Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Despite months of config, still having connection issues

    Scheduled Pinned Locked Moved General pfSense Questions
    29 Posts 6 Posters 2.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      rheritier @JonathanLee
      last edited by

      @JonathanLee OK! I'll try that then!
      I'll probably reset my netgate to start from scratch.

      JonathanLeeJ R 2 Replies Last reply Reply Quote 0
      • JonathanLeeJ
        JonathanLee @rheritier
        last edited by

        @rheritier remember to simple first, do only transparent mode. Make sure you have the correct ACL for DNS, HTTP, https etc also.

        Good luck.

        Make sure to upvote

        1 Reply Last reply Reply Quote 0
        • R
          rheritier @SteveITS
          last edited by

          @SteveITS Here it is!
          Yes, someone told me wifi was an issue and to hardwire my meshs but where they are located make hardwire impossible.
          But I still have the same issues even when I only keep 1 mesh on, which is hardwired on the Netgate...

          Here is the result of the quality:

          Screen Shot 2023-09-22 at 10.18.31 AM.png

          1 Reply Last reply Reply Quote 0
          • R
            rheritier @rheritier
            last edited by

            @JonathanLee Thanks Jonathan

            I'll start with transparent mode.
            On the ACL, should putting what I have below helps limiting the system blocking some websites? (example: *.com to leave all website in .com accessible)?
            I need to learn more about the DNS and its configuration also.

            Screen Shot 2023-09-22 at 10.22.58 AM.png

            JonathanLeeJ 1 Reply Last reply Reply Quote 0
            • JonathanLeeJ
              JonathanLee @rheritier
              last edited by JonathanLee

              @rheritier I just have that set as .* for allow all. Squidguard does my blocking

              Keep it simple

              Screenshot_20230922-072758.png
              Regular expression based works great

              Make sure to upvote

              1 Reply Last reply Reply Quote 0
              • R
                rheritier
                last edited by

                Thanks @JonathanLee, I like that!!
                Will try it now

                JonathanLeeJ 1 Reply Last reply Reply Quote 0
                • JonathanLeeJ
                  JonathanLee @rheritier
                  last edited by JonathanLee

                  @rheritier

                  https://docs.netgate.com/pfsense/en/latest/recipes/http-client-proxy-transparent.html
                  really good transparent mode guide

                  https://docs.netgate.com/pfsense/en/latest/packages/cache-proxy/squidguard.html
                  squidguard guide

                  Make sure to upvote

                  1 Reply Last reply Reply Quote 0
                  • R
                    rheritier
                    last edited by

                    So I did everything so far and it seem it is a bit smoother and block less things.
                    But I still have for example difficult access to Amazon App. I have to deselect the wifi, let it charge a bit, reselect the Wifi and then it'll work propertly.

                    Here is the screenshot of my Firewall block. Anyone sees something specific??

                    Screenshot 2023-09-22 134602.png

                    JonathanLeeJ 1 Reply Last reply Reply Quote 0
                    • JonathanLeeJ
                      JonathanLee @rheritier
                      last edited by

                      @rheritier do you have any IPv6 access?

                      Make sure to upvote

                      R 1 Reply Last reply Reply Quote 0
                      • R
                        rheritier @JonathanLee
                        last edited by

                        @JonathanLee Hi Jonathan,
                        I'm not sure what to think and tell you since both test seems to show different results.
                        Is there another way to test?

                        Screen Shot 2023-09-24 at 10.12.15 AM.png

                        Screen Shot 2023-09-24 at 10.12.31 AM.png

                        JonathanLeeJ GertjanG 2 Replies Last reply Reply Quote 0
                        • JonathanLeeJ
                          JonathanLee @rheritier
                          last edited by

                          @rheritier does your wan configuration on PfSense show anything for IPv6?

                          Make sure to upvote

                          R 1 Reply Last reply Reply Quote 0
                          • R
                            rheritier @JonathanLee
                            last edited by

                            @JonathanLee here is my WAN config:
                            Screen Shot 2023-09-24 at 10.45.02 PM.png Screen Shot 2023-09-24 at 10.45.13 PM.png Screen Shot 2023-09-24 at 10.45.20 PM.png

                            1 Reply Last reply Reply Quote 0
                            • GertjanG
                              Gertjan @rheritier
                              last edited by

                              @rheritier said in Despite months of config, still having connection issues:

                              since both test seems to show different results

                              The tests are different.

                              You visited https://test-ipv6.com/ from your PC.
                              You should have run the ping version IPv6 test also from your PC, like

                              C:\Users\Gauche>ping -6 2001:4860:4860::8888
                              
                              Envoi d’une requête 'Ping'  2001:4860:4860::8888 avec 32 octets de données :
                              Réponse de 2001:4860:4860::8888 : temps=17 ms
                              Réponse de 2001:4860:4860::8888 : temps=17 ms
                              Réponse de 2001:4860:4860::8888 : temps=17 ms
                              Réponse de 2001:4860:4860::8888 : temps=17 ms
                              

                              And and before running such test, why not asking your PC if it has any IPv6 connection available ? :

                              C:\Users\Gauche>ipconfig /all
                              

                              Your pfSense IPv6 ping test (Diagnostics > Ping) shows that pfSEnse has an IPv6 connection.
                              Your WAN setup says it used the DHCPv6 client to obtain "IPv6".

                              Most probably, you should set up your LAN interface to use IPv6, like this (example ) :
                              bb7b96f1-ba7e-45bc-b71e-0fd450b7931b-image.png

                              and the DHCPv6 LAN server :

                              59b6c2e3-af5f-482b-85ff-95ddc6a6b77d-image.png

                              also :

                              20ff6cd5-fa9d-4458-8e97-3cbd62724575-image.png

                              This WAN IPv6 :

                              451ca002-69e9-4c44-89c5-6595befc32f0-image.png

                              is also listed here : Status > Interfaces under the WAN interface.

                              No "help me" PM's please. Use the forum, the community will thank you.
                              Edit : and where are the logs ??

                              1 Reply Last reply Reply Quote 1
                              • R
                                rheritier
                                last edited by rheritier

                                Hi @Gertjan ! Thanks!
                                So I did the following:
                                Ipconfig /all (on Mac, it seems to be /sbins/ifconfig) and here is the result (I hided some info):

                                lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
                                options=1203<RXCSUM,TXCSUM,TXSTATUS,SW_TIMESTAMP>
                                inet 127.0.0.1 netmask 0xff000000
                                inet6 ::1 prefixlen 128
                                inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1
                                nd6 options=201<PERFORMNUD,DAD>
                                gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
                                stf0: flags=0<> mtu 1280
                                en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
                                options=50b<RXCSUM,TXCSUM,VLAN_HWTAGGING,AV,CHANNEL_IO>
                                ether a8:XXXX:22:00:f6
                                nd6 options=201<PERFORMNUD,DAD>
                                media: autoselect (none)
                                status: inactive
                                en1: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
                                options=400<CHANNEL_IO>
                                ether 20:XXXX:cc:ba:15
                                inet6 fe80::XXXX:9648:76df:976d%en1 prefixlen 64 secured scopeid 0x5
                                inet 192.168.1.110 netmask 0xffffff00 broadcast 192.168.1.255
                                inet6 fd2b:XXXX:5617:48b5:86e:6bad:9d1b:b18c prefixlen 64 autoconf secured
                                inet6 fd2b:XXXX:5617:48b5:a56c:fca1:5cfb:5727 prefixlen 64 autoconf temporary
                                nd6 options=201<PERFORMNUD,DAD>
                                media: autoselect
                                status: active
                                en2: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
                                options=460<TSO4,TSO6,CHANNEL_IO>
                                ether 82:XXXX:fe:0c:80
                                media: autoselect <full-duplex>
                                status: inactive
                                fw0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 4078
                                lladdr a8:XXXX:ff:fe:67:f8:32
                                nd6 options=201<PERFORMNUD,DAD>
                                media: autoselect <full-duplex>
                                status: inactive
                                bridge0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
                                options=63<RXCSUM,TXCSUM,TSO4,TSO6>
                                ether 82:XXXX:fe:0c:80
                                Configuration:
                                id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
                                maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
                                root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
                                ipfilter disabled flags 0x0
                                member: en2 flags=3<LEARNING,DISCOVER>
                                ifmaxaddr 0 port 6 priority 0 path cost 0
                                nd6 options=201<PERFORMNUD,DAD>
                                media: <unknown type>
                                status: inactive
                                p2p0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 2304
                                options=400<CHANNEL_IO>
                                ether 02:XXXX:cc:ba:15
                                media: autoselect
                                status: inactive
                                awdl0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1484
                                options=400<CHANNEL_IO>
                                ether 5e:XXXX:3f:da:96
                                inet6 fe80::XXXX:21ff:fe3f:da96%awdl0 prefixlen 64 scopeid 0xa
                                nd6 options=201<PERFORMNUD,DAD>
                                media: autoselect
                                status: active
                                utun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1380
                                inet6 fe80::XXXX:a585:1912:fde8%utun0 prefixlen 64 scopeid 0xb
                                nd6 options=201<PERFORMNUD,DAD>
                                utun1: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 2000
                                inet6 fe80::XXXX:88f8:a44f:abd7%utun1 prefixlen 64 scopeid 0xc
                                nd6 options=201<PERFORMNUD,DAD>

                                I tried to ping as said at the beginning but it didn't give much (I search and found on Mac it should be ping -l...but it didn't work either):
                                ping -l 2001:4860:4860::8888
                                ping: invalid preload value: `2001:4860:4860::8888'

                                Then I followed your recommendation and had the same setup for the 1st screen (set up LAN interface to sue IPv6), change the range as per your example from 2 to 86 (mine was from 1000 to 2000), and on last screen, changed the Router Mode from "Assisted" to "Managed".

                                I saw you hided some info so did the same. Here is what I have in Status/Interface/WAN (by the way, what is this big "Release WAN" in red? should I do it?)

                                Screen Shot 2023-09-26 at 12.22.02 AM.png

                                GertjanG 1 Reply Last reply Reply Quote 0
                                • GertjanG
                                  Gertjan @rheritier
                                  last edited by

                                  @rheritier said in Despite months of config, still having connection issues:

                                  Ipconfig /all (on Mac, it seems to be /sbins/ifconfig) and here is the result

                                  Not really.
                                  See ipconfig command for Mac and ... you'll get no answer.

                                  I wanted to see this :

                                  C:\Users\Gauche>ipconfig /all
                                  
                                  Configuration IP de Windows
                                  
                                     Nom de l’hôte . . . . . . . . . . : Gauche2
                                     Suffixe DNS principal . . . . . . :
                                     Type de noeud. . . . . . . . . .  : Hybride
                                     Routage IP activé . . . . . . . . : Non
                                     Proxy WINS activé . . . . . . . . : Non
                                     Liste de recherche du suffixe DNS.: bhf.tld
                                  
                                  Carte Ethernet Ethernet :
                                  
                                     Suffixe DNS propre à la connexion. . . : bhf.tld
                                     Description. . . . . . . . . . . . . . : Intel(R) Ethernet Connection (11) I219-LM
                                     Adresse physique . . . . . . . . . . . : A4-BB-6D-BA-16-A1
                                     DHCP activé. . . . . . . . . . . . . . : Oui
                                     Configuration automatique activée. . . : Oui
                                     Adresse IPv6. . . . . . . . . . . . . .: 2a01:cb19:907:dead::c7(préféré)
                                     Bail obtenu. . . . . . . . . . . . . . : dimanche 17 septembre 2023 12:09:05
                                     Bail expirant. . . . . . . . . . . . . : mardi 26 septembre 2023 18:53:29
                                     Adresse IPv6 de liaison locale. . . . .: fe80::daa9:bcf8:99cd:717e%11(préféré)
                                     Adresse IPv4. . . . . . . . . . . . . .: 192.168.1.6(préféré)
                                     Masque de sous-réseau. . . . . . . . . : 255.255.255.0
                                     Bail obtenu. . . . . . . . . . . . . . : dimanche 17 septembre 2023 12:09:03
                                     Bail expirant. . . . . . . . . . . . . : mercredi 27 septembre 2023 06:53:26
                                     Passerelle par défaut. . . . . . . . . : fe80::92ec:77ff:fe29:392c%11
                                                                         192.168.1.1
                                     Serveur DHCP . . . . . . . . . . . . . : 192.168.1.1
                                     IAID DHCPv6 . . . . . . . . . . . : 346340205
                                     DUID de client DHCPv6. . . . . . . . : 00-01-00-01-26-59-DF-8D-A4-BB-6D-BA-16-A1
                                     Serveurs DNS. . .  . . . . . . . . . . : 2a01:cb19:907:dead:beef:77ff:fe29:392c
                                                                         192.168.1.1
                                     NetBIOS sur Tcpip. . . . . . . . . . . : Activé
                                     Liste de recherche de suffixes DNS propres à la connexion :
                                                                         bhf.tld
                                  

                                  This doesn't hardware aspect of the interface, but : It got an IPv4 using DHCP, who is the DHCP server (192.168.1.1 == pfSense), and the same info about IPv6.
                                  Also : who is my DNS for this PC (pfSense).

                                  @rheritier said in Despite months of config, still having connection issues:

                                  ping -l 2001:4860:4860::8888

                                  '-l' ? Try

                                  ping6 2001:4860:4860::8888
                                  

                                  Although a ping using ICMPv6 will only work if you obtained IPv6 by using DHCPv6 (client) or a static IPv6 assignment (don't forget the IPv6 gateway, don't forget the DNSv6)

                                  @rheritier said in Despite months of config, still having connection issues:

                                  by the way, what is this big "Release WAN" in red? should I do it?

                                  On your WAN interface, you use DHCPv4 and/or DHCPv6 to obtain a IPv4 lease and / or IPv6 info.
                                  Leases can be released 😊

                                  So that's what the button does. You rarely, if never, need to do that.
                                  If you were editing the DHCP server settings of the upstream server, you would : validate your settings, and the release, and renew the IPs of your WAN to have tour pfSense reconnect again using the new lease info.
                                  You could also remove the WAN cable for a short moment, and re insert it.

                                  Btw : my pfSense LAN :

                                  8d6b5bc7-6b6d-46e7-871f-d1da1d8817fa-image.png

                                  On the DHCPv6 LAN server page : check :

                                  5a2320e9-f370-4003-8172-378082fd9e5a-image.png

                                  No "help me" PM's please. Use the forum, the community will thank you.
                                  Edit : and where are the logs ??

                                  1 Reply Last reply Reply Quote 0
                                  • JonathanLeeJ
                                    JonathanLee
                                    last edited by

                                    Also if you enabled DHCP6 you need to set Squid to listen on IPV6 too as clients have IPv6 access

                                    Make sure to upvote

                                    R 1 Reply Last reply Reply Quote 0
                                    • R
                                      rheritier @JonathanLee
                                      last edited by

                                      @JonathanLee noted!
                                      This is the only change to bring to do so, right?

                                      Screen Shot 2023-09-26 at 10.33.21 AM.png

                                      JonathanLeeJ 1 Reply Last reply Reply Quote 1
                                      • JonathanLeeJ
                                        JonathanLee @rheritier
                                        last edited by

                                        @rheritier yes as long as IPv6 clients know where the proxy is your good to go.

                                        Make sure to upvote

                                        1 Reply Last reply Reply Quote 0
                                        • First post
                                          Last post
                                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.