Intermittent freezes of web GUI, complete block of outgoing WAN traffic
-
@OhYeah-0 said in Intermittent freezes of web GUI, complete block of outgoing WAN traffic:
pfsense will not ping any outside IP address or hostname from console, but will ping LAN IP addresses
OK I would concentrate on this. I assume 'LAN addresses' means other hosts inside the LAN subnet? Those are things it can reach directly as long as they respond to ARP. Anything outside it's own local subnets requires routing so I would check that it still has a default route and that it's the correct one. So Diag > Routes in the GUI or
netstat -rnat the CLI.
If it's wrong then make sure you set the default IPv4 gateway to the WAN gateway specifically rather than automatic in System > Routing > Gateways.Steve
-
I assume 'LAN addresses' means other hosts inside the LAN subnet? << Yes.
So Diag > Routes in the GUI or netstat -rn at the CLI. << Since GUI cannot be reached I will try it from the console the next time it happens. Thanks for the tip.
-
You should also try it now so you know what it looks like when it's working correctly.
-
@stephenw10 said in Intermittent freezes of web GUI, complete block of outgoing WAN traffic:
You should also try it now so you know what it looks like when it's working correctly.
Just had a small, max 5 minute blackout again, ran netstat -rn from console and everything there was OK.
-
Can it ping anything in the WAN subnet?
Is the gateway in the ARP table?
There has to be some reason it stops being able to pass traffic on WAN.
-
@stephenw10 said in Intermittent freezes of web GUI, complete block of outgoing WAN traffic:
Can it ping anything in the WAN subnet?
Is the gateway in the ARP table?
There has to be some reason it stops being able to pass traffic on WAN.
It doesn't ping anything, including our main firewall (which is running on pfsense also).
What makes it stranger still that it continues to reply to ping coming from outside.
As for the gateway ARP table, I will try to check it next time from console. I did check if ARP entries were okay on the main firewall (thinking this could possibly be the culprit), but all was fine there.
-
@OhYeah-0 said in Intermittent freezes of web GUI, complete block of outgoing WAN traffic:
What makes it stranger still that it continues to reply to ping coming from outside.
A ping that is already running? Could indicate the state table exhausted. Though I'd expect to see logs indicating that.
-
@stephenw10 said in Intermittent freezes of web GUI, complete block of outgoing WAN traffic:
@OhYeah-0 said in Intermittent freezes of web GUI, complete block of outgoing WAN traffic:
What makes it stranger still that it continues to reply to ping coming from outside.
A ping that is already running? Could indicate the state table exhausted. Though I'd expect to see logs indicating that.
No, not only. The number of states is very low. There is currently only one server hosted with us with low to moderate usage by a couple of people.
-
Hmm, still feels like a bad default route then. Since incoming traffic on WAN hits a reply-to rule there replies from the firewall have a route back even if no route is present.
What error is shown when you try to ping something external from the firewall?
-
Case solved.
The cause of the problems was somewhat embarrassing. It turns out that the WAN IP had been in use previously (years ago) and it was still tied to another firewall/router as a virtual IP on the same network and I simply never managed to catch the ARP conflict live in the perimeter firewall.
My faith in pfsense is restored but the faith in my own IQ is severely diminished. Thanks for help and have a nice weekend.
-
Ah, good result! Interesting that pfSense didn't log that. I would normally expect to see 'xxxx is using my IP address' entries.
