Intermittent freezes of web GUI, complete block of outgoing WAN traffic
-
I assume 'LAN addresses' means other hosts inside the LAN subnet? << Yes.
So Diag > Routes in the GUI or netstat -rn at the CLI. << Since GUI cannot be reached I will try it from the console the next time it happens. Thanks for the tip.
-
You should also try it now so you know what it looks like when it's working correctly.
-
@stephenw10 said in Intermittent freezes of web GUI, complete block of outgoing WAN traffic:
You should also try it now so you know what it looks like when it's working correctly.
Just had a small, max 5 minute blackout again, ran netstat -rn from console and everything there was OK.
-
Can it ping anything in the WAN subnet?
Is the gateway in the ARP table?
There has to be some reason it stops being able to pass traffic on WAN.
-
@stephenw10 said in Intermittent freezes of web GUI, complete block of outgoing WAN traffic:
Can it ping anything in the WAN subnet?
Is the gateway in the ARP table?
There has to be some reason it stops being able to pass traffic on WAN.
It doesn't ping anything, including our main firewall (which is running on pfsense also).
What makes it stranger still that it continues to reply to ping coming from outside.
As for the gateway ARP table, I will try to check it next time from console. I did check if ARP entries were okay on the main firewall (thinking this could possibly be the culprit), but all was fine there.
-
@OhYeah-0 said in Intermittent freezes of web GUI, complete block of outgoing WAN traffic:
What makes it stranger still that it continues to reply to ping coming from outside.
A ping that is already running? Could indicate the state table exhausted. Though I'd expect to see logs indicating that.
-
@stephenw10 said in Intermittent freezes of web GUI, complete block of outgoing WAN traffic:
@OhYeah-0 said in Intermittent freezes of web GUI, complete block of outgoing WAN traffic:
What makes it stranger still that it continues to reply to ping coming from outside.
A ping that is already running? Could indicate the state table exhausted. Though I'd expect to see logs indicating that.
No, not only. The number of states is very low. There is currently only one server hosted with us with low to moderate usage by a couple of people.
-
Hmm, still feels like a bad default route then. Since incoming traffic on WAN hits a reply-to rule there replies from the firewall have a route back even if no route is present.
What error is shown when you try to ping something external from the firewall?
-
Case solved.
The cause of the problems was somewhat embarrassing. It turns out that the WAN IP had been in use previously (years ago) and it was still tied to another firewall/router as a virtual IP on the same network and I simply never managed to catch the ARP conflict live in the perimeter firewall.
My faith in pfsense is restored but the faith in my own IQ is severely diminished. Thanks for help and have a nice weekend.
-
Ah, good result! Interesting that pfSense didn't log that. I would normally expect to see 'xxxx is using my IP address' entries.
