Network becomes totally unusable when my parents connect
-
@RickyBaker said in Network becomes totally unusable when my parents connect:
I simply don't know what to do and REALLY don't want to reattach all my hundreds of devices again....
If you have DHCP configured as you describe, there is nothing to "attach". Simply put them on the wire and let them acquire an IP address from DHCP. I suspect you need to greatly simplify this network of yours. It seems you are trying to be too clever by half and clicking/configuring yourself into non-functionality ...
Keep it simple.
-
@bmeeks said in Network becomes totally unusable when my parents connect:
Simply put them on the wire and let them acquire an IP address from DHCP.
what do you mean put them on the wire? I would be recreating all the assignments and interfaces/rules. I'm sure I'd do something wrong. But good point, if I leave the SSID the same all the Wifi devices should reconnect eventually....
And you are certainly right about the cleverness. I don't know how to fix it so yeah. it's too clever for me....
-
@bmeeks said in Network becomes totally unusable when my parents connect:
@RickyBaker said in Network becomes totally unusable when my parents connect:
I do not remember ever turning this on.
It is not enabled out-of-the-box with any pfSense installation. It had to be enabled by you or another admin.
Not in my case. I've seen this enabled by default in recent version of pfSense CE. YMMV, but in any case, as long as OP is not using IPv6 on WAN, there's no reason he can't turn it off.
-
I agree with those that say it sounds like a network loop. I'm not sure the Unifi controller will really tell you precisely where the loop is, though it will tell you ports its disabling, which might give you a place to start.
If I were troubleshooting this, I'd do two things.
- I would disable mesh functions in the wifi completely.
- I would pull all wiring and reconnect one step at a time. Connect first switch to router, attach wired systems that typically attach to first switch, and test. If all is well, connect second downlink switch, reattach all its clients, and test again. Once all switches are connected, start reconnecting wireless APs and testing as you go. Continue until everything is working, or until something goes sideways.
As far as network loops, since you are serving multiple floors, I'd make sure there's not something strange going on like a cat6 cable connecting two wall jacks.
Might be worth checking the wiring
-
@bp81 well thanks for the suggested steps. One question though. If my non POE switch is what's connected to the pfsense, I would in a sense be testing as many non-wifi devices as possible first? without any APs/WiFi? Then plug in the POE switch and plug one AP at a time in? then other POE devices?
-
@RickyBaker said in Network becomes totally unusable when my parents connect:
@Patch said in Network becomes totally unusable when my parents connect:
You have a VPN. How is that segmented on your network?
Does this have the information you were asking about?
Repeating the question does not provide an answer.
The reason for VPN segmentation information is I believe it can cause asymmetric routing if not configured appropriately.
But I still recommend you find your fault by drastically simplify your network then progressively rebuilding it.
Your network verbal description suggests you have some network complexity, so for others to help a network diagram is required. Drawing one would probably also result in you identifying the problem.
-
@Patch said in Network becomes totally unusable when my parents connect:
Repeating the question does not provide an answer.
I'm very sorry my screenshot doesn't seem to have loaded:
login-to-viewYes I'm in front of my rack right now trying to troubleshoot. First I did a speed test on the Wifi and then hardwired to the nonPOE switch and the diffferences were drastic. Perhaps the poor internet I experienced on the hardwired PC was actually due to it being ancient and not the internet. I wouldn't say my laptop directly connected is the snappiest internet experience i've ever had but it's def usable.
login-to-view
login-to-viewSo sorry for the red herring. I unplugged everything then slowly started plugging things back in and the previously blocked AP again was blocked due to STP. I even changed the Static IP it's assigned an still blocked. HOWEVER when I switched the port it was plugged into it grabbed a signal and was not blocked. Albeit at a FE speed and not the GbE speeds I was expecting (and a warning about Poor Ethernet Link Speeds)
login-to-viewI even switched the static IP back to what it was before and it still connected without being blocked. It is only when it's plugged into port 48. i even copied the settings from the port that did work to the one that didn't and still it was blocked by STP. I don't even know if this is the issue, seems like that cable could stand to be reterminated but since I still had issues with it completely unplugged I'm guessing that's not gonna solve my problem. At least I have it actually narrowed down to the WiFi specifically now..
-
Since it's WiFi should any of these options inside Unifi be enabled or disabled? I disabled the UDP Broadcast Relay that I had painstakingly built inside pfsense to no affect...
login-to-view -
this i gather from googling is quite bad
login-to-viewBut i dunno what it's implying or how to fix it. Can anyone point me in the right direction?
-
@RickyBaker telling you the response time from your gateway way monitoring is high.. It defaults to 500ms I believe.. which would make sense for what your seeing.. But 500ms is really really high for ping time to your gateway..
You would hope your gateway, ie first device you hit in your isp network that 99.124.237.246 IP should answer more like 10 to say 30ms max... If you were fiber you could see more like 2 or 3ms..
Mine flux between say 10-12ms
Could be your saturating your link..
-
@johnpoz link saturated as in too much traffic from devices going from the LAN to the Internet? Or both ways? I have att fiber. What would be my next troubleshooting step?
-
Either way could affect it.
But the first thing to do is set the monitoring IP to something remote. The gateway could just be deprioritising ping replies.
https://docs.netgate.com/pfsense/en/latest/routing/gateway-configure.html
-
@RickyBaker well normally the upload would be what would kill the latency to your gateway..
I would look to see how much traffic your sending in pfsense traffic graphs.. I would think your connection would have to be just utterly pegged to cause that kind of latency.
You're on fiber - normally those response times from your ISPs are way way low - like few ms only so seeing plus 500ms is insane. And normally fiber has nice fat pipe, like gig/gig - while I am stuck on shitty cable with 500/50 --
And this only happens when your parents device(s) connect? What is your normal latency show when network is working normal.. You can look in monitoring for that.
Or should show just on your gateway widget..
Example I currently have like 6 people streaming off my plex, on my 50Mbps up connection using like 40Mbps or so, etc.. And it put a hurt on my normally 10-12ms ping times to my gateway
edit: and yeah Steve is right you should see if its just your gateway being shitty and not answering you very fast - you could try some other IP on the internet, say 8.8.8.8 for example if your connection is not saturated.
-
@johnpoz said in Network becomes totally unusable when my parents connect:
o
That 4680 is still going strong....
-
@michmoor so your not seeing any real traffic on your wan in either direction, and your still seeing 500ms logs... Or currently your not seeing those events?
Yeah 4860 - great box! rocks for anything would ever need with my 500/50 connection that is for damn sure.. Wish I could put it through its paces with gig/gig ;) but just no option for me available. It never really even breaks a sweat for me..
-
@johnpoz said in Network becomes totally unusable when my parents connect:
@michmoor so your not seeing any real traffic on your wan in either direction, and your still seeing 500ms logs... Or currently your not seeing those events?
Yeah 4860 - great box! rocks for anything would ever need with my 500/50 connection that is for damn sure.. Wish I could put it through its paces with gig/gig ;) but just no option for me available. It never really even breaks a sweat for me..
Didn’t mean to taint the thread. Your question is to the OP.
But yeah that 4680 is an amazing little device. How long have you had it?
As an aside I got a 1100 at my mom’s place and that’s just so impressive. No fuss. Handles 300/25Mbps with easiness -
@michmoor its getting a bit long in the tooth.. Sometime round end of 2017, early 2018..
edit: found this old post, pictures must of gotten lost in one of the previous forum updates, but here is post when I got it
https://forum.netgate.com/post/740935
So would been right around 12/13/2017 ;)
-
@stephenw10
Changed the Monitoring ip to the google name servers, I see this in the log and no more alarms but maybe it just hasn't tested it yet? or maybe it just hasn't failed yetI pulled up that Gateways widget an when it first loaded I had a big red warning about the gateway but that changed to Online pretty quick. I'm gonna let the monitoring IP stay 8.8.8.8 for a little bit to see what's up but then i'll change it back and see what we got
@johnpoz said in Network becomes totally unusable when my parents connect:
Mine flux between say 10-12ms
I didn't know how to add that graph, any tips would be appreciated.
On another front I called AT&T and just complained and they are sending me a new router tomorrow, as mine was 5+ years old and they seemed unwilling to troubleshoot with me until it's replaced....
-
@RickyBaker had you just changed it when you took that widget screenshot - because 50ms with a SD of 140ms is insane to google
Which graph - monitoring, just pick the stuff you want to see.. for traffic just go to traffic graph - both under status tab.
-
@johnpoz the one in this post: https://forum.netgate.com/post/1212585
i'll explore the status tab further, I was thinking it was a widget you add to the homepage
Possible non-sequitur but i ran across this post as I was trying to google how best to set up my new ATT modem/ONT (BGW320-500)
https://docs.netgate.com/pfsense/en/latest/recipes/authbridge.htmland I remember this! when i first set up my router, but eventually had an IT guy from my work set it up for me. The top 2 use-cases it mentions are:
Modem Memory Limitations
The fiber modem may still track states even in IP-Passthrough mode. Some modems have a hard limit on the number of states that they can handle at a time, becoming unstable under significant load.Limitations in IPv6 Implementation
In IP-Passthrough mode the modem is usually provisioned with an IPv6 prefix (/60 for AT&T, for example), but will only hand out a single /64 prefix out of the larger allocation via DHCP-PD to the firewall. This means that only a single LAN on the firewall can be provisioned with IPv6 by default. It is possible to request multiple /64 networks out of the IPv6 prefix block, but that is an ugly workaround.Both of these seem like they could manifest as the weird IP6/DNS ghosts I was/am experiencing. I also noticed that my Current Modem isn't in IP Passthrough mode, which I simply don't understand. I remember earlier in this tread i couldn't understand why Track Interface selection under IPv7 Configuration Type of the LAN. It HAD to come from this....
Also should be noted that despite this supposed to be to remove the Modem from the loop, my modem was very much attached.