DNS resolver exiting when loading pfblocker 25.03.b.20250409.2208

RobbieTT

Over 72 hrs since my last boot and zero issues with the false interface errors. Packages are happy and DNS resolver has a healthy cache again. Looking like a fix.

@stephenw10 said in DNS resolver exiting when loading pfblocker 25.03.b.20250409.2208:

The fix for VIPs on PPPoE went into that beta. But I'm not sure how that would affect LAN...

Well it didn't really look like a genuine LAN issue from the start. Multiple DACs, vendors and different physical interfaces all showed the same issue.

Regress to v24.11 and the issue went away. Simple DHCP on the WAN to another router and the issue went away again. Remove IPv6 and the issue went away. Use v25.03b with the old PPPoE and the issue went away.

With v25.03b + PPPoE + IPv6 and the problem exerted itself, perhaps with the odd unsolicited RA in the mix, producing the loose periodicity noted. That and perhaps the new SFP28 driver.

Anyway, I am just a sample size of one but so far it all looks good with beta 0610.

I've got logs pre and post fix if required.

️

stephenw10

Nice. More fixes are incoming for various things.

If you're able to test this patch that would be good: https://forum.netgate.com/post/1218007

It works fine everywhere I've tested it but, as we are finding, there are significant differences in pppoe connections.

RobbieTT

@stephenw10
This one?

https://nc.netgate.com/nextcloud/s/bt2fWWjdzT4KFHy

What should it do?

It does not work for me though:

Patch does not apply cleanly (detail) 
Patch does not revert cleanly (detail) 

Debug Result: Fail

This patch does not apply or revert cleanly.
The patch settings may be incorrect, the patch content may not be relevant to this version, or the patch may depend upon another separate patch which must be applied first.

️

stephenw10

Oh it's probably for 2.8 and you're on the latest 25.03-beta. I'll get a diff for that tomorrow.

It allows for ISPs that don't send RAs. Otherwise the gateway is never populated. But we need to be sure it doesn't break anything in the process! (I'm pretty sure it doesn't ).

RobbieTT

@stephenw10

Ok, that makes sense.

️

w0w

@stephenw10 said in DNS resolver exiting when loading pfblocker 25.03.b.20250409.2208:

Oh it's probably for 2.8 and you're on the latest 25.03-beta. I'll get a diff for that tomorrow.

Any news about diff for 25.03, @stephenw10?

stephenw10

Checking...

stephenw10

OK try this. It should apply against the June 10th 25.03 build.

1229.diff

w0w

@stephenw10
Awesome, I applied the patch and testing.

RobbieTT

@stephenw10 said in DNS resolver exiting when loading pfblocker 25.03.b.20250409.2208:

OK try this. It should apply against the June 10th 25.03 build.

Applied and testing.

2025-06-17 08:48:44.587745+01:00	php-fpm	64902	System Patches: Patch applied successfully (ID: 685080088725a, DESCR: PPPoE IPv6 RA Changes 685080088725a for 25.03.b.20250610.1659)

Well, presuming 'applied successfully' means no reboot required?

️

stephenw10

Yup you shouldn't need a reboot there. The scripts get run at interface events and will have changed after applying the patch.

w0w

Probably this is not related to the current patch, ... I think this issue has been present since the early 23.05 versions, but I’ve only recently started to understand what’s going on. Sometimes, but not always, when PPPoE disconnects and reconnects, I receive an IPv6 address on the WAN interface, but nothing is assigned on the LAN interface, which is configured as a track interface. After some time, the IPv6 address on the WAN interface also disappears. I’ll try to collect logs later.

RobbieTT

@w0w
Check that:

net.inet6.ip6.rfc6204w3=1

Just to be sure...

️

w0w

@RobbieTT said in DNS resolver exiting when loading pfblocker 25.03.b.20250409.2208:

net.inet6.ip6.rfc6204w3

Hmm, does it reflected in pfSense GUI somewhere? I don't have this option at all when listing sysctl net.inet6.ip6, I can add it via tunables anyway, but…

stephenw10

Check it at the command line:

[2.8.0-RELEASE][admin@t70.stevew.lan]/root: sysctl -d net.inet6.ip6.rfc6204w3
net.inet6.ip6.rfc6204w3: Accept the default router list from ICMPv6 RA messages even when packet forwarding is enabled
[2.8.0-RELEASE][admin@t70.stevew.lan]/root: sysctl  net.inet6.ip6.rfc6204w3
net.inet6.ip6.rfc6204w3: 1

It should be 1 by default. You'll only see it in the tunables list if it's been added as a custom value.

w0w

@stephenw10
Now I have

net.inet6.ip6.rfc6204w3=1

Nothing has changed. Manually disconnecting and reconnecting can result in no IPv6 on WAN, or IPv6 being present on both WAN and LAN, and sometimes it initially appears on WAN but disappears from WAN later.

I am not sure it pfSense, it can be my ISP. I see nothing helpful in the logs currently.
BTW, sometimes the uptime is also missing, and clients have no internet access — they cannot ping external sites by name or IP, also directly can not ping from pfSense. However, I can resolve names using DNS lookup on the pfSense, so Unbound is somehow working. But when I check the routes, it looks like the default route is missing — there is no 0.0.0.0 route at all.

This is happening often when playing manual disconnect and connect after.

stephenw10

Ok well that seem unrealted to IPv6 or Unbound so it should probably be in a different thread.

However I would check the output of pppcfg pppoe0 when that happens. It looks like it's not connecting at all.

w0w

@stephenw10

@stephenw10 said in DNS resolver exiting when loading pfblocker 25.03.b.20250409.2208:

It looks like it's not connecting at all.

I don't think so. You can see gateway status on the screenshot and pppoe0 is in routes list, but not default.

@stephenw10 said in DNS resolver exiting when loading pfblocker 25.03.b.20250409.2208:

Ok well that seem unrealted to IPv6 or Unbound so it should probably be in a different thread.

Sure. I think I will do further tests on weekend or when it's possible and post back in another thread.

stephenw10

Hmm, but it shows no IP address against the pppoe gateway and the RTT at 0.5ms seems too low to be real.

If you're using if_pppoe it will show an uptime if it's really connected.

RobbieTT

@stephenw10 said in DNS resolver exiting when loading pfblocker 25.03.b.20250409.2208:

Nice. More fixes are incoming for various things.

The latest IPv6 RA patch has had no adverse consequences on my test setup.

Relative trivia but a very easy thing to fix with the 'various things':

2025-06-18 08:34:03.000000+01:00	nginx	-	2025/06/18 08:34:03 [error] 333#100367: *9037 open() "/usr/local/www/apple-touch-icon.png" failed (2: No such file or directory), client: 2a02:xxx:xxxx:1:xxxx:xxxx:xxxx:b6bd, server: , request: "GET /apple-touch-icon.png HTTP/2.0", host: "router-7.xxxxxxx.me:8443"
2025-06-18 08:34:03.000000+01:00	nginx	-	2025/06/18 08:34:03 [error] 333#100367: *9037 open() "/usr/local/www/apple-touch-icon-precomposed.png" failed (2: No such file or directory), client: 2a02:xxx:xxxx:1:xxxx:xxxx:xxxx:b6bd, server: , request: "GET /apple-touch-icon-precomposed.png HTTP/2.0", host: "router-7.xxxxxxx.me:8443"

️