Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNS resolver exiting when loading pfblocker 25.03.b.20250409.2208

    Scheduled Pinned Locked Moved Plus 25.07 Develoment Snapshots
    124 Posts 4 Posters 11.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • w0wW
      w0w @RobbieTT
      last edited by

      @RobbieTT said in DNS resolver exiting when loading pfblocker 25.03.b.20250409.2208:

      net.inet6.ip6.rfc6204w3

      Hmm, does it reflected in pfSense GUI somewhere? I don't have this option at all when listing sysctl net.inet6.ip6, I can add it via tunables anyway, but…

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        Check it at the command line:

        [2.8.0-RELEASE][admin@t70.stevew.lan]/root: sysctl -d net.inet6.ip6.rfc6204w3
net.inet6.ip6.rfc6204w3: Accept the default router list from ICMPv6 RA messages even when packet forwarding is enabled
[2.8.0-RELEASE][admin@t70.stevew.lan]/root: sysctl  net.inet6.ip6.rfc6204w3
net.inet6.ip6.rfc6204w3: 1

        It should be 1 by default. You'll only see it in the tunables list if it's been added as a custom value.

        w0wW 1 Reply Last reply Reply Quote 1
        • w0wW
          w0w @stephenw10
          last edited by

          @stephenw10
          Now I have

          net.inet6.ip6.rfc6204w3=1

          Nothing has changed. Manually disconnecting and reconnecting can result in no IPv6 on WAN, or IPv6 being present on both WAN and LAN, and sometimes it initially appears on WAN but disappears from WAN later.

          I am not sure it pfSense, it can be my ISP. I see nothing helpful in the logs currently.
          BTW, sometimes the uptime is also missing, and clients have no internet access — they cannot ping external sites by name or IP, also directly can not ping from pfSense. However, I can resolve names using DNS lookup on the pfSense, so Unbound is somehow working. But when I check the routes, it looks like the default route is missing — there is no 0.0.0.0 route at all.

          b5703f22-d2f3-4800-b934-98283aaee32b-image.png

          This is happening often when playing manual disconnect and connect after.

          S 1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            Ok well that seem unrealted to IPv6 or Unbound so it should probably be in a different thread.

            However I would check the output of pppcfg pppoe0 when that happens. It looks like it's not connecting at all.

            w0wW 1 Reply Last reply Reply Quote 0
            • w0wW
              w0w @stephenw10
              last edited by

              @stephenw10

              @stephenw10 said in DNS resolver exiting when loading pfblocker 25.03.b.20250409.2208:

              It looks like it's not connecting at all.

              I don't think so. You can see gateway status on the screenshot and pppoe0 is in routes list, but not default.

              9a8f5208-507a-4446-990d-8101b401d158-image.png

              @stephenw10 said in DNS resolver exiting when loading pfblocker 25.03.b.20250409.2208:

              Ok well that seem unrealted to IPv6 or Unbound so it should probably be in a different thread.

              Sure. I think I will do further tests on weekend or when it's possible and post back in another thread.

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                Hmm, but it shows no IP address against the pppoe gateway and the RTT at 0.5ms seems too low to be real.

                If you're using if_pppoe it will show an uptime if it's really connected.

                w0wW 1 Reply Last reply Reply Quote 0
                • RobbieTTR
                  RobbieTT @stephenw10
                  last edited by RobbieTT

                  @stephenw10 said in DNS resolver exiting when loading pfblocker 25.03.b.20250409.2208:

                  Nice. More fixes are incoming for various things.

                  The latest IPv6 RA patch has had no adverse consequences on my test setup. 👍

                  Relative trivia but a very easy thing to fix with the 'various things':

                  2025-06-18 08:34:03.000000+01:00	nginx	-	2025/06/18 08:34:03 [error] 333#100367: *9037 open() "/usr/local/www/apple-touch-icon.png" failed (2: No such file or directory), client: 2a02:xxx:xxxx:1:xxxx:xxxx:xxxx:b6bd, server: , request: "GET /apple-touch-icon.png HTTP/2.0", host: "router-7.xxxxxxx.me:8443"
2025-06-18 08:34:03.000000+01:00	nginx	-	2025/06/18 08:34:03 [error] 333#100367: *9037 open() "/usr/local/www/apple-touch-icon-precomposed.png" failed (2: No such file or directory), client: 2a02:xxx:xxxx:1:xxxx:xxxx:xxxx:b6bd, server: , request: "GET /apple-touch-icon-precomposed.png HTTP/2.0", host: "router-7.xxxxxxx.me:8443"

                  ☕️

                  1 Reply Last reply Reply Quote 1
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    What are you accessing from to generate those?

                    RobbieTTR 1 Reply Last reply Reply Quote 0
                    • w0wW
                      w0w @stephenw10
                      last edited by w0w

                      @stephenw10 said in DNS resolver exiting when loading pfblocker 25.03.b.20250409.2208:
                      https://forum.netgate.com/topic/197887/pppoe-problems-getting-an-ipv6-address-on-reconnection-and-other-problems continuing there

                      1 Reply Last reply Reply Quote 0
                      • RobbieTTR
                        RobbieTT @stephenw10
                        last edited by

                        @stephenw10 said in DNS resolver exiting when loading pfblocker 25.03.b.20250409.2208:

                        What are you accessing from to generate those?

                        Just from a Mac.

                        The files exist on pfSense but are down a level in a sub-directory, rather than the usual location.

                        ☕️

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S
                          stephenw10 Netgate Administrator
                          last edited by

                          I don't see those specifically only:

                          [2.8.0-RELEASE][root@m370.stevew.lan]/root: ls -ls /usr/local/www/apple-touch/
total 26
5 -rw-r--r--  1 root wheel 3669 May 20 15:25 apple-touch-icon-ipad-76x76-precomposed.png
9 -rw-r--r--  1 root wheel 7260 May 20 15:25 apple-touch-icon-ipad-retina-152x152-precomposed.png
5 -rw-r--r--  1 root wheel 2965 May 20 15:25 apple-touch-icon-iphone-60x60-precomposed.png
9 -rw-r--r--  1 root wheel 5640 May 20 15:25 apple-touch-icon-iphone-retina-120x120-precomposed.png

                          So those requests are from Safari in MacOS?

                          RobbieTTR 1 Reply Last reply Reply Quote 0
                          • RobbieTTR
                            RobbieTT @stephenw10
                            last edited by RobbieTT

                            @stephenw10

                            It expects to find the png files in this directory:

                            /root: ls /usr/local/www/
404.html                                 services_checkip_edit.php
50x.html                                 services_dhcp.php
android-chrome-192x192.png               services_dhcp_edit.php
android-chrome-512x512.png               services_dhcp_relay.php
apple-touch                              services_dhcp_settings.php
[/snip]

                            The Android/Chrome pngs are there but the Apple equivalents apple-touch-icon.png and apple-touch-icon-precomposed.png are not, so it triggers the error in the logs. As you note, the iPhone and iPad pngs are in the apple-touch sub-directory.

                            ☕️

                            1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              Right so seems like something missing that's (relatively) new. I asked internally since I don't run MacOS.

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                You are seeing this specifically when using Safari? We can't replicate that here so far. Everything we've tested just uses the correct path specified in the meta data.

                                1 Reply Last reply Reply Quote 0
                                • stephenw10S
                                  stephenw10 Netgate Administrator
                                  last edited by

                                  OK we manage to replicate it. Weird that most things don't hit it. Digging....

                                  RobbieTTR 1 Reply Last reply Reply Quote 0
                                  • RobbieTTR
                                    RobbieTT @stephenw10
                                    last edited by

                                    @stephenw10 said in DNS resolver exiting when loading pfblocker 25.03.b.20250409.2208:

                                    OK we manage to replicate it. Weird that most things don't hit it. Digging....

                                    Good effort and yes, noticed the issue with Safari.

                                    ☕️

                                    1 Reply Last reply Reply Quote 0
                                    • stephenw10S
                                      stephenw10 Netgate Administrator
                                      last edited by

                                      You have any plugins that might try to pull an icon to use? Password manager perhaps?

                                      RobbieTTR 1 Reply Last reply Reply Quote 0
                                      • RobbieTTR
                                        RobbieTT @stephenw10
                                        last edited by

                                        @stephenw10

                                        No plugins or password manager.

                                        I do have 3 extensions though:

                                        • Stop The Madness (not really used with pfSense GUI)

                                        • Dark Reader (disabled for pfSense GUI)

                                        • AdGuard For Safari (disabled for pfSense GUI).

                                        ☕️

                                        1 Reply Last reply Reply Quote 1
                                        • stephenw10S
                                          stephenw10 Netgate Administrator
                                          last edited by

                                          Hmm, does it only happen in Safari? Does it happen everytime you refresh the page? Any page?

                                          Still trying to get more data points here. Seems like it must be something very specific.

                                          RobbieTTR 1 Reply Last reply Reply Quote 0
                                          • RobbieTTR
                                            RobbieTT @stephenw10
                                            last edited by RobbieTT

                                            @stephenw10

                                            Only happens on Safari (I only use Safari and Brave).

                                            Seems like a common issue when I Googled it. This example is a bit dated though:

                                            **If a user from Safari Web browser (Apple devices) visit your site. The browser tries to fetch the site icon if it is not defined in <head> in the following order:

                                            apple-touch-icon-57x57-precomposed.png
                                            apple-touch-icon-57x57.png
                                            apple-touch-icon-precomposed.png
                                            apple-touch-icon.png

                                            To resolve this issue either define an icon for safari web browsers or apple devices. Add something like this to head section of your site:

                                            <link rel="apple-touch-icon" href="/custom_icon.png"/>
                                            If you want to keep <head> clean then upload the icon to root dir of your site with proper name.

                                            You can find more details on iOS developer library.**

                                            It also came up as a pfSense issue from back in the day:

                                            https://redmine.pfsense.org/issues/6727

                                            ☕️

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.