Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Port Forwarding stopped working after upgrading to 2.8.0

    Scheduled Pinned Locked Moved General pfSense Questions
    73 Posts 5 Posters 2.1k Views 3 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S Offline
      stephenw10 Netgate Administrator @comet424
      last edited by

      @comet424 said in Port Forwarding stopped working after upgrading to 2.8.0:

      create a file
      /boot/loader.conf.local

      and place in it
      hint.iwm.0.disabled="1"

      and thats all i need to do ?

      Yes. Do that in 2.7.2 before upgrading.

      @comet424 said in Port Forwarding stopped working after upgrading to 2.8.0:

      not sure how you interupt the boot proccess

      When you see the loader menu with the 3 second countdown press ESC to reach the loader prompt:

          _ __  / _|___  ___ _ __  ___  ___      _                
         | '_ \| |_/ __|/ _ \ '_ \/ __|/ _ \   _| |_              
         | |_) |  _\__ \  __/ | | \__ \  __/  |_   _|             
         | .__/|_| |___/\___|_| |_|___/\___|    |_|               
         |_|                                                      
                                                                  
                                                                                    
       ╔════ Welcome to Netgate pfSense Plus ════╗      __________________________  
       ║                                         ║     /                       ___\ 
       ║  1. Boot Multi user [Enter]             ║    |                      /`     
       ║  2. Boot Single user                    ║    |                     /    :-|
       ║  3. Escape to loader prompt             ║    |      _________  ___/    /_ |
       ║  4. Reboot                              ║    |    /` ____   / /__    ___/ |
       ║  5. Cons: Serial                        ║    |   /  /   /  /    /   /     |
       ║                                         ║    |  /  /___/  /    /   /      |
       ║  Options:                               ║    | /   ______/    /   /  _    |
       ║  6. Kernel: default/kernel (1 of 1)     ║    |/   /          /   / _| |_  |
       ║  7. Boot Options                        ║        /          /___/ |_   _| |
       ║  8. Boot Environments                   ║       /                   |_|   |
       ║                                         ║      /_________________________/ 
       ║                                         ║                                  /
       ╚═════════════════════════════════════════╝
                                                                                     
      Exiting menu!
      
      
      Type '?' for a list of commands, 'help' for more detailed help.
      OK 
      
      C 1 Reply Last reply Reply Quote 0
      • C Offline
        comet424 @stephenw10
        last edited by comet424

        @stephenw10 i wish they explained it better like you did.. they so criptied like engineer writtings

        so i having issues installing pfsense i setup the dhcp and it then checkjing for netgate servers but in the end it fails it cant detect any netgate servers to install pfsense

        is netgate servers down to install pfsense... i wish you could just install it and not need to download it .. like a usb installer with pfsense 2.7.2 already on the usb or the 2.8.

        i even tried shutting off my dsl modem.. for 20 min and also set in pfsense installer dns to 1.1.1.1 but it will not get past the netgate servers cant be fetched..
        do you know if they down or so

        i did find a iso of 2.7.2 so i got that installed on the gaming comp but i cant import the 2.8.0 configuration file into 2.7.2 so i guess ill have to wait till comp can update to 2.8.0 as there is no iso of 2.8.0 which sucks as it would help right now to get things back up and running

        C 1 Reply Last reply Reply Quote 0
        • C Offline
          comet424 @comet424
          last edited by

          @stephenw10 so i got it installed and got the config file installed.. got 2.8.0 finally on the gaming comp with the hint file code

          so i going to test if it locks up too
          currently cpu says current 1700 max 3800mhz
          16 cores but really 8 cores 8 hyperthreading
          32 gig ram
          realtek onboard card, and 10gtek network card.. i know realtek not supported but not like i can change onboard..

          so going to test if i get the same lock outs of the php but im sure the routing issues like for canadian tire home depot where you only get those websites partial working is a routing issue.. is there anything i should be also looking for that the 192.168.40.x works but then 192.168.0.0 doesnt

          and i appreciate your help so far

          1 Reply Last reply Reply Quote 1
          • stephenw10S Offline
            stephenw10 Netgate Administrator
            last edited by

            Cool. Yup there was a backend issue last night. It should be fixed now.

            1 Reply Last reply Reply Quote 0
            • C Offline
              comet424 @comet424
              last edited by comet424

              @stephenw10

              so i been running pfsense on that gaming hardware and updated to 2.8.1 twice now.. i havent dared to try a usb installer to test if i still gotta do that set hint.iwm.0.disable="1" but i did do it from the updates ..

              so running on the 8core 8 hyper threads but says 2 hardware threads, 32 gig ram .. at speed i dunno as it doesnt display the processor speed other comp says 1700 and max 3800 this is the ryzen 5700g

              but so far testing the php stall or kill you mentioned that has seemed to be gone.. i currently running at a 0 to 2% cpu usage.. and with the serveral openvpns and the setup you see that seems to solved that .. i guess maybe that cpu 4 cores is just not powerful enough to handle 2.8 now 2.7 didnt seem to have that issue

              ok the 2nd issue which i guess now my first issue lol.. but its that like going to home depot i site i get that smething went wrong... yet if i test on my dmz on a ubuntu works.. if i stick a windows 11 on the dmz it works and soemtimes doesnt work... if i plug the comp directly to the pppoe modem windows 11 can do the searchs fine on the windows 11
              i been testing several days different ways

              so
              pppoe modem ---> dhcp ---> computer, home depot and like canadian tire search pages work
              ppope modem ---> pppoe --->pfsense ---> lan behind or not behind vpn both home depot canadian tire search fails with the something went wrong
              ppope modem ---> pppoe --->pfsense ---> dmz ubuntu works for both homedepot and canadian tire
              ppope modem ---> pppoe --->pfsense ---> dmz windows 11 works for both homedepot and canadian tire but also fails to work

              ppope modem ---> dhcp --->pfsense ---> same results above

              so is this something like double natting issues that it works and doesnt work.. the modem has a dmz option i set it for pfsense but it still fails

              can i do a comparable tests of ubuntu ip and windows 11 ip and see where its failing with the states or the routes..

              as i even tried shutting off the modem for 30 min and rebooting pfsense and let it come back but i still run into that issue of its not processing the requests right... is there something wrong with my NAT settings ..

              next test i going to do is just a factory reset of pfsense and just test the lan like factory setting of n o vlans no touching the nat just the default setup just to see if its something going wrong in my current setup that i cant find

              and is there a bug in the traffic graph page.. if i choose hostname or Description it will display some names but mostly IP address even if the ip has a static ip set with a description
              like
              my unraid server is
              hostname : Tardis
              Description: Tardis - Unraid - Main Server
              IP: 192.168.0.3

              but when you set the display Hostname or Description it always shows 192.168.0.3 so wonder if there is a bug or something i need to set to fix it

              1 Reply Last reply Reply Quote 0
              • stephenw10S Offline
                stephenw10 Netgate Administrator
                last edited by

                Do you see the same dependency between Unbuntu and Windows if they are on LAN?

                That sort of difference points to IPv6 often. One OS will default to trying to use it if it exists at all. pfSense may be advertising it if the ISP is passing IPv6.

                The other thing I would check is packet sizes. An MTU/MSS issue can present like that. As a test try setting MSS on the LAN to something low like 1300. See if that allows the sites to load.

                C 1 Reply Last reply Reply Quote 0
                • C Offline
                  comet424 @stephenw10
                  last edited by

                  @stephenw10 not sure how to test for all those

                  and for the LAN Ubuntu and Windows depenency on the LAN.. i havent tested that just on the DMZ

                  but i also noticed something else.. so when my modem boggs down for a while i cant use my desktop via vpn or just lan doesnt use vpn

                  but dmz side works.. even though some of the LAN ips dont use vpn goes out the WAN like the DMZ so thats messed.. and usually i turn off the modem for 15 min and fixs itself but now it doesnt fix itself i seen this a few times

                  when i ping from pfsense ping and ping 1.1.1.1 or google.ca it doesnt work resetting states or rebooting the pfsense doesnt fix it.. so your not able to ping 1.1.1.1 through pfsense default is WAN for pfsense.. but i can go to like amazon.ca or ebay. on the ubuntu browswers on the DMZ...

                  so i then figured changing from pppoe to dhcp would solve this no doesnt... when i do a restore from last configuration... the openvpns work again the desktop works for internet.. pfsense can ping 1.1.1.1 or google.ca

                  is this also ip6 or is it something miss configured... or is it due to my modem is being maxed out like a highway fully conjested as its only like 3 megabit and its fully used... i know you might not seen this as everyone has faster internet then me.. but maybe you might know what this is...

                  and the MSS on the LAN i set to 1300 shoud i set it to the WAN connection too?

                  and should you disable IPv6 everywhere or is it something you want enabled? as i know when you do the vpns they always turn that off..

                  i also notice after a restore the internet works for a bit then 10 min in the pinging stops working in pfsense

                  so i know i got some weird issues... and ill do that factory test of 0 configurations as i think either its the modem how it works or massive gremlins...

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S Offline
                    stephenw10 Netgate Administrator
                    last edited by

                    Is that WAN 3Mbps both ways? That could certainly be getting filled entirely causing problems. If it is though you should see it in the traffic graphs.

                    You only need to set MSS at one place in the path so just on LAN should do it if it is an MTU issue.

                    C 1 Reply Last reply Reply Quote 0
                    • C Offline
                      comet424 @stephenw10
                      last edited by

                      @stephenw10
                      ok something glitched..

                      so ok,. my internet is 3megbit down and like 500kilobyte upload.. its like hooking up a dial up modem connection to pfsense

                      now currently whats messed up is every time i delete the nordvpn dns servers from the general settings... and pfsense cant ping except the monitor ip .. DMZ works no problem... the LAN IPs that use the WAN or the ppope that dont use vpn cant ping or anything vpn goes down...

                      now i did 2 tests... i Saved the configuration file with the 2 nordvpn dnss deleted and then i restored the configuration file after 10 min i let it sit the pfsense couldnt ping couldnt connect to PIA vpn but dmz worked fine..

                      so then i decided to restore the previous config i saved where it has the 2 extra dns nord vpns and boom internet works PIA connects.. but still cant use the home depot

                      ok reply here wont let me upload all my pics.. ugh tells me some rate limit error

                      so there is a log file
                      2 folders one with the nordvpn dns servers that works.. but if i restore without those 2 servers.. nothing works thats in the not working folder

                      now youll see i got 2 LAN rules one for * and other wan_ppoe i was trying 2 different ways to get internet to work.. but didnt help

                      youll probably say start from scratch.. i also going to test turning off 1 vpn as it looks like PIA doesnt offer fail over since i get the same ip address.. but going to test more..

                      but ya its frustrating with a slow internet connection... but here is the link

                      link text

                      in the mean time i going to try removing the 2nd PIA VPN just disable the interface.. save config file then restore with the nordvpns removed... as i cant tell what the heck is wrong... and in end probably need to restore 1 section at a time.. and or start from scratch

                      C 1 Reply Last reply Reply Quote 0
                      • C Offline
                        comet424 @comet424
                        last edited by

                        @stephenw10

                        so update i got fed up cuz i couldnt reconnect internet

                        so i did a factory reset.. and things didnt default right.. internet defaulted to LAN as a LANGW
                        whatever a langgw is...

                        but i set up the WAN to pppoe lan to 192.168.0.1 disabled the IP6

                        i got internet to work on the desktop and i got the home depot website to search properly.. thats at the default settings... so i guessing that has to be a NAT issue maybe but i guess ill try restoring 1 section at a time to see if i can narrow the problem from the config file.. and then re do the PIA VPN or so..

                        but ill get back to you... so least its not the computer that was disabling home depot website to work ... factory reset to LAN * that seems to be working

                        so ill update later also going to trial and error some stuff

                        C 1 Reply Last reply Reply Quote 0
                        • C Offline
                          comet424 @comet424
                          last edited by

                          i notice i cant import everything slowly from the backup and restore...

                          why isnt the user certs for the users and openvpn restored... only seems to restore from a ALL option same with static routes giving me error for not the right tag.. yet i importing each section 1 section at a time nad testing..

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S Offline
                            stephenw10 Netgate Administrator
                            last edited by

                            Restoring the full config is always the recommended way because only one section contains the config version.

                            With a 512Kbps upload it's going to be very easy to fill the available bandwidth creating latency and, potentially, packet loss.

                            I would guess the issues you're seeing are either due to the VPNs and associated routing or DNS. Or a combination since you' seems to be using VPN providers DNS servers.

                            What are you passing to DMZ clients for DNS? Is it different to LAN?

                            C 1 Reply Last reply Reply Quote 0
                            • C Offline
                              comet424 @stephenw10
                              last edited by

                              @stephenw10
                              ah ok ya i was hoping to import parts of the config like the gateway groups,, the authority certs and certs...

                              ya you can see my internet pretty slow...

                              so with the factory reset home depot works.. on tha LAN but i wasnt able to import certain ones. i think i narrowed it down to NAT page maybe one of those screen shots i sent tells you ive done it wrong.. like what is the 1::128 and such

                              but ok so for the DMZ i use 192.168.40.1 as the gateway and dns as the Vlan for is 40 so i do 192.168.40.x
                              and LAN uses 192.168.0.1 as DNS and Gateway
                              192.168.10.0 uses 192.168.10.1 for DNS and Gateway
                              and so on for 20 30 40 50 60 and i block the 30 gateway as i wanted my own impt i think it is port for management to be able to access network if the other network interface fails...

                              now the rules is the DMZ subbnets * * * *
                              dmz.png

                              im sure one of the NATS is probably causing the conflicts
                              so what i have in the NATS is one i have it set as Manual due to when setting up pia or nord in the past..

                              i did the openvpn be able to access the site to site network.. i had to add it as i was having issues with remote access to remote home assistant
                              then i did vpn ips use one of the 2 PIA interfaces
                              then i did rest of the lan use WAN interfaces
                              and then i did all my other vpns the IP private networks vlan 10 20 30 40 50 60 to use WAN interface
                              and i added the 192.168.0.0/24 to the WAN interface too as i was trying things
                              and i added the 127.0.0.0/8 and 1:128 and the 172.168.0.0/24 for the remote access to pfsense for openvpn and a few more WAN connections .. but i havent changed nothing from the nat screen shots from prior i posted...
                              so i figured i configure things correctly.. but im sure one of those is causing the issue..

                              i sure learning alot of different ways to import and configure...

                              C 1 Reply Last reply Reply Quote 0
                              • C Offline
                                comet424 @comet424
                                last edited by

                                at least i think its NAt unless its something else thats causing issues as when i factory reset the computer can search home depot but go back to previous config and i reboot the comp i cant search again... as if i dont do a reboot.. i guess it keeps the routes and that allows it to work... so i got some gremlin in here

                                C 1 Reply Last reply Reply Quote 0
                                • C Offline
                                  comet424 @comet424
                                  last edited by

                                  so i kinda got it working... i spent hours fiddling

                                  under the general setup i set up

                                  10.0.0.243 for the one PIA VPN
                                  10.0.0.241 and i set it to WAN and i tried also none

                                  i guess when you set to none that means whatever gateway is avaliable will use it??

                                  ive tried again using 1.1.1.1 for WAN but i find it leaks the cloud flare on the vpn which i truly dont understand as i always figured the ip address you give is specific to that gateway and not share over all the connections..

                                  so i testing with the 2 pia vpn ips.. for now it seems to be working but will see by tommorow.. i been testing stuff all day so ill let you know how i make out

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S Offline
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    Ok so if all subnets are just sending the interface address to use for DNS (which is the default) then that means clients are using Unbound in pfSense for DNS unless they are hard coded to use soemthing different.

                                    So how is Unbound (DNS Resolver) configured? Looking back I don't think you have sent a screenshot for that.

                                    C 1 Reply Last reply Reply Quote 0
                                    • C Offline
                                      comet424 @stephenw10
                                      last edited by

                                      @stephenw10
                                      so im going nuts.. i spent last couple days trouble shooting i figure its the dns resolver..
                                      i re did my pfsense... i imported 1 thing at a time.. and rebooted to see if i had internet etc.. i found if i imported the dns resolver.. that made my internet not work and the PIA vpn not log in but WAN was online..

                                      as on the resolver i point with host over rides to a lancache i use cuz my internet poor so i use it for like windows updates to cache . so i can download from it... well i thought i solved it but it didnt work so...

                                      i also set the All for Incoming networks and i set to All for out going networks not just the 2 PIA vpns...

                                      well here is where it gets stupid and i going nuts... like bash my head off the wall... the internet and home depot will work when i setup what i mentions all but the dns so i saved that to a config file..

                                      then ive imported the dns info and then changed it to ALL for out going network.. so the host over rides are there.. well then sometimes 30 min in internet stop works or the pinging of google.ca is no longer functional but you can ping 1.1.1.1... then what gets more stupid i dunno whats going on..

                                      if i make sure computers are not downloading from windows or streaming etc so the internet is idle.. it will WAN will go back to online the PIA VPN will not go back online.. even when u do reconnect in openvpn.. i also tried Sates and reset the states nothing... a reboot doesnt work to make the internet work.. it will not make the PIA vpn to work again and i cant ping from pfsense...

                                      and reboots dont fix nothing what fix's if i do a restore of that config file i made.. then boom dns naming works so i can ping google.ca and the home depot will work the search.. but it will not last if internet is being used.. and when it wont come back online if i reboot it will still keep the vpn disconnected. i cant ping google.. till i restore the config file again then boom its working again...

                                      i thought if you clear the States it would be the same as rebooting or so.. i not sure what the different from rebooting and restoring the config file. if there is another file like the states that keeps recording of outbound internet.. but its messed up

                                      and i figured why the ubuntu was working on internet when my other dmz didnt.. for some reason i had dns1 8.8.8.8 and dns2 192.168.40.1 not sure how or when i did that.. but thats how it was still working when others arent...

                                      so ya and i not sure if my slow internet where its like 3megabit down and 500k upload if maybe its too slow it buggers up pfsense...

                                      and forwhatever reason netgate forum not letting me upload pics.. rate limit whatever that is.. so i created another one drive link... and sometimes when it cant connect the vpn it says it cant determine ip4 ip6

                                      but here is the link.. but maybe its just cuz my internet so slow everything gets buggered up and if i had faster internet it be better.. my sister finally this past week they burried a fiber optic cable in the ground and a box to the house so shes getting closer to high speed as shes got the same speed i get.. but shes with nexicom and im with bell.. but she doesnt run with the same issues and i basiclly configured hers to be like mine without lancache

                                      so here is the link
                                      https://1drv.ms/f/c/2759db01e8e27b46/EuIE6VvK0wtCsxan-H2_tsIBv9pQYmVCqEsXFvRIMWP_ig?e=WM0mRs

                                      im thinking maybe no help till i get faster internet.. but i keep trying to resolve it..

                                      C 1 Reply Last reply Reply Quote 0
                                      • C Offline
                                        comet424 @comet424
                                        last edited by

                                        @stephenw10 so more testing and frustration..

                                        so like home depot search works fine on computers behind the vpn... but anything behind WAN works only at time i restore the configuration file.. it works for a while... then boom it stops resolving that site
                                        now if i set the general page and set 1.1.1.1 to use the WAN pppoe or if i set it to DHCP well 1 it leaks that dns over into the VPN it doesnt stay it ins lane.. that 1.1.1.1 ony works for the wan ppoe interface, and doesnt come over into the VPN lane and share it too..

                                        and if i connect to teh modem itself with acomputer that has no issue... and if i factory reset and just let LAN use WAN and no configuring of a VPN then it has no issues... it comes to when i split things so part of the network uses WAN and part uses VPN.. but basiclly if you sit everything behind the vpn then that works... but i cant seem to get an equal balance... WAN stays in its lan and doesnt come over to the VPN side... i did this orginally due to Xbox being double nat'd going through vpn and had issues and my webserver couldnt work

                                        so i not sure if its caused by the dns resolver as i set it both to ALL incoming and out going i removed my host over rides... i not sure if its the Bypass Routing policy 1918 doing it that i got configured..

                                        how do you properly split pfsense like DMZ or Some LAN IPs , and VPN Clients they they both stay in there own lane the lancache i had tried behind on the behind the VPN and DMZ side or well maybe not fully DMZ as its just the default way pfsense sets up LAN so its still protected from the firewall.. and not wide open no firewall..

                                        ive tried the no wan egress and 1,1,1,1 for wan under general with no wan egress on vpn doesnt solve that.. i not sure if my slow speed stalls out my modem or glitchs the dns ive tried 15 30 min modem shut off... but if i restore config file it works fine for a little while... so its almost like you need 2 pfsense's 1 for WAN and 1 for VPN and the vpn goes out the the WAN pfsense... and pfsense 1 WAN would do ips 192.168.0.2-50 and pfsense 2 VPN side would do 192.168.0.51-254

                                        so is there a way cuz if i use lan dhcp and tell it to use 1.1.1.1 but then that buggers things up too as then pfsense doesnt resolve local names on the network and then its also leaked out

                                        or is the best to do this as i thought of it before too but i wanted LAN 192.168.0.x some ips to be behind vpn and others just on WAN
                                        is it best to just do

                                        192.168.0.x uses VPN
                                        192.168.5,x users WAN
                                        instead of 192.168.0.1-50 uses WAN but some ips are set to VPN

                                        as i do 192.168.x.0 x = 10,20,30,40,50 using WAN

                                        ive noticed this problem for a long time but it comes and goes but its hard to tell cuz my internet so slow to todays standards of internet use i just wanting to fix things before i get fiber high speed as dsl high speed no longer as good and i seeing more glitchs surfing the web etc that i notice more... probably the wifi devices i added bogging down internet or my webserver.. hard to pin point but i do finding my configurations not cutting it...

                                        sorry dragging out i appreciate the help you have done so far to help.. and i going to try couple other things like lan just uses VPN and my dmz to use just WAN and see how things go and try couple other settings to try..

                                        ill let you know how it goes.. and stil lwasnt able to upload pics rate limit error whatever that is

                                        1 Reply Last reply Reply Quote 0
                                        • stephenw10S Offline
                                          stephenw10 Netgate Administrator
                                          last edited by

                                          I would try disabling DNSSec. When running in forwarding mode that can cause problems if one of the servers you're forwarding to doesn't correctly support it.

                                          C 1 Reply Last reply Reply Quote 0
                                          • C Offline
                                            comet424 @stephenw10
                                            last edited by

                                            @stephenw10 ok i unchecked dnssec support under dns resolver..

                                            i still get frustrated too if internet stop workin but openvpn still shows things connected and i reboot.. it wont reconnect.. pfsense cant ping websites.. resetting states or reboot doesnt help sometimes disabling the interface vpn and then re enabling fixes it.. or i end up restoring that xml i made that avoids adding dns resolver.. and internet and vpns show connection back in openvpn..

                                            like that is so messed up why that does it...

                                            but i testing nowing with the dnssec unchecked

                                            so does the dnssec mean if it doesnt support dns sec it basiclly crashes pfsense ? or locks it in an infinite loop ?

                                            but ok testing it now and see how it goes

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.