Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Connections/states DROP when changing web configurator COLOR!!

    Scheduled Pinned Locked Moved Development
    16 Posts 2 Posters 337 Views 3 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S Offline
      stephenw10 Netgate Administrator
      last edited by stephenw10

      When I make that change I see logged:

      Jul 24 15:06:24 	check_reload_status 	687 	Syncing firewall
      Jul 24 15:06:24 	php-fpm 	57549 	/system.php: Configuration Change: admin@172.21.16.8 (Local Database): System:
      Jul 24 15:06:25 	php-fpm 	57549 	/system.php: Staging AutoConfigBackup encrypted configuration backup for deferred upload to https://acb.netgate.com
      Jul 24 15:06:27 	root 	45627 	/etc/rc.d/hostid: WARNING: hostid: unable to figure out a UUID from DMI data, generating a new one
      Jul 24 15:06:34 	php-fpm 	57549 	/system.php: NTPD is starting up.
      Jul 24 15:06:34 	check_reload_status 	687 	Reloading filter 
      

      So you can see it reloads the firewall ruleset. For some reason. It's not immediately obvious what setting on that page might require it....

      N 1 Reply Last reply Reply Quote 0
      • N Online
        netblues @stephenw10
        last edited by

        @stephenw10 And it restarts ntp too?

        Doesn't look like a feature to me, but is it a bug?

        And why reloading filter kills nat sessions to begin with.. I don't remember that being the case in the past (but I might be wrong)

        1 Reply Last reply Reply Quote 0
        • stephenw10S Offline
          stephenw10 Netgate Administrator
          last edited by

          It restarts ntpd because that page has the external ntp server settings on it. But nothing there looks like it would affect the firewall... 🤔

          N 1 Reply Last reply Reply Quote 0
          • N Online
            netblues @stephenw10
            last edited by

            @stephenw10 Did some more fiddling since this made no sense at all.
            Went back to 24.11, via boot environments reloaded the newer configuration, and then migrated again to 25.07rc

            The problem went away. Almost impossible to reproduce again, strange as it is.

            However, going back to 24.11 i saw that sticky connections did work.
            Migrating to latest 25.07 rc, sticky connections are gone.

            1 Reply Last reply Reply Quote 0
            • stephenw10S Offline
              stephenw10 Netgate Administrator
              last edited by

              Like in a load-balanced gateway group?

              N 1 Reply Last reply Reply Quote 0
              • N Online
                netblues @stephenw10
                last edited by

                @stephenw10 Exactly on that.

                1 Reply Last reply Reply Quote 0
                • stephenw10S Offline
                  stephenw10 Netgate Administrator
                  last edited by

                  Hmm, I'm not aware of that. How are you testing? What are you seeing?

                  N 1 Reply Last reply Reply Quote 0
                  • N Online
                    netblues @stephenw10
                    last edited by

                    @stephenw10
                    I have two 1Gbit ftth lines(with 500Mbits upload)
                    One is dhcp, the other is pppoe
                    I have a gateway group called Loadb with the two gateways as Tier1 and another backup tier
                    as tier3 via 5g
                    On the lan side, I have a typical rule that sends the traffic there
                    d83f32e1-862c-4181-ae7c-2def5c69e308-image.png
                    This works fine. With stickiness enabled I get this

                    9d7e8c7f-0499-4958-a91c-884fdd18a1e8-image.png

                    Which is expected, and doing a speedtest utilizes randomly one of the two lines
                    99aa05f5-aabf-4180-a916-d86ace186e28-image.png
                    This is with stickiness enabled
                    a6010ae9-ffc9-4a20-8d96-02784a624ca9-image.png

                    Unchecking "use sticky connections", the source tracking tab disappears (as expected)
                    and a speedtest (multi connection by default) gets the aggregate as it should

                    da3f7789-30f0-458d-93df-6ea69c3e1560-image.png

                    Upgrading to 25.07 rc has no entries in the source tracking states and speedtests are always get the aggregate traffic.
                    This is a problem when visiting https sites , especially web banking and other session sensitive, since you get disconnected due to different source ip. It can be mitigated by excluding https traffic with policy routing, but then the issue persists on non standard ports.

                    This is with the new kernel mode pppoe driver but I have tried disabling it with no difference too.

                    1 Reply Last reply Reply Quote 0
                    • stephenw10S Offline
                      stephenw10 Netgate Administrator
                      last edited by stephenw10

                      Hmm, OK yup I'm seeing that. Digging....

                      Edit: Looks like this: https://redmine.pfsense.org/issues/16282

                      N 1 Reply Last reply Reply Quote 1
                      • N Online
                        netblues @stephenw10
                        last edited by netblues

                        @stephenw10 Yes, this is exactly the case.
                        And while we are there, it would be nice to have stickiness being enabled per interface and not on as a whole. Even better if it could be done at the source ip level too.

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S Offline
                          stephenw10 Netgate Administrator
                          last edited by

                          Ok, that is fixed in 25.07 and will be in the next 2.8.1-beta.

                          The stickiness is per source IP. So each internal client will be stuck to a gateway/WAN.

                          N 1 Reply Last reply Reply Quote 0
                          • N Online
                            netblues @stephenw10
                            last edited by

                            @stephenw10 You mean 25.07 release? Since we are on rc.

                            Yes, I know that stickiness is per source ip, but there is no control over it.
                            its either all of them or none.

                            1 Reply Last reply Reply Quote 0
                            • stephenw10S Offline
                              stephenw10 Netgate Administrator
                              last edited by

                              Mmm, so prevent source tracking for specific IPs or subnets?

                              I did wonder if sticky connections could be per gateway group. That seems like it should be possible. You could then use rules to route specific clients or subnets to a non-sticky group.

                              1 Reply Last reply Reply Quote 1
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.