Port Forwarding stopped working after upgrading to 2.8.0

[comet424]

so i kinda got it working... i spent hours fiddling

under the general setup i set up

10.0.0.243 for the one PIA VPN
10.0.0.241 and i set it to WAN and i tried also none

i guess when you set to none that means whatever gateway is avaliable will use it??

ive tried again using 1.1.1.1 for WAN but i find it leaks the cloud flare on the vpn which i truly dont understand as i always figured the ip address you give is specific to that gateway and not share over all the connections..

so i testing with the 2 pia vpn ips.. for now it seems to be working but will see by tommorow.. i been testing stuff all day so ill let you know how i make out

[stephenw10]

Ok so if all subnets are just sending the interface address to use for DNS (which is the default) then that means clients are using Unbound in pfSense for DNS unless they are hard coded to use soemthing different.

So how is Unbound (DNS Resolver) configured? Looking back I don't think you have sent a screenshot for that.

[comet424]

@stephenw10
so im going nuts.. i spent last couple days trouble shooting i figure its the dns resolver..
i re did my pfsense... i imported 1 thing at a time.. and rebooted to see if i had internet etc.. i found if i imported the dns resolver.. that made my internet not work and the PIA vpn not log in but WAN was online..

as on the resolver i point with host over rides to a lancache i use cuz my internet poor so i use it for like windows updates to cache . so i can download from it... well i thought i solved it but it didnt work so...

i also set the All for Incoming networks and i set to All for out going networks not just the 2 PIA vpns...

well here is where it gets stupid and i going nuts... like bash my head off the wall... the internet and home depot will work when i setup what i mentions all but the dns so i saved that to a config file..

then ive imported the dns info and then changed it to ALL for out going network.. so the host over rides are there.. well then sometimes 30 min in internet stop works or the pinging of google.ca is no longer functional but you can ping 1.1.1.1... then what gets more stupid i dunno whats going on..

if i make sure computers are not downloading from windows or streaming etc so the internet is idle.. it will WAN will go back to online the PIA VPN will not go back online.. even when u do reconnect in openvpn.. i also tried Sates and reset the states nothing... a reboot doesnt work to make the internet work.. it will not make the PIA vpn to work again and i cant ping from pfsense...

and reboots dont fix nothing what fix's if i do a restore of that config file i made.. then boom dns naming works so i can ping google.ca and the home depot will work the search.. but it will not last if internet is being used.. and when it wont come back online if i reboot it will still keep the vpn disconnected. i cant ping google.. till i restore the config file again then boom its working again...

i thought if you clear the States it would be the same as rebooting or so.. i not sure what the different from rebooting and restoring the config file. if there is another file like the states that keeps recording of outbound internet.. but its messed up

and i figured why the ubuntu was working on internet when my other dmz didnt.. for some reason i had dns1 8.8.8.8 and dns2 192.168.40.1 not sure how or when i did that.. but thats how it was still working when others arent...

so ya and i not sure if my slow internet where its like 3megabit down and 500k upload if maybe its too slow it buggers up pfsense...

and forwhatever reason netgate forum not letting me upload pics.. rate limit whatever that is.. so i created another one drive link... and sometimes when it cant connect the vpn it says it cant determine ip4 ip6

but here is the link.. but maybe its just cuz my internet so slow everything gets buggered up and if i had faster internet it be better.. my sister finally this past week they burried a fiber optic cable in the ground and a box to the house so shes getting closer to high speed as shes got the same speed i get.. but shes with nexicom and im with bell.. but she doesnt run with the same issues and i basiclly configured hers to be like mine without lancache

so here is the link
https://1drv.ms/f/c/2759db01e8e27b46/EuIE6VvK0wtCsxan-H2_tsIBv9pQYmVCqEsXFvRIMWP_ig?e=WM0mRs

im thinking maybe no help till i get faster internet.. but i keep trying to resolve it..

[comet424]

@stephenw10 so more testing and frustration..

so like home depot search works fine on computers behind the vpn... but anything behind WAN works only at time i restore the configuration file.. it works for a while... then boom it stops resolving that site
now if i set the general page and set 1.1.1.1 to use the WAN pppoe or if i set it to DHCP well 1 it leaks that dns over into the VPN it doesnt stay it ins lane.. that 1.1.1.1 ony works for the wan ppoe interface, and doesnt come over into the VPN lane and share it too..

and if i connect to teh modem itself with acomputer that has no issue... and if i factory reset and just let LAN use WAN and no configuring of a VPN then it has no issues... it comes to when i split things so part of the network uses WAN and part uses VPN.. but basiclly if you sit everything behind the vpn then that works... but i cant seem to get an equal balance... WAN stays in its lan and doesnt come over to the VPN side... i did this orginally due to Xbox being double nat'd going through vpn and had issues and my webserver couldnt work

so i not sure if its caused by the dns resolver as i set it both to ALL incoming and out going i removed my host over rides... i not sure if its the Bypass Routing policy 1918 doing it that i got configured..

how do you properly split pfsense like DMZ or Some LAN IPs , and VPN Clients they they both stay in there own lane the lancache i had tried behind on the behind the VPN and DMZ side or well maybe not fully DMZ as its just the default way pfsense sets up LAN so its still protected from the firewall.. and not wide open no firewall..

ive tried the no wan egress and 1,1,1,1 for wan under general with no wan egress on vpn doesnt solve that.. i not sure if my slow speed stalls out my modem or glitchs the dns ive tried 15 30 min modem shut off... but if i restore config file it works fine for a little while... so its almost like you need 2 pfsense's 1 for WAN and 1 for VPN and the vpn goes out the the WAN pfsense... and pfsense 1 WAN would do ips 192.168.0.2-50 and pfsense 2 VPN side would do 192.168.0.51-254

so is there a way cuz if i use lan dhcp and tell it to use 1.1.1.1 but then that buggers things up too as then pfsense doesnt resolve local names on the network and then its also leaked out

or is the best to do this as i thought of it before too but i wanted LAN 192.168.0.x some ips to be behind vpn and others just on WAN
is it best to just do

192.168.0.x uses VPN
192.168.5,x users WAN
instead of 192.168.0.1-50 uses WAN but some ips are set to VPN

as i do 192.168.x.0 x = 10,20,30,40,50 using WAN

ive noticed this problem for a long time but it comes and goes but its hard to tell cuz my internet so slow to todays standards of internet use i just wanting to fix things before i get fiber high speed as dsl high speed no longer as good and i seeing more glitchs surfing the web etc that i notice more... probably the wifi devices i added bogging down internet or my webserver.. hard to pin point but i do finding my configurations not cutting it...

sorry dragging out i appreciate the help you have done so far to help.. and i going to try couple other things like lan just uses VPN and my dmz to use just WAN and see how things go and try couple other settings to try..

ill let you know how it goes.. and stil lwasnt able to upload pics rate limit error whatever that is

[stephenw10]

I would try disabling DNSSec. When running in forwarding mode that can cause problems if one of the servers you're forwarding to doesn't correctly support it.

[comet424]

@stephenw10 ok i unchecked dnssec support under dns resolver..

i still get frustrated too if internet stop workin but openvpn still shows things connected and i reboot.. it wont reconnect.. pfsense cant ping websites.. resetting states or reboot doesnt help sometimes disabling the interface vpn and then re enabling fixes it.. or i end up restoring that xml i made that avoids adding dns resolver.. and internet and vpns show connection back in openvpn..

like that is so messed up why that does it...

but i testing nowing with the dnssec unchecked

so does the dnssec mean if it doesnt support dns sec it basiclly crashes pfsense ? or locks it in an infinite loop ?

but ok testing it now and see how it goes

[stephenw10]

If you have dnssec enabled then any responses from servers that don't support it will be ignored. When you are forwarding queries to external servers there is no point using DNSSec because you are already trusting the configured servers. But the worse case is if one of those doesn't support DNSSec then you may just see DNS fail if that's the server used.

See: https://docs.netgate.com/pfsense/en/latest/services/dns/resolver-config.html#dns-resolver-options

[comet424]

@stephenw10 so disabling didnt help

so its almost like a flag if my internet fails for so long pfsense flags and disables

so what happens

this is with pppoe or dhcp 192.168.2.x on the WAN

it will work for a long time or so.. then internet doesnt work VPN goe offline.. VPN and WAN internet no longer work.. Pfsense cant ping google.ca but it can ping 1.1.1.1

if i reboot wan comes online but it doesnt work pfsense cant ping google only like 1.1.1.1 and its not using monitor ip of 1.1.1.1 just the default DSL modem provides from bell

so i tried disabling the interfaces WAN and vpns did a reboot then re enabled.. still cant get vpn or WAN to goto any websites.. pfsense cant Ping google.ca but can ping 1.1.1.1

resetting states does nothing..

but if i restore my config file.. when reboots vpn up and working, WAn is working, pfsense can ping google.ca and things working... its like the pfsense gets a flag to no longer work even reboots dont fix this flag.. except a restore of the config file..

is there something in the logs i need to capture when this happens next.. is there a glitch in pfsense maybe that does this... is there a file i need to delete that let me fix it like how you delete the dhcpd leases from shell when the gui doesnt work... is it a glitch cuz my poor internet is causing this.. i havent resolved the homedepot issue.. but for now i dealing with this locking up.. and i not sure if i just let pfsense alone an hour to see if it correct itself..

and i figured out why host names or description names dont work i had it set to the kea dhcp it doesnt seem to work so i set it back to isc and names show up.. dunno why its broken on the kea side..

but ya so i dunno what to look for or a logger to say dns resolver is down that u cant ping by web names only ips

[Gertjan]

@comet424 said in Port Forwarding stopped working after upgrading to 2.8.0:

it will work for a long time or so.. then internet doesnt work VPN goe offline.. VPN and WAN internet no longer work.. Pfsense cant ping google.ca but it can ping 1.1.1.1

Please rephrase.
You can't reach 1.1.1.1 - and get replies back - when your internet is down.

[comet424]

@Gertjan sorry i guess i should added a comma after it cant ping google.ca, but it can ping 1.1.1.1

so what i ment my stupid dyslexia,,

i cant ping "google.ca"
i can ping "1.1.1.1" or "8.8.8.8"

so names i cant ping ip address i can ping

sorry

and the only way to fix it is i gotta restore my configuration file.. as a reboot disabling interfaces vpn or wan and re enabling doesnt fix it.. but i restore the config file and pinging names is back up and working

i havent tried yet where this fails... like stop any comps on the network of using internet or just unplug lan from pfsese let it sit for an hour and see if it corrects itself..

but reboots dont fix it but restoring the config file fixes it

[comet424]

i think cuz my internet so slow and if it gets bogged down where pages dont load etc that it triggers something in pfsense like a flag and doesnt let internet to work properly again

as my internet is only 3mbps and 500k upload and thats if i lucky just bad internet now a days for rural areas.. but i am getting fiber sometime this year they doing projects.... so i figure my slow internet triggers something in pfsense to disable things and restore fixes it

now im probably wrong.. but that is what i thinking is going on. from what i experiencing

[comet424]

@stephenw10 so i did more testing
cuz pfsense keeps locking me out of internet on the 2.8.0 i dont remember it happening so much on 2.7.2

but when the internet stops working on WAN or vpn.. it can connect to some sites on the WAN
if i unplug the lan and let the pfsense rest for an hour i still can not ping websites by there name so google.ca ebay.com amazon.com from pfsense but i can ping 1.1.1.1 8.8.8.8

i tried reboot and the wan says online, but vpn doesnt work... my site to site to my sisters pfsense is down pfsense can not not ping dns names.. i can just ping ip address's

i change the wan from pppoe to dhcp so it gets 192.168.2.x ip and i can just ping ip address not dns names i do a reboot and i still cant connect site to site.. dns names dont work just ips..

i delete all in the dns reslover and set ALL ALL for incoming and outgoing.. i do reboot pfsense and still cant ping dns names from pfsense just ip address's

i do a restore of the config file boom i can ping dns names again once it reboots.. so something seems to get flag and reboots cant correct it..

is it my poor internet thats causing this like seems like a flag issue.. its like a circuit breaker.. it trips and you cant use internet anymore till you reset the breaker or restore pfsense...

i cant downgrade to 2.7.2 cuz its not an option in the update.. could this be a panic kernel issue where i had to set that set hint.iwm.disable="1"

could the os be panicing and bricking my dns till i restore and then its solved till it breaks like a circuit breaker..

is there more tests i can test?

[Gertjan]

@comet424 said in Port Forwarding stopped working after upgrading to 2.8.0:

i cant ping "google.ca"
i can ping "1.1.1.1" or "8.8.8.8"

so names i cant ping ip address i can ping

if "google.ca" doesn't work, but 1.1.1.1 or 8.8.8.8 works, this means the classic failure applies :
DNS is broken.
Remember : DNS 'translates' for you a host name like "google.ca" or cnn.com" to an IP address.

@comet424 said in Port Forwarding stopped working after upgrading to 2.8.0:

but reboots dont fix it but restoring the config file fixes it

A reboot : loads the config file, and set up all the parameters.
A 'restoring the config file' is very close to 'loads the config file = does the same thing.

My advise : remove all VPN stuff.
Go back to a working condition as pfSense out of the box works.
From then on, make small changes, and use a several days wait and test cycle.

[comet424]

@Gertjan ok ill retry that ill try to re do it all or ill delete the vpn stuff and go back to plain

as ya a reboot doesnt fix anything and site to site that works on WAN not vpn cant even reconnect all you can do is goto ip address;s so its like i thought a breaker is tripped it trips the dns breaker and bricks it till i restore the file as a reboot does nothing..

i had to restore the file 3 times yesterday and once this morning to reply to your response..
but ok ill give it a try and see what happens remove

as it is frustrating for sure as i didnt see this in 2.7.2 or 2.7.0

but ill get back to you guys as it craps outs trying to update my unraid Server apps and then i loose internet

so i restored file
i disabled the 2 vpns interfaces
i disabled the LAN rules for vpn and * for all the lan to go out the wan
in the dns resolver i set incoming and outgoing to ALL and i disabled the dnssec as i using the lancache for windows updates etc.. so i left it in for now

so ill test this setup

[stephenw10]

Yup there is no 'stop working' flag or similar.

It's unrelated the driver firmware panic at boot in 2.8.

The one thing we can be fairly certain of here is that DNS stops working for some reason. So the first thing I would do is try to resolve something in Diag > DNS Lookup.
That will show you what DNS servers are configured and which if any is responding.

The other thing that seems consistent is that the VPN(s) fail to connect.
That could be a symptom or a cause. If your VPNs are connecting to servers defined by FQDN that would fail if DNS fails. So check that.
If the servers are defined by IP they should connect (but don't). That might imply that the DNS is failing because it only works over the VPN.

[comet424]

@stephenw10
ah ok,.. i figured maybe there was another type style panic where its panicing and bricking the dns as when you reboot it doesnt cure the issue..

so im currently running that setup above i disabled the vpn interfaces. and it takes a long time took like 5 min for it for it to take affect when i disabled the 2 interfaces..
and i disabled rules vpn so only works through wan.. and pfsense currently can ping

so i currently updating my apps in unraid as i wasnt able to it would drop out and then pfsense cant ping till i restore

as sitting for 1 hour didnt not fix the dns issues either (with the lan port disconnected..)

this here is the dns lookup of google.. its slow due to unraid is updating and maxing out my internet... but it is also this current setup

so i restored file
i disabled the 2 vpns interfaces
i disabled the LAN rules for vpn and * for all the lan to go out the wan
in the dns resolver i set incoming and outgoing to ALL and i disabled the dnssec as i using the lancache for windows updates etc.. so i left it in for now

so i currently testing that ill do that again when it fails.. or when i re do the vpn
but this is currently what i starting from... ill get back to u when if anything fails

and i not sure how to check vpns for the FQDN ill have to look up what FQDN is ive see that name before

[comet424]

so i looked up what that FQDN so thats like the domain names

so for my
WAN site to site to my sisters Pfsense i use a domain name
VPNS to connect to the PIA is also domain names

none use ip address's in the vpn settings

[comet424]

@stephenw10 so i had issues again with running WAN it fails till i restore the configuration i have

here is the dnslookup and ppoe etc

now here is when i do a restore of the config file and i dnslookup

[stephenw10]

Ok so VPNs won't be able to connect if the servers are all defined as FQDNs and DNS fails.

What are 10.0.0.241 and 10.0.0.243?

You have 1.1.1.1 configured as a DNS server in System > General Setup?

When DNS fails it appears the system no longer has any DNS servers available other than Unbound on localhost. If Unbound is in forwarding mode that will also fail if it has no servers to forward to.

[comet424]

@stephenw10
so the 10.0.0.241 and 243 is just for the VPN so in general.

i removed that 1.1.1.1 from the WAN_ppoe and also had at none in general setup..

and at the point of testing the wan setup i had deleted all 3 of those dns.. it soly relied on the default like new no dns options under general setup..

so the test setup i mentioned yesterday where i disabled vpn interface.. i also deleted all the dns under general setup so it was a fresh slate

so if i restore delete the dns's under general setup disable the vpn interfaces set the rules to just lan to go out the wan... all setup in the first few mins of a restore that seems to be fine...

but when fails is what you saw in the screen shot.. if you need new screen shots let me know...

as pfsense doesnt use the vpn as internet though if uses the default where i specify use wan_ppoe under the routing section