Port Forwarding stopped working after upgrading to 2.8.0

stephenw10

If you have dnssec enabled then any responses from servers that don't support it will be ignored. When you are forwarding queries to external servers there is no point using DNSSec because you are already trusting the configured servers. But the worse case is if one of those doesn't support DNSSec then you may just see DNS fail if that's the server used.

See: https://docs.netgate.com/pfsense/en/latest/services/dns/resolver-config.html#dns-resolver-options

comet424

@stephenw10 so disabling didnt help

so its almost like a flag if my internet fails for so long pfsense flags and disables

so what happens

this is with pppoe or dhcp 192.168.2.x on the WAN

it will work for a long time or so.. then internet doesnt work VPN goe offline.. VPN and WAN internet no longer work.. Pfsense cant ping google.ca but it can ping 1.1.1.1

if i reboot wan comes online but it doesnt work pfsense cant ping google only like 1.1.1.1 and its not using monitor ip of 1.1.1.1 just the default DSL modem provides from bell

so i tried disabling the interfaces WAN and vpns did a reboot then re enabled.. still cant get vpn or WAN to goto any websites.. pfsense cant Ping google.ca but can ping 1.1.1.1

resetting states does nothing..

but if i restore my config file.. when reboots vpn up and working, WAn is working, pfsense can ping google.ca and things working... its like the pfsense gets a flag to no longer work even reboots dont fix this flag.. except a restore of the config file..

is there something in the logs i need to capture when this happens next.. is there a glitch in pfsense maybe that does this... is there a file i need to delete that let me fix it like how you delete the dhcpd leases from shell when the gui doesnt work... is it a glitch cuz my poor internet is causing this.. i havent resolved the homedepot issue.. but for now i dealing with this locking up.. and i not sure if i just let pfsense alone an hour to see if it correct itself..

and i figured out why host names or description names dont work i had it set to the kea dhcp it doesnt seem to work so i set it back to isc and names show up.. dunno why its broken on the kea side..

but ya so i dunno what to look for or a logger to say dns resolver is down that u cant ping by web names only ips

Gertjan

@comet424 said in Port Forwarding stopped working after upgrading to 2.8.0:

it will work for a long time or so.. then internet doesnt work VPN goe offline.. VPN and WAN internet no longer work.. Pfsense cant ping google.ca but it can ping 1.1.1.1

Please rephrase.
You can't reach 1.1.1.1 - and get replies back - when your internet is down.

comet424

@Gertjan sorry i guess i should added a comma after it cant ping google.ca, but it can ping 1.1.1.1

so what i ment my stupid dyslexia,,

i cant ping "google.ca"
i can ping "1.1.1.1" or "8.8.8.8"

so names i cant ping ip address i can ping

sorry

and the only way to fix it is i gotta restore my configuration file.. as a reboot disabling interfaces vpn or wan and re enabling doesnt fix it.. but i restore the config file and pinging names is back up and working

i havent tried yet where this fails... like stop any comps on the network of using internet or just unplug lan from pfsese let it sit for an hour and see if it corrects itself..

but reboots dont fix it but restoring the config file fixes it

comet424

i think cuz my internet so slow and if it gets bogged down where pages dont load etc that it triggers something in pfsense like a flag and doesnt let internet to work properly again

as my internet is only 3mbps and 500k upload and thats if i lucky just bad internet now a days for rural areas.. but i am getting fiber sometime this year they doing projects.... so i figure my slow internet triggers something in pfsense to disable things and restore fixes it

now im probably wrong.. but that is what i thinking is going on. from what i experiencing

comet424

@stephenw10 so i did more testing
cuz pfsense keeps locking me out of internet on the 2.8.0 i dont remember it happening so much on 2.7.2

but when the internet stops working on WAN or vpn.. it can connect to some sites on the WAN
if i unplug the lan and let the pfsense rest for an hour i still can not ping websites by there name so google.ca ebay.com amazon.com from pfsense but i can ping 1.1.1.1 8.8.8.8

i tried reboot and the wan says online, but vpn doesnt work... my site to site to my sisters pfsense is down pfsense can not not ping dns names.. i can just ping ip address's

i change the wan from pppoe to dhcp so it gets 192.168.2.x ip and i can just ping ip address not dns names i do a reboot and i still cant connect site to site.. dns names dont work just ips..

i delete all in the dns reslover and set ALL ALL for incoming and outgoing.. i do reboot pfsense and still cant ping dns names from pfsense just ip address's

i do a restore of the config file boom i can ping dns names again once it reboots.. so something seems to get flag and reboots cant correct it..

is it my poor internet thats causing this like seems like a flag issue.. its like a circuit breaker.. it trips and you cant use internet anymore till you reset the breaker or restore pfsense...

i cant downgrade to 2.7.2 cuz its not an option in the update.. could this be a panic kernel issue where i had to set that set hint.iwm.disable="1"

could the os be panicing and bricking my dns till i restore and then its solved till it breaks like a circuit breaker..

is there more tests i can test?

Gertjan

@comet424 said in Port Forwarding stopped working after upgrading to 2.8.0:

i cant ping "google.ca"
i can ping "1.1.1.1" or "8.8.8.8"

so names i cant ping ip address i can ping

if "google.ca" doesn't work, but 1.1.1.1 or 8.8.8.8 works, this means the classic failure applies :
DNS is broken.
Remember : DNS 'translates' for you a host name like "google.ca" or cnn.com" to an IP address.

@comet424 said in Port Forwarding stopped working after upgrading to 2.8.0:

but reboots dont fix it but restoring the config file fixes it

A reboot : loads the config file, and set up all the parameters.
A 'restoring the config file' is very close to 'loads the config file = does the same thing.

My advise : remove all VPN stuff.
Go back to a working condition as pfSense out of the box works.
From then on, make small changes, and use a several days wait and test cycle.

comet424

@Gertjan ok ill retry that ill try to re do it all or ill delete the vpn stuff and go back to plain

as ya a reboot doesnt fix anything and site to site that works on WAN not vpn cant even reconnect all you can do is goto ip address;s so its like i thought a breaker is tripped it trips the dns breaker and bricks it till i restore the file as a reboot does nothing..

i had to restore the file 3 times yesterday and once this morning to reply to your response..
but ok ill give it a try and see what happens remove

as it is frustrating for sure as i didnt see this in 2.7.2 or 2.7.0

but ill get back to you guys as it craps outs trying to update my unraid Server apps and then i loose internet

so i restored file
i disabled the 2 vpns interfaces
i disabled the LAN rules for vpn and * for all the lan to go out the wan
in the dns resolver i set incoming and outgoing to ALL and i disabled the dnssec as i using the lancache for windows updates etc.. so i left it in for now

so ill test this setup

stephenw10

Yup there is no 'stop working' flag or similar.

It's unrelated the driver firmware panic at boot in 2.8.

The one thing we can be fairly certain of here is that DNS stops working for some reason. So the first thing I would do is try to resolve something in Diag > DNS Lookup.
That will show you what DNS servers are configured and which if any is responding.

The other thing that seems consistent is that the VPN(s) fail to connect.
That could be a symptom or a cause. If your VPNs are connecting to servers defined by FQDN that would fail if DNS fails. So check that.
If the servers are defined by IP they should connect (but don't). That might imply that the DNS is failing because it only works over the VPN.

comet424

@stephenw10
ah ok,.. i figured maybe there was another type style panic where its panicing and bricking the dns as when you reboot it doesnt cure the issue..

so im currently running that setup above i disabled the vpn interfaces. and it takes a long time took like 5 min for it for it to take affect when i disabled the 2 interfaces..
and i disabled rules vpn so only works through wan.. and pfsense currently can ping

so i currently updating my apps in unraid as i wasnt able to it would drop out and then pfsense cant ping till i restore

as sitting for 1 hour didnt not fix the dns issues either (with the lan port disconnected..)

this here is the dns lookup of google.. its slow due to unraid is updating and maxing out my internet... but it is also this current setup

so i restored file
i disabled the 2 vpns interfaces
i disabled the LAN rules for vpn and * for all the lan to go out the wan
in the dns resolver i set incoming and outgoing to ALL and i disabled the dnssec as i using the lancache for windows updates etc.. so i left it in for now

so i currently testing that ill do that again when it fails.. or when i re do the vpn
but this is currently what i starting from... ill get back to u when if anything fails
dns lookup1.png

and i not sure how to check vpns for the FQDN ill have to look up what FQDN is ive see that name before

comet424

so i looked up what that FQDN so thats like the domain names

so for my
WAN site to site to my sisters Pfsense i use a domain name
VPNS to connect to the PIA is also domain names

none use ip address's in the vpn settings

comet424

@stephenw10 so i had issues again with running WAN it fails till i restore the configuration i have

here is the dnslookup and ppoe etc
dns lookup wan.png
dns lookup 2.png dns lookup 3.png dns lookup 4.png dns lookup 5.png

now here is when i do a restore of the config file and i dnslookup
dns lookup 6.png

stephenw10

Ok so VPNs won't be able to connect if the servers are all defined as FQDNs and DNS fails.

What are 10.0.0.241 and 10.0.0.243?

You have 1.1.1.1 configured as a DNS server in System > General Setup?

When DNS fails it appears the system no longer has any DNS servers available other than Unbound on localhost. If Unbound is in forwarding mode that will also fail if it has no servers to forward to.

comet424

@stephenw10
so the 10.0.0.241 and 243 is just for the VPN so in general.

i removed that 1.1.1.1 from the WAN_ppoe and also had at none in general setup..

and at the point of testing the wan setup i had deleted all 3 of those dns.. it soly relied on the default like new no dns options under general setup..

so the test setup i mentioned yesterday where i disabled vpn interface.. i also deleted all the dns under general setup so it was a fresh slate

so if i restore delete the dns's under general setup disable the vpn interfaces set the rules to just lan to go out the wan... all setup in the first few mins of a restore that seems to be fine...

but when fails is what you saw in the screen shot.. if you need new screen shots let me know...

as pfsense doesnt use the vpn as internet though if uses the default where i specify use wan_ppoe under the routing section

stephenw10

Was Unbound still set to forwarding mode? It needs to have some external servers configured to forward to in that case.

comet424

@stephenw10 so if you mean the host overrides?

where i have dnssec turned off

and the host overrides point to 192.168.0.32 (lancache)

and the lancache then points to 1.1.1.1

ive also tried pointing to the pia vpn dns and the nordvpn dns

but doesnt help

ive also tried where i re enable the dnssec deleted all the host over rides.. plus the custom options as you seen in my text file to the my one drive link.. and it didnt solve nothing a reboot still wouldnt let pfsense ping doman names just ips and i have enable forwarding mode turned off

comet424

ill re do the tests

so to double check when the Enable Forwarding is checked it uses the DNS's under general setup

and if there is no dns's and you have the enable forwarding checked then there are no dns's and it cant work correct?

and if so ill re do the test

current test i doing is
of the vpns turned on and forward enabled the host overrides... and when my internet fails ill do that dnslookup and post the info

stephenw10

OK if Unbound was not in forwarding mode when this was taken:
https://forum.netgate.com/assets/uploads/files/1754407237097-dns-lookup-wan.png

Then Unbound was failing to resolve at that point. Check the Resolver logs for errors. You can also increase the log level to give more detail on individual queries.

comet424

@stephenw10 that i dont remember

but also if i do have forwarding checked off.. how does wan work when i dont have the 1.1.1.1 in general setup pointing to wan_ppoe

cuz i find everytime i add that it leaks the 1.1.1.1 into the vpn

to seperate it wan and vpn
do you just have the general setup point to the 2 pia vpn

and on dns resolver set all for incoming and just outgoing to 2 vpn interfaces..

and then wan will do its own thing ??

and under system logs do i set it to Formated or Raw .. its set at general loggin options.. to get that more detailed logs

and thanks for the help and patience so far.. i also learning alot too at same time

stephenw10

There's no way you can have all DNS queries run over the VPN if the VPN servers are defined as FQDNs which require DNS to connect.

If you don't have forwarding enabled Unbound resolves directly against the DNS root servers. It can do that across any route.

If you want to avoid DNS "leaks" from clients using one of the VPNs it's usually best to pas clients different DNS servers to use via DHCP and then route traffic to those over the VPN. You can also then add block rules to prevent any other DNS traffic leaving over the WAN directly.

Doing that means DNS from pfSense itself can be left as default because clients being routed via the VPN won't use it. But it would also mean those clients don't use the overrides and hence the lancache.

An alternative would be so set the DNS behaviour in general setup to 'use remote, ignore local'. Then pfSense itself will use the defined external servers and you can allow VPN clients to use Unbound with the overrides. Unbound itself should be set to only use the VPNs for outgoing queries in that scenario.