Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Port Forwarding stopped working after upgrading to 2.8.0

    Scheduled Pinned Locked Moved General pfSense Questions
    92 Posts 5 Posters 2.5k Views 3 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S Online
      stephenw10 Netgate Administrator
      last edited by

      Ok so VPNs won't be able to connect if the servers are all defined as FQDNs and DNS fails.

      What are 10.0.0.241 and 10.0.0.243?

      You have 1.1.1.1 configured as a DNS server in System > General Setup?

      When DNS fails it appears the system no longer has any DNS servers available other than Unbound on localhost. If Unbound is in forwarding mode that will also fail if it has no servers to forward to.

      C 1 Reply Last reply Reply Quote 0
      • C Offline
        comet424 @stephenw10
        last edited by

        @stephenw10
        so the 10.0.0.241 and 243 is just for the VPN so in general.

        i removed that 1.1.1.1 from the WAN_ppoe and also had at none in general setup..

        and at the point of testing the wan setup i had deleted all 3 of those dns.. it soly relied on the default like new no dns options under general setup..

        so the test setup i mentioned yesterday where i disabled vpn interface.. i also deleted all the dns under general setup so it was a fresh slate

        so if i restore delete the dns's under general setup disable the vpn interfaces set the rules to just lan to go out the wan... all setup in the first few mins of a restore that seems to be fine...

        but when fails is what you saw in the screen shot.. if you need new screen shots let me know...

        as pfsense doesnt use the vpn as internet though if uses the default where i specify use wan_ppoe under the routing section

        1 Reply Last reply Reply Quote 0
        • stephenw10S Online
          stephenw10 Netgate Administrator
          last edited by

          Was Unbound still set to forwarding mode? It needs to have some external servers configured to forward to in that case.

          C 1 Reply Last reply Reply Quote 0
          • C Offline
            comet424 @stephenw10
            last edited by comet424

            @stephenw10 so if you mean the host overrides?

            where i have dnssec turned off

            and the host overrides point to 192.168.0.32 (lancache)

            and the lancache then points to 1.1.1.1

            ive also tried pointing to the pia vpn dns and the nordvpn dns

            but doesnt help

            ive also tried where i re enable the dnssec deleted all the host over rides.. plus the custom options as you seen in my text file to the my one drive link.. and it didnt solve nothing a reboot still wouldnt let pfsense ping doman names just ips and i have enable forwarding mode turned off

            C 1 Reply Last reply Reply Quote 0
            • C Offline
              comet424 @comet424
              last edited by

              ill re do the tests

              so to double check when the Enable Forwarding is checked it uses the DNS's under general setup

              and if there is no dns's and you have the enable forwarding checked then there are no dns's and it cant work correct?

              and if so ill re do the test

              current test i doing is
              of the vpns turned on and forward enabled the host overrides... and when my internet fails ill do that dnslookup and post the info

              1 Reply Last reply Reply Quote 0
              • stephenw10S Online
                stephenw10 Netgate Administrator
                last edited by

                OK if Unbound was not in forwarding mode when this was taken:
                https://forum.netgate.com/assets/uploads/files/1754407237097-dns-lookup-wan.png

                Then Unbound was failing to resolve at that point. Check the Resolver logs for errors. You can also increase the log level to give more detail on individual queries.

                C 1 Reply Last reply Reply Quote 0
                • C Offline
                  comet424 @stephenw10
                  last edited by

                  @stephenw10 that i dont remember

                  but also if i do have forwarding checked off.. how does wan work when i dont have the 1.1.1.1 in general setup pointing to wan_ppoe

                  cuz i find everytime i add that it leaks the 1.1.1.1 into the vpn

                  to seperate it wan and vpn
                  do you just have the general setup point to the 2 pia vpn

                  and on dns resolver set all for incoming and just outgoing to 2 vpn interfaces..

                  and then wan will do its own thing ??

                  and under system logs do i set it to Formated or Raw .. its set at general loggin options.. to get that more detailed logs

                  and thanks for the help and patience so far.. i also learning alot too at same time

                  C 1 Reply Last reply Reply Quote 0
                  • stephenw10S Online
                    stephenw10 Netgate Administrator
                    last edited by

                    There's no way you can have all DNS queries run over the VPN if the VPN servers are defined as FQDNs which require DNS to connect. 😉

                    If you don't have forwarding enabled Unbound resolves directly against the DNS root servers. It can do that across any route.

                    If you want to avoid DNS "leaks" from clients using one of the VPNs it's usually best to pas clients different DNS servers to use via DHCP and then route traffic to those over the VPN. You can also then add block rules to prevent any other DNS traffic leaving over the WAN directly.

                    Doing that means DNS from pfSense itself can be left as default because clients being routed via the VPN won't use it. But it would also mean those clients don't use the overrides and hence the lancache.

                    An alternative would be so set the DNS behaviour in general setup to 'use remote, ignore local'. Then pfSense itself will use the defined external servers and you can allow VPN clients to use Unbound with the overrides. Unbound itself should be set to only use the VPNs for outgoing queries in that scenario.

                    C 1 Reply Last reply Reply Quote 0
                    • C Offline
                      comet424 @comet424
                      last edited by

                      @stephenw10 so internet lasted a few hours then went down again.. when my vpn goes down or 100% packet loss it just takes out the wan

                      so i did dns resolver logs when it failed.. and when i rebooted and it never fixed itself..

                      the dns resolver i left it as forwarding and i only had the 2 vpns selected as outgoing.. and that seemed to work wan worked vpn worked and then it just fails or what not...

                      i did notice i could ping 1.1.1.1 but dnslookup failed for 1.1.1.1 i left it as the general i didnt know if u wanted raw or formated..

                      but here is the screen shots

                      issue1.png issue2.png issue4.png issue5.png issue7.png issue8.png issue9.png

                      here i rebooted the pfsense

                      issue10.png issue11.png issue12.png

                      here is the dns logger files.. 1 is when it failed.. and the other is when i rebooted. and nothing fixed itself
                      dns resolver after reboot.txt dns resolver.txt

                      is it doing that its removing the dns servers and it cant resolve as its showing that there is no server.. and if so how can i fix this then so wan is seperate from the vpn they dont leak over to vpn and nothing fails

                      and is this cuz my internet is so poor its buggering up the vpn or loosing internet...

                      i will retest again without the vpns tommorow.... but any other tricks or a Check box to make the vpn and wan seperate and work and not fail....

                      i do hope when i get better internet all this issues go away

                      1 Reply Last reply Reply Quote 0
                      • C Offline
                        comet424 @stephenw10
                        last edited by

                        @stephenw10 my reply was before i saw your reply

                        ill re read what you said what to do and the use remote ignore local ill have to look that up and google too.. as right now all you mentioned kinda lost me... so i have to re read it a few times with my disylexia and then review how to fix it...

                        so for the dhcp i just tell it dns is 192.168.0.1 i left it simple so that covered vpn and just plain
                        and if you you dont use 192.168.0.1 as the dns dont u loose local domains like the server names?

                        ill re read your comments tommorow.. as i got a headache and trying to understand what you wrote with a headache just makes headaches work... i appreciate the help so far

                        and i wish there was a video i could learn from as i a visual learner...

                        but ill try this stuff tommorow to look it up or figure it out from google what you mentioned

                        C 1 Reply Last reply Reply Quote 0
                        • C Offline
                          comet424 @comet424
                          last edited by comet424

                          so i set General Setup
                          just the 2 dns servers

                          i set the use remote dns ignore local

                          under dns resolver

                          i unchecked dns sec, left the enable forwarding, and i set the incoming all and outgoing to just the 2 vpn servers

                          now i going to let that run all night and see what happens....

                          and ill look up that other information tommorow

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S Online
                            stephenw10 Netgate Administrator
                            last edited by

                            You can't DNS Lookup 1.1.1.1, it's not an FQDN.

                            When you have the outgoing interfaces in Unbound set to only the VPNs then it will fail to resolve anything if the VPNs go down.

                            If pfSense itself it also set to use only the VPN DNS servers it won't be able to resolve the VPN servers to connect to them.

                            pfSense itself must have access to some other DNS server. Or the VPN servers must be entered as IP addresses directly.

                            I would revert to a much simpler more default config and make sure that works first.

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.