"Could not find gateway for interface (wan)" every quarter hour.

tix

I get this log entry on every quarter hour in the system log. Sometimes it causes the DNSMasq service to restart and others causes DHCP Server to restart but mostly just interruption in traffic.

I asked about this in the general 2.0 forum and no one else is reporting this entry as the cron job that runs on the qtr hour doesn't exist in the base code so I assume it's part of the IPv6 code train. Google indicates that this is old code from the Squid package but that isn't installed.

I don't 'speak' PHP but can someone explain what this script does and what it's for?

0,15,30,45 * * * * root /etc/rc.filter_configure_sync

#!/usr/local/bin/php -f
/* $Id$ */
/*
    rc.filter_configure_sync
    part of pfSense (http://www.pfSense.com)
    Copyright (C) 2004 Scott Ullrich
    All rights reserved.

    Redistribution and use in source and binary forms, with or without
    modification, are permitted provided that the following conditions are met:

    1\. Redistributions of source code must retain the above copyright notice,
       this list of conditions and the following disclaimer.

    2\. Redistributions in binary form must reproduce the above copyright
       notice, this list of conditions and the following disclaimer in the
       documentation and/or other materials provided with the distribution.

    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
    POSSIBILITY OF SUCH DAMAGE.
*/

require_once("config.inc");
require_once("functions.inc");
require_once("filter.inc");
require_once("shaper.inc");
require_once("ipsec.inc");
require_once("vpn.inc");

/* invalidate interface cache */
get_interface_arr(true);

filter_configure_sync();

?>

wallabybob

I run the base system with IPv6 enhancements and that file is not in my crontab.

The real work is done in filter_config_sync() in /etc/inc/filter.inc and a quick scan of that file suggests /etc/rc.filter_configure_sync is put into crontab if there are schedules in firewall rules.

Do you have any firewall rules with schedules? Do you need the schedules?
(I don't have any firewall rules with schedules.)

Perhaps if firewall rules get "adjusted" every 15 mins then there could be some (hopefully small) time windows when packets are discarded because there is no rule allowing them in. The width of such a window might depend on how busy your system is.

databeestje

Well, it's not uncommon for rules to reload if it has something like hostnames and other factors.

I think what's biting here is that firewall rules for proper multi-wan support are missing. When that falls through the reply-to is skipped and the default route is relied on.

I'll have a quick look if I can make the filter process intelligent enough to find out the proper v6 wan gateway.