• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Large amount of data usage

Scheduled Pinned Locked Moved General pfSense Questions
24 Posts 6 Posters 2.7k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • J
    johnpoz LAYER 8 Global Moderator
    last edited by May 1, 2018, 9:36 AM

    Ok if they give you multiple IP are those IPv4 or IPv6?  Doesn't really matter but IPv6 would explain lots of IPs very easy..

    So how exactly are you connecting this wireless router..  Are you leaving it connected the same time you using pfsense?  If you get IPv6 address, pfsense for sure could be giving all your clients IPv6 and your ISP could be counting those.. But would think you would see more than 2 then..

    But if your isp is giving out multiple IPv4 then maybe you have multiple devices on the ISP ipv4 network vs behind NAT (pfsense or your wifi router)..

    As to "MAC filtering and no one is able to access it that way"

    I sure hope you have actual security setup, WPA2 with a secure PSK??  Mac filtering is a control method and a joke to circumvent if your wifi network is not actually secured..

    An intelligent man is sometimes forced to be drunk to spend time with his fools
    If you get confused: Listen to the Music Play
    Please don't Chat/PM me for help, unless mod related
    SG-4860 24.11 | Lab VMs 2.8, 24.11

    1 Reply Last reply Reply Quote 0
    • M
      mikecala
      last edited by May 1, 2018, 9:44 AM

      They should be IPv4 but I can disable IPv6 if you think that could be the cause.

      Also it is connected at the same time as pfsense but it is only connected to the LAN port on the router with dhcp disabled.

      Yes I do have WPA2 with a PSK, no names or room numbers or anything like that, along with the MAC filtering.

      1 Reply Last reply Reply Quote 0
      • J
        johnpoz LAYER 8 Global Moderator
        last edited by May 1, 2018, 9:53 AM

        Mac filtering is pretty pointless.. Its good for say controlling which devices connect to which AP when you have more than one.. Or if you want to like shut off the kids wifi access at bedtime, etc.  It is not or has it ever been an actual security feature… Its like putting some duct tape across your door jam after you have set the deadbolt -- that will make it harder for them to get in ;)

        What it does do is make it harder to get on your own network... Oh sure billy you want to use my wifi, whats your mac address so I can go add it to the list..

        " only connected to the LAN port on the router with dhcp disabled."

        How exactly do you have it connected??  Your not going going through your switch right..  So you have connected like the left where switch is after the firewall... Or do you have it like the right side where your modem is connected to your switch and you have vlans setup to isolate traffic?

        connection.png
        connection.png_thumb

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • M
          mikecala
          last edited by May 1, 2018, 9:56 AM

          It is setup like the left. My internet comes from the ISP through an ethernet port in the wall then to pfsense then the switch then the wireless router.

          1 Reply Last reply Reply Quote 0
          • J
            johnpoz LAYER 8 Global Moderator
            last edited by May 1, 2018, 10:43 AM May 1, 2018, 10:40 AM

            Well then really the only way you could have 2 IPs being seen by the ISP would be from IPv6..  You can look on pfsense to see what IPs it has..

            Prob have a IPv4 address and IPv6, etc.. Out of the box pfsense wold not grab more than 1 IPv4 on its wan interface… Unless you setup VIP?

            You can see exactly what IPs pfsense has right on the dashboard..  Do you see IPv6 Addresses?

            Another thought on your days you see 2 IPs.. You do understand that since your pfsense mac of its wan interface is different than the mac of your wifi router.. If you say where changing them in an out for testing that your ISP would see 2 IPs for those days... The IPv4 pfsense wan got, and then the IPv4 your wifi router got.

            To be honest - that would be my guess to why your seeing 2 IPs on some days.

            If you want to swap your pfsense and wifi router in and out of your connection and use the same IP.. You could prob setup mac clone on either pfsense or your wifi router so that you present the same MAC address to your ISP so via dhcp you should always get the same address.  I use to do this all the time when running router as vm.. I could swap out different distros and even different copies of pfsense and always have the same public IP because I set all the VMs to use the same MAC on their wan interface.. Also meant I didn't have to reboot my cable modem when changing routers in and out.

            IPs.png
            IPs.png_thumb

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • M
              mikecala
              last edited by May 1, 2018, 11:07 AM

              There is no IPv6 address that shows up in the list.

              Also the IP issue isn't caused by the routers being switched because I only switched after weeks of the dual IPs and then after two days pass it shows only the one IP. I only switched to try to narrow down the cause of the issue after the fact.

              Also I don't have to worry about rebooting a modem because I don't have one.

              Right now since I just connected it I will have to wait another two days to see if this problem still persists. I also have bandwidthd, Status_Traffic_Totals, and darkstat running now to try to see what I see compared to the ISP.

              1 Reply Last reply Reply Quote 0
              • J
                johnpoz LAYER 8 Global Moderator
                last edited by May 1, 2018, 12:55 PM

                Well it could very well be your IP is just changing.. I would write down what your IP is currently on pfsense, and check it now and then to see if it is changing.. It could be that they are just handing you a different IP… Your wan on pfsense is set to dhcp right.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • M
                  mikecala
                  last edited by May 3, 2018, 8:00 AM

                  So I switched routers back to only pfsense on the 1st and waited until the 3rd to check the usage to be sure that it wasn't just two IPs from both routers being on in one day and it showed two IPs again.

                  I called customer support and of course they told me my router is in "bridge mode" again but that's how great outsourced tech support is..

                  They also gave me the two IPs I was pulling and one of them is the one that is assigned to my WAN interface in pfsense and the other one does not show up in the interfaces section. Is there any way to track down where this is coming from since I have that IP now?

                  1 Reply Last reply Reply Quote 0
                  • J
                    johnpoz LAYER 8 Global Moderator
                    last edited by May 3, 2018, 8:49 AM

                    So they told you your routers in bridge mode - so pfsense has a public IP on its wan..

                    And it didn't change?  You checked on it now and then and made sure it didn't change like on day 2, etc..  This 2nd IP they say your using is also public..

                    You have nothing else plugged into your modem that is in bridge mode, and it has no WIFI on?  Just the 1 wire from modem to pfsense wan?

                    You do not have pfsense setup in bridge mode do you?  You can view all the ips pfsense would have on the diag, routes.. This would show you any vips you might of setup even..  See attached I created a vip 1.2.3.4 just to show as example…

                    pfsenseips.png
                    pfsenseips.png_thumb

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • M
                      mikecala
                      last edited by May 4, 2018, 7:12 AM

                      Yes the IP has been the same since I plugged it in and it's still the same.

                      It's fiber so no modem but yes pfsense is the first thing the network touches coming into my room.

                      I have not setup any bridges or anything in pfsense. Straight out of the box install plus adding the monitoring packages.

                      I looked in the routes section and the second IP does not show up.

                      It does show up in bandwidthd as the second highest traffic amount right under the router itself. I attached a picture of its entry.

                      Capture.PNG
                      Capture.PNG_thumb

                      1 Reply Last reply Reply Quote 0
                      • J
                        johnpoz LAYER 8 Global Moderator
                        last edited by May 4, 2018, 10:41 AM

                        What is the IP - look to its mac in your arp table tell you what device it is.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        1 Reply Last reply Reply Quote 0
                        • M
                          mikecala
                          last edited by May 8, 2018, 7:54 AM

                          Well, I found my issue. The IPMI interface on my board binds itself to the first ethernet port so the ipmi interface was pulling the second IP and causing that extra traffic on my network…

                          1 Reply Last reply Reply Quote 0
                          • J
                            johnpoz LAYER 8 Global Moderator
                            last edited by May 8, 2018, 9:32 AM

                            how did you track that down?

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            1 Reply Last reply Reply Quote 0
                            • M
                              mikecala
                              last edited by May 8, 2018, 9:45 AM

                              So once I got the IP from my ISP I found it showing up in the ARP table with the MAC address matching with my board's manufacturer. I decided to just type in the IP, which admittedly should have been something I did before, and it popped up with my IPMI web console. I did some research and figured out that by default the IMPI bonds to the dedicated port as well as the first ethernet port so I went in and disabled it.

                              Definitely not something I thought about at all honestly.

                              1 Reply Last reply Reply Quote 0
                              • J
                                johnpoz LAYER 8 Global Moderator
                                last edited by May 8, 2018, 10:02 AM

                                Good catch… For sure - you sure wouldn't want your ipmi open to the public internet..

                                Such an option should really be disabled in the bios out of the box..

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                1 Reply Last reply Reply Quote 0
                                • M
                                  mikecala
                                  last edited by May 8, 2018, 10:03 AM

                                  You'd think but I guess since it's not really a board meant to be a router they just assume it's only going to be inside the network.

                                  simondngS 1 Reply Last reply Jun 5, 2018, 2:01 PM Reply Quote 0
                                  • simondngS
                                    simondng @mikecala
                                    last edited by Jun 5, 2018, 2:01 PM

                                    @mikecala Man, wish I'd seen this thread a few days ago. I've had exactly the same problem, new pfSense install - using 30GB+ extra a day more than normal. What board are you using?

                                    1 Reply Last reply Reply Quote 0
                                    • stephenw10S
                                      stephenw10 Netgate Administrator
                                      last edited by Jun 5, 2018, 2:14 PM

                                      Wow, that's concerning. What on IPMI there is using 30GB a day? Was it exposed with default credentials?

                                      Steve

                                      simondngS 1 Reply Last reply Jun 5, 2018, 2:40 PM Reply Quote 0
                                      • simondngS
                                        simondng @stephenw10
                                        last edited by Jun 5, 2018, 2:40 PM

                                        @stephenw10 I'm not sure if it was IPMI, or some other misconfiguration on my behalf.

                                        It's a APU.2C4 board.

                                        I've taken it offline for now, as it used up the 1TB allowance last month.

                                        1 Reply Last reply Reply Quote 0
                                        • G
                                          gzorn
                                          last edited by Jun 5, 2018, 7:03 PM

                                          It seems like many business branded comps (Dell, Lenovo, etc) have security issues on onboard ethernet (exposing either IPMI or AMT). On my router machine, I'm only using the onboard ethernet for a 'management lan' that gets no internet access at all. IPMI and switch management interfaces shouldn't need to access the internet anyway. WAN and LANs served by an intel 4-port card. I just don't trust those manufacturers to patch management bugs fast enough.

                                          For all those who ran into this data usage issue, I'd urge you to reset your IPMI or AMT interface to factory defaults before locking it down. It's an annoyingly nontrivial task in some cases. If it's got gigs of data usage, I'd be concerned that a bad actor somewhere has pwned your management interface.

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received