Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Logon / Performance oddity

    Scheduled Pinned Locked Moved General pfSense Questions
    14 Posts 4 Posters 1.5k Views 4 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ Offline
      johnpoz LAYER 8 Global Moderator
      last edited by

      If your not going to let the box do dns, do you have unbound running?

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 25.07 | Lab VMs 2.8, 25.07

      1 Reply Last reply Reply Quote 0
      • N Offline
        nehumanuscrede
        last edited by

        Unbound is currently disabled.

        1 Reply Last reply Reply Quote 0
        • johnpozJ Offline
          johnpoz LAYER 8 Global Moderator
          last edited by

          So you have pfsense pointing nowhere for dns?

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 25.07 | Lab VMs 2.8, 25.07

          1 Reply Last reply Reply Quote 0
          • N Offline
            nehumanuscrede
            last edited by nehumanuscrede

            Correct.

            There are no DNS servers configured within the appliance.

            The only services actually running are:

            ntpd
            openvpn
            syslogd

            Also noteworthy, modifying the configuration in any way and saving it takes quite some time* as well with the unit blocked from talking outside the local network.

            *~60 seconds

            N 1 Reply Last reply Reply Quote 0
            • N Offline
              nehumanuscrede @nehumanuscrede
              last edited by

              My workaround fix:

              The edge router who is playing firewall duty is now allowing the pfSense appliance to send out DNS requests. It is also allowing outbound UDP traffic where the source port is the OpenVPN server.

              Everything else is denied so while the DNS query gets resolved, the appliance can't do much with it beyond that since all other traffic is blocked.


              Login and page transition are now working at a normal pace, though I don't know why a DNS query would have any impact on the speed at which the web gui login / page transitions happen.

              While this means the unit won't be able to check for updates, I'm actually ok with that as I've had to reload from scratch ( via USB stick ) the entire appliance multiple times after the usual update process left me with a non-bootable unit. :|

              1 Reply Last reply Reply Quote 0
              • johnpozJ Offline
                johnpoz LAYER 8 Global Moderator
                last edited by

                To be honest if you turned off the update.. it shouldn't be doing any dns queries.. and since you said you don't have any dns enabled nor pfsense pointing any dns.. What/How could it be do queries... If I find some time I will do some playing around with this this weekend... I have a 2440 on my bench I can take home put on the network and just block it from talking outbound like your doing..

                I would be curious what dns queries its doing exactly.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 25.07 | Lab VMs 2.8, 25.07

                1 Reply Last reply Reply Quote 0
                • N Offline
                  nehumanuscrede
                  last edited by

                  As a test, I wiped out my blocking statements for the pfSense ( allowing full access to the world ) on the edge router and simply removed the DNS entry from the pfSense appliance ( the /etc/resolv.conf file confirms no DNS servers are configured ).

                  With an empty ( or an invalid ) DNS address in the pfSense appliance, the web / gui login takes approximately 90 seconds after supplying your login credentials before it will transition to the Dashboard page. Once there, if you try to go to the System -> Update page, it will take another 90 seconds before you actually get there and another 90 if you try to get to the System -> Update -> Update Settings page.

                  ( This page is where I disabled / verify the Dashboard auto-update check is disabled )

                  It should be noted that this has no impact on a SSH login. Only the web / gui is impacted.

                  Once I supply a valid DNS address, the login and page transitions run as expected.

                  Basically, it pitches a fit if it doesn't have a valid DNS address to use and / or if it isn't allowed to actually talk to it :D

                  1 Reply Last reply Reply Quote 0
                  • S Offline
                    SteveITS Rebel Alliance
                    last edited by

                    In general if DNS isn't working then requests will have to time out, I've found. Why it does that if there is no DNS I don't know.

                    You can disable the update check on the dashboard (so it doesn't check) in system/update/update settings. Then you can add a DNS server and do the check manually.

                    Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                    When upgrading, allow 10-15 minutes to reboot, or more depending on packages, and device or disk speed.
                    Upvote ๐Ÿ‘ helpful posts!

                    N 1 Reply Last reply Reply Quote 0
                    • N Offline
                      nehumanuscrede @SteveITS
                      last edited by

                      @teamits

                      The interesting part is even after the auto-update check is disabled, the appliance still attempts to update and / or talk to an external network device on its own.
                      ( the ip resolves to pfSense so it's most likely an update or telemetry check )

                      I think disabling it via the GUI only prevents the check from the GUI dashboard, it doesn't appear to disable the check completely.

                      Example:

                      Dec 2 09:06:18 CST:
                      tcp 192.168.20.10(32392) -> 162.208.119.40(443), 17 packets

                      GertjanG S 2 Replies Last reply Reply Quote 0
                      • GertjanG Offline
                        Gertjan @nehumanuscrede
                        last edited by

                        @nehumanuscrede said in Logon / Performance oddity:

                        tcp 192.168.20.10(32392) -> 162.208.119.40(443), 17 packets

                        That's a request to a https port on some remote server (without any reverse ? strange). I bet : not originating from pfSense itself

                        No "help me" PM's please. Use the forum, the community will thank you.
                        Edit : and where are the logs ??

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ Offline
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          While there is no reverse that is pfsense IP.. It ends up being files.pfsense.org

                          But trying to hit an IP is different than a dns query.. And that shouldn't really cause a waiting for dns delay.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 25.07 | Lab VMs 2.8, 25.07

                          GertjanG 1 Reply Last reply Reply Quote 0
                          • GertjanG Offline
                            Gertjan @johnpoz
                            last edited by

                            @johnpoz said in Logon / Performance oddity:

                            While there is no reverse that is pfsense IP.. It ends up being files.pfsense.org

                            Yes !

                            [2.4.4-RELEASE][admin@pfsense.brit-hotel-fumel.net]/root: host files.pfsense.org
                            files.pfsense.org has address 162.208.119.40
                            files.pfsense.org has address 162.208.119.41
                            files.pfsense.org has IPv6 address 2610:1c1:0:6::40
                            files.pfsense.org has IPv6 address 2610:1c1:0:6::41
                            

                            Thanks

                            No "help me" PM's please. Use the forum, the community will thank you.
                            Edit : and where are the logs ??

                            1 Reply Last reply Reply Quote 0
                            • S Offline
                              SteveITS Rebel Alliance @nehumanuscrede
                              last edited by

                              @nehumanuscrede said in Logon / Performance oddity:

                              even after the auto-update check is disabled, the appliance still attempts to update and / or talk to an external network device

                              I don't recall the location offhand but there is an option somewhere to "do not send the device ID to Netgate" or something like that.

                              Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                              When upgrading, allow 10-15 minutes to reboot, or more depending on packages, and device or disk speed.
                              Upvote ๐Ÿ‘ helpful posts!

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.