Logon / Performance oddity

[nehumanuscrede]

Unbound is currently disabled.

[johnpoz]

So you have pfsense pointing nowhere for dns?

[nehumanuscrede]

Correct.

There are no DNS servers configured within the appliance.

The only services actually running are:

ntpd
openvpn
syslogd

Also noteworthy, modifying the configuration in any way and saving it takes quite some time* as well with the unit blocked from talking outside the local network.

*~60 seconds

[nehumanuscrede]

My workaround fix:

The edge router who is playing firewall duty is now allowing the pfSense appliance to send out DNS requests. It is also allowing outbound UDP traffic where the source port is the OpenVPN server.

Everything else is denied so while the DNS query gets resolved, the appliance can't do much with it beyond that since all other traffic is blocked.

---

Login and page transition are now working at a normal pace, though I don't know why a DNS query would have any impact on the speed at which the web gui login / page transitions happen.

While this means the unit won't be able to check for updates, I'm actually ok with that as I've had to reload from scratch ( via USB stick ) the entire appliance multiple times after the usual update process left me with a non-bootable unit. :|

[johnpoz]

To be honest if you turned off the update.. it shouldn't be doing any dns queries.. and since you said you don't have any dns enabled nor pfsense pointing any dns.. What/How could it be do queries... If I find some time I will do some playing around with this this weekend... I have a 2440 on my bench I can take home put on the network and just block it from talking outbound like your doing..

I would be curious what dns queries its doing exactly.

[nehumanuscrede]

As a test, I wiped out my blocking statements for the pfSense ( allowing full access to the world ) on the edge router and simply removed the DNS entry from the pfSense appliance ( the /etc/resolv.conf file confirms no DNS servers are configured ).

With an empty ( or an invalid ) DNS address in the pfSense appliance, the web / gui login takes approximately 90 seconds after supplying your login credentials before it will transition to the Dashboard page. Once there, if you try to go to the System -> Update page, it will take another 90 seconds before you actually get there and another 90 if you try to get to the System -> Update -> Update Settings page.

( This page is where I disabled / verify the Dashboard auto-update check is disabled )

It should be noted that this has no impact on a SSH login. Only the web / gui is impacted.

Once I supply a valid DNS address, the login and page transitions run as expected.

Basically, it pitches a fit if it doesn't have a valid DNS address to use and / or if it isn't allowed to actually talk to it :D

[SteveITS]

In general if DNS isn't working then requests will have to time out, I've found. Why it does that if there is no DNS I don't know.

You can disable the update check on the dashboard (so it doesn't check) in system/update/update settings. Then you can add a DNS server and do the check manually.

[nehumanuscrede]

@teamits

The interesting part is even after the auto-update check is disabled, the appliance still attempts to update and / or talk to an external network device on its own.
( the ip resolves to pfSense so it's most likely an update or telemetry check )

I think disabling it via the GUI only prevents the check from the GUI dashboard, it doesn't appear to disable the check completely.

Example:

Dec 2 09:06:18 CST:
tcp 192.168.20.10(32392) -> 162.208.119.40(443), 17 packets

[Gertjan]

@nehumanuscrede said in Logon / Performance oddity:

tcp 192.168.20.10(32392) -> 162.208.119.40(443), 17 packets

That's a request to a https port on some remote server (without any reverse ? strange). I bet : not originating from pfSense itself

[johnpoz]

While there is no reverse that is pfsense IP.. It ends up being files.pfsense.org

But trying to hit an IP is different than a dns query.. And that shouldn't really cause a waiting for dns delay.

[Gertjan]

@johnpoz said in Logon / Performance oddity:

While there is no reverse that is pfsense IP.. It ends up being files.pfsense.org

Yes !

[2.4.4-RELEASE][admin@pfsense.brit-hotel-fumel.net]/root: host files.pfsense.org
files.pfsense.org has address 162.208.119.40
files.pfsense.org has address 162.208.119.41
files.pfsense.org has IPv6 address 2610:1c1:0:6::40
files.pfsense.org has IPv6 address 2610:1c1:0:6::41

Thanks

[SteveITS]

@nehumanuscrede said in Logon / Performance oddity:

even after the auto-update check is disabled, the appliance still attempts to update and / or talk to an external network device

I don't recall the location offhand but there is an option somewhere to "do not send the device ID to Netgate" or something like that.