Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PFsense Blocking Some Traffic

    Scheduled Pinned Locked Moved General pfSense Questions
    33 Posts 5 Posters 3.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator
      last edited by johnpoz

      Well if you believe the problem is dns related.. look at your timing and any loss in unbound... Dump your stats

      unbound-control -c /var/unbound/unbound.conf stats_noreset

      What is your recursion time average, etc..
      What sort of % hit on cache are you getting, etc. etc.
      if your not getting a high amount of cache hits, you prob want to turn on prefetch and zero ttl. These can help with problems with long recursion times and or timeouts.

      total.recursion.time.avg=0.158804
      total.recursion.time.median=0.0505461

      total.num.queries=126887
      total.num.cachehits=110479

      So Im at about 87% cache hit rate...

      Look at the stats page in the gui.
      Status / DNS Resolver

      Are you seeing timeouts? You really should have all Zeros

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      N 1 Reply Last reply Reply Quote 0
      • T
        tim.mcmanus @noob
        last edited by

        @noob said in PFsense Blocking Some Traffic:

        @johnpoz the packet loss from another post was a red herring, pfsense was not monitoring my modem, it was monitoring virgin media's gateway which is way out of my control.
        i setup "think broadband" to monitor my public IP (and so monitoring my own gateway) and packet loss was 0.11% max
        i have disabled pfsense gateway monitor, as it was monitoring the wrong thing and giving irrelevant into, and was easier than getting pfsense to monitor the correct gateway

        I actually have pfSense monitoring a point on the Internet, not my modem. When I am experiencing issues, I want to test a point off of my ISP's network. Yes, on occasion it will trigger some false-positives, but generally speaking, I won't "feel" that issue on the network. When I am suspicious that my network is having issues, then I can check the monitor to see if/what the loss is.

        If you want to monitor the quality of your connection, try this smokeping tool: https://www.dslreports.com/smokeping

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by

          heheeh - yeah I think I know how to monitor my connection... But thanks ;)

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          T 1 Reply Last reply Reply Quote 0
          • T
            tim.mcmanus @johnpoz
            last edited by

            @johnpoz said in PFsense Blocking Some Traffic:

            heheeh - yeah I think I know how to monitor my connection... But thanks ;)

            Not you, the other guy. Although, I didn't want to assume... ;)

            1 Reply Last reply Reply Quote 0
            • N
              noob @johnpoz
              last edited by noob

              @johnpoz total.recursion.time.avg=0.125316
              total.recursion.time.median=0.0505173
              just booted up pfsense as it took it down again last night
              total.num.queries=55
              total.num.cachehits=4

              i have just turned prefetch on to see what difference it makes

              DNS Reseolver timeout A, timeout AAAA and timeout other are all zero's

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                Well stats right after it boots not going to point to any sort of problem.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                N 1 Reply Last reply Reply Quote 0
                • N
                  noob @johnpoz
                  last edited by johnpoz

                  @johnpoz how long would you like me to leave it before re-posting stats?
                  hours, days? i dont know how long ill need to collect data for before it becomes of any use for fault diagnosis

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by johnpoz

                    After you have been seeing a dns related problem.

                    Total number of queries 55.. There is nothing on your network doing anything at that point.. Notice mine was 126,000

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    N 1 Reply Last reply Reply Quote 0
                    • N
                      noob @johnpoz
                      last edited by

                      @johnpoz

                      im not sure this is even a DNS issue, i have no idea what is causing the issue, that smokeping test tool posted further up is currently reporting 0.00% packet loss accross all 3 servers that are pinging me.

                      the issue with ebay app landing [page not loading on wifes phone is constant (it never loads unless we switch to 3g/4g data or remove pfsense) all the other pages/search/buy functions work all the time.... ebay app loads on other devices every single time no issues.
                      the issue with the android tv box and virgin tv go allowing me to login, loading menu's and previews and up to date live tv guide but not playing actual programs is a constant while pfsense is running, but virgin tv go on all other devices works even with pfsense in place.

                      i cant see anything in the logs to suggest traffic is being blocked, makes no sense as to why i would be blocking only certain devices

                      total.num.queries=1047
                      total.num.queries_ip_ratelimited=0
                      total.num.cachehits=158
                      total.num.cachemiss=889
                      total.num.prefetch=14
                      total.num.zero_ttl=0
                      total.recursion.time.avg=0.138458
                      total.recursion.time.median=0.0890953

                      i would love to learn more about pfsense (which is why i got it to start with) but these issues dont seem to make any sense.

                      i did notice you had over 100k queries but i have no idea how long your box has been up and running, could be months

                      from the first few mins of booting pfsence up to now 2 hours uptime, the hit rate seems to be hovering steady at 14-16%

                      is there anything i should be looking at on the devices in question??

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        You might want to grab a packet capture onb the LAN filtered by the IP of the offending device.
                        Try to do as little as possible on the phone just to minimise the traffic. Once the menus have failed to load check the pcap.

                        Steve

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          Current uptime: 22 Days 03 Hours 48 Minutes 58 Seconds

                          That would of been since updated to p1, current stats show... But that is not always related to when unbound restarted..

                          1047 queries is not a lot of queries.. Do you have not have your stuff pointing to pfsense? Do you only have like 1 device on your network or something? How long has unbound been up to get your 1047 queries?

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • N
                            noob
                            last edited by

                            It was only me on my pc and phone last night.
                            The system uptime was 2 hours 12 mins when I saw the 1000 queries which is approx 500 per hour.
                            Your 126k decided by 22 days up time is approx 240 per hour.
                            I have no idea how long unbound was running, I was just going by system up time.

                            All traffic should be going through pfsense as all traffic to and from the modem is tagged via vlan
                            I've taken pfsense down again at the moment, will boot it up again tonight and leave it running for a few days (and do the Lan side packet sniffing sujested above)
                            How can I find inbounds "uptime" if it's different from system uptime?

                            GertjanG 1 Reply Last reply Reply Quote 0
                            • GertjanG
                              Gertjan @noob
                              last edited by

                              @noob said in PFsense Blocking Some Traffic:

                              How can I find inbounds "uptime" if it's different from system uptime?

                              Easy : check the DNS log ! Or ask the system : ps ax | grep 'unbound'
                              unbound is a service that is restarted rather often.

                              No "help me" PM's please. Use the forum, the community will thank you.
                              Edit : and where are the logs ??

                              1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator
                                last edited by johnpoz

                                time up will also be in the stats
                                time.up=81609.360209

                                Which would be in seconds.

                                And to be honest most everything on my network points to downstream pihole, so that reduces the number of queries unbound sees because pihole only asks unbound for stuff that has not been blocked, and also it caches.. So if say 3 things asked for xyz.com unbound would only see the 1 from pihole, then piehole would serve the answer up to the clients via its cache.

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.