Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    [solved] BUG: pfsense 2.4.4 update_breaks http/https from LAN - workaround

    Scheduled Pinned Locked Moved Problems Installing or Upgrading pfSense Software
    35 Posts 3 Posters 3.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S
      stephenw10 Netgate Administrator
      last edited by

      If you have 'Hardware Checksum Offloading' enabled that's exactly how it can appear in a packet capture for transmitted packets.

      https://www.wireshark.org/docs/wsug_html_chunked/ChAdvChecksums.html

      I would not normally expect that to be for just the DNS traffic but you should disable it anyway to be sure it's not just a quirk of the capture.

      Steve

      4 1 Reply Last reply Reply Quote 0
      • 4
        4o4rh @stephenw10
        last edited by

        @stephenw10 Thanks Steve, I stand corrected. That actually appears to have solved the problem.

        1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          The entire problem or just removed the errors from the packet capture?

          Usually those checksum errors are just false positives, annoying but ultimately harmless.

          Steve

          1 Reply Last reply Reply Quote 0
          • 4
            4o4rh
            last edited by 4o4rh

            removing the checksum, allowed browsing to return to normal.
            the only problem i am having now is linux and debian services upgrading via the vpn. Seems a name resolution problem, but most likely unrealted (although it id work in the previous version as well)

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              Mmm, interesting. I wonder if a driver update enabled that on your NICs on FreeBSD 11.2. Or indeed broke it.

              Steve

              1 Reply Last reply Reply Quote 0
              • 4
                4o4rh
                last edited by

                fyi my system has 4*Intel WG82583 10/100M/1000M Lan

                1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  Hmm, curious. There almost certainly were updates to igb in FreeBSD 11.2. I run that in almost everything though.

                  Are those part of an SoC? It looks like they are not. There's a lot of fake Intel chips about unfortunately. Speculation at this point. I'd just leave it disabled and move on.

                  Steve

                  1 Reply Last reply Reply Quote 0
                  • 4
                    4o4rh
                    last edited by 4o4rh

                    My box is a J1900 N10 with two LAN segments and one WAN.
                    Unfortunately, i still think there is an issue with the Gateway Pool Routing. As although disabling the h/w checksum enables browsing, i am having problems with POP/SMTP and the linuxmint being able to find package update servers. they all come up with 0kb/s speed. if i switch the gateway from the VPN to default it works. so back to the original problem - none of which existing in 2.4.3.

                    What i can say, i am using 2x ExpressVPN access points as a failover, and if i set the specific gateways to the individual access interface, it works ok. it is only a problem when selecting a pool, per my original problem description. so for me 2.4.4 definitely breaks a setup that was previously working under 2.4.2 and 2.4.3

                    1 Reply Last reply Reply Quote 0
                    • 4
                      4o4rh
                      last edited by

                      Steve, I still have issues with linuxmint and debian clients accessing the package updates via the vpn and google mail struggles. these all previously worked. One thing i notice under the Diag - Interfaces.
                      DNS servers all show below the WAN interface.
                      127.0.0.1
                      1.1.1.1
                      9.9.9.9
                      1.0.0.1
                      9.9.9.10
                      81.3.27.54
                      46.182.19.48
                      In actual fact, they are assigned via the general settings per
                      1.1.1.1, 9.9.9.9 = vpn1
                      1.0.0.1, 9.9.9.10 = vpn2
                      81.3.27.54, 46.182.19.48 = wan

                      stephenw10S 1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator @4o4rh
                        last edited by

                        I'm pretty sure that's just a display artifact. Check the routing table. DNS servers set to a specific WAN should show a static route via that gateway.

                        Steve

                        1 Reply Last reply Reply Quote 0
                        • 4
                          4o4rh
                          last edited by

                          Steve, i got to the bottom of the problem i am having. Sorted and confirmed DNS redirecting to the box, and then out over 853. Confirmed with android devices that ignore dhcp and try and connect to google.

                          I have a IP4/6 blocking rule for everything on all interfaces and only allow selected ports within the LAN and separately selected ports via the WAN

                          I have 2 ExpressVPNs as Tier 1 and 2. Routing correctly shows 1x Quad9 + 1xCloudfare DNS per connection.

                          When both connections are up browsing is working but things like android updates, linux updates, etc don't work. This is true, whether i use the pool gateway or the individual gateways.

                          When i force one of the VPNs down, then everything is working.
                          So, it seems i miss something..from a route blocking / etc? Do you have some idea?

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            Hmm, if the VPNs are in a gateway group just one of them going down would not normally do anything.

                            The fact that changes anything implies perhaps you are allowing the VPN connection to add new routes to the system still, or a new default route even.

                            Or potentially you have rules that not applied when the gateway is down. Check in System > Advanced > Misc. Do you have 'Skip rules when gateway is down' enabled?

                            Steve

                            1 Reply Last reply Reply Quote 0
                            • 4
                              4o4rh
                              last edited by 4o4rh

                              I had it checked, and now unchecked. Doesn't make any difference. As soon as i enable the 2nd VPN the android clients are unable to update (as practical example). In the gateway group VPN1 = Tier 1 and VPN2 = Tier 2 based on member down. So in theory, VPN2 shouldn't even be touched, but seems like some kind of routing problem. although strange browsing still works

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                Hmm. Probably need to dig into the ruleset and states here to see what rules are passing the traffic and where.

                                1 Reply Last reply Reply Quote 0
                                • 4
                                  4o4rh
                                  last edited by

                                  something much more fundamental Steve.

                                  I turned all rules off. and only open DNS and HTTP/HTTPS from LAN to Gateway Pool.

                                  With 2x OpenVPN Client active; i can browse the net, but android updates time out.
                                  Shutdown one of the OpenVPN clients, and android updates takes off.

                                  GrimsonG 1 Reply Last reply Reply Quote 0
                                  • GrimsonG
                                    Grimson Banned @4o4rh
                                    last edited by

                                    @gwaitsi said in [solved] BUG: pfsense 2.4.4 update_breaks http/https from LAN - workaround:

                                    With 2x OpenVPN Client active; i can browse the net, but android updates time out.
                                    Shutdown one of the OpenVPN clients, and android updates takes off.

                                    Well maybe the android update servers block that VPN provider/IP.

                                    4 1 Reply Last reply Reply Quote 0
                                    • 4
                                      4o4rh @Grimson
                                      last edited by

                                      @grimson Nope. Both VPN1 and 2 are ExpressVPN access points in different countries. If either one is disabled, it works. it is only when both are enable at the same time that it doesn't work. Android was just quick/easy example. Linux Mint updates break. only the standard standards servers are found at a much lower bandwidth, no local servers. When only 1 VPN enabled, linux standard servers increase bandwidth dramatically and the local servers can be found.

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        Appears like it's load-balancing between those gateways but they should be failover right?

                                        Check how they show in /tmp/rules.debug.

                                        Steve

                                        4 1 Reply Last reply Reply Quote 0
                                        • 4
                                          4o4rh
                                          last edited by 4o4rh

                                          yep, trigger level is member down.
                                          note sure what i am looking for m8, but here is what i see

                                          Gateways

                                          GWRED_DHCP = " route-to ( em0 192.168.0.1 ) "
                                          GWLUXVPN_VPNV4 = " route-to ( ovpnc1 10.149.0.73 ) "
                                          GWVPNNLD_VPNV4 = " route-to ( ovpnc3 10.156.0.129 ) "
                                          GWExpressVPN = " route-to { ( ovpnc1 10.149.0.73 ) } "

                                          Load balancing anchor

                                          rdr-anchor "relayd/*"

                                          UPnPd rdr anchor

                                          rdr-anchor "miniupnpd"

                                          anchor "relayd/"
                                          anchor "openvpn/                                          "
                                          anchor "ipsec/*"

                                          VPN Rules

                                          anchor "tftp-proxy/*"

                                          1 Reply Last reply Reply Quote 0
                                          • 4
                                            4o4rh @stephenw10
                                            last edited by

                                            @stephenw10 I am guessing the issue relates to the pushing of the DNS?

                                            Options error: option 'route' cannot be used in this context ([PUSH-OPTIONS])
                                            Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS])
                                            Options error: option 'redirect-gateway' cannot be used in this context ([PUSH-OPTIONS])
                                            PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 10.154.0.1,comp-lzo no,route 10.154.0.1,topology net30,ping 10,ping-restart 60,ifconfig 10.154.1.18 10.154.1.17,peer-id 23'

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.