Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Wired APs drop internet access but not LAN, help

    Scheduled Pinned Locked Moved General pfSense Questions
    33 Posts 4 Posters 3.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • L
      Live4soccer7
      last edited by

      Thanks for the troubleshooting step. I will have to wait for the APs to go down again before I can try that. I will post up as soon as they do. Sometimes it does it once a week and sometimes it does it a couple times a day. I would say on average it is once or twice a week.

      1 Reply Last reply Reply Quote 0
      • L
        Live4soccer7
        last edited by

        It is something associated with openVPN. I was able to simply restart just this service after looking at some logs and deducing that perhaps that could be it.

        I was able to ping EVERYTHING on the network. Once I tried to ping anything outside the network then it failed with 100% packet loss.

        Jul 9 00:15:02 openvpn NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
        Jul 9 00:15:48 openvpn RESOLVE: Cannot resolve host address: nl.privateinternetaccess.com:1198 (hostname nor servname provided, or not known)
        Jul 9 00:16:35 openvpn RESOLVE: Cannot resolve host address: nl.privateinternetaccess.com:1198 (hostname nor servname provided, or not known)
        Jul 9 00:16:35 openvpn Could not determine IPv4/IPv6 protocol
        Jul 9 00:16:35 openvpn SIGUSR1[soft,init_instance] received, process restarting

        OpenVPN was no longer connected to the VPN service at this point. the moment it restarted it regained connection and everything began working again.

        1 Reply Last reply Reply Quote 0
        • JKnottJ
          JKnott
          last edited by

          That doesn't make sense. An OpenVPN problem should have affected everything, not just WiFi stuff.

          PfSense running on Qotom mini PC
          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
          UniFi AC-Lite access point

          I haven't lost my mind. It's around here...somewhere...

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            Are the wifi access points connected to the same interface, same subnet, as wired devices that are not disconnected?

            Steve

            1 Reply Last reply Reply Quote 0
            • L
              Live4soccer7
              last edited by

              Yes, everything is connected to the same device and the same interface.

              By default, everything goes through open vpn, however the firewall rules I have specific IPs that I can allow to pass by the VPN and be routed without VPN.

              It does not matter if the wifi device has been granted the ability to not go through openVPN or not, it will not have internet access.

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by johnpoz

                @Live4soccer7 said in Wired APs drop internet access but not LAN, help:

                Yes, everything is connected to the same device and the same interface.

                Please draw how you have this connected... And lets be 100% sure that these devices are actually AP.. Since what you say makes zero sense...

                What are the IPs in play here? Pfsense doesn't know if a client is wired or wireless... So if your policy routing device with IP 1.2.3.4 out your vpn, and your vpn goes down then sure that makes sense. So all of your wireless devices get IP in range that you policy route out? Lets see your actual rules..

                And if I change rule for IP 1.2.3.4 to not policy route, then it would not policy route it.. You will want to make sure you kill any old states for that IP.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • L
                  Live4soccer7
                  last edited by

                  I've been baffled myself as it has never made much sense to me either in the way that it happens.

                  I have changed some openVPN settings/configurations. I am not seeing any errors or weird things in the logs, so I think I'll be watching to see if it goes down again.

                  It is possible that it was only traffic going through the VPN that was effected. I swore I checked a device that wasn't routed through the VPN and it didn't work, but I'm starting to think I must be wrong on that.

                  1 Reply Last reply Reply Quote 0
                  • L
                    Live4soccer7
                    last edited by

                    Reading this guide on PIA and OpenVPN: https://www.ovpn.com/en/guides/pfsense

                    I'm not quite sure what these are or if they are necessary to change as suggested. I have not seen them mentioned in any other guide.

                    Deselect, so that Allow DNS server list to be overridden by DHCP/PPP on WAN is not checked

                    Select, so that Do not use the DNS Forwarder or Resolver as a DNS server for the firewall is checked

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by johnpoz

                      You would not ant dns from your isp - this is a given, and really should always be checked.. Since its pointless when you resolve which is pfsense default.

                      If you uncheck to let pfsense to use itself for dns - then it would have to be able to use something else for dns.. And it wouldn't be able to resolve any of your local stuff if not asking itself for dns. ie resolver or forwarder - 127.0.0.1

                      Neither of those two optioins have anything to do with your issue!!

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • L
                        Live4soccer7
                        last edited by Live4soccer7

                        @Live4soccer7 said in Wired APs drop internet access but not LAN, help:

                        Deselect, so that Allow DNS server list to be overridden by DHCP/PPP on WAN is not checked
                        Select, so that Do not use the DNS Forwarder or Resolver as a DNS server for the firewall is checked

                        Thanks!

                        If I'm reading your statement correct, then the following would be the correct selection for those two options:

                        Check This Box: Allow DNS server list to be overridden by DHCP/PPP on WAN

                        Do NOT Check this Box: Do not use the DNS Forwarder or Resolver as a DNS server for the firewall

                        Edit, I believe the issue was a cert/security algorithm issue with PIA. For whatever reason it wasn't negotiating the correct algorithm, but was still compensating for it on the PIA side. I was seeing an error associated with this. I had to change the cert, port, algo etc... Since doing that, I haven't seen any errors.

                        Jul 9 00:50:56 openvpn WARNING: 'cipher' is used inconsistently, local='cipher AES-128-CBC', remote='cipher BF-CBC'

                        I currently have a ticket open with them to hopefully get the correct algos working properly. As of now, I have not seen near as much in the logs.

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          Your not reading it right - why would you want dhcp to override your dns - that should always be unchecked to be honest.. And by default should be unchecked.

                          Both boxes should be UNchecked..

                          checkbox.png

                          In pretty much any configuration. Its going to be very odd setup to check those..

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • L
                            Live4soccer7
                            last edited by

                            Thanks! So far the connection is still good and hasn't dropped. I would say if it stays up a few weeks then the issue is resolved.

                            1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              Hmm. No idea how that could affect things coming over wifi only....

                              1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator
                                last edited by

                                it couldn't!!

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                1 Reply Last reply Reply Quote 0
                                • L
                                  Live4soccer7
                                  last edited by

                                  The last setting discussed is just an afterthought on something I saw online. It wasn't really too relevant to the issue or setup.

                                  Here's a question. By DEFAULT all traffic is routed through VPN with openVPN on pfsense. I have setup manual rules to route traffic around the VPN. Is there any way that the address of the AP (not set to be routed around VPN, nor am I even sure that would work that way) could be getting misinterpreted when it goes down and making all traffic from the AP go through the VPN, hence making it appear that everything wireless is not able to connect to the internet.

                                  One thing I did not try was connecting a device via ethernet to the back of the AP when wifi devices can't connect.

                                  JKnottJ 1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by johnpoz

                                    @Live4soccer7 said in Wired APs drop internet access but not LAN, help:

                                    By DEFAULT all traffic is routed through VPN with openVPN on pfsense.

                                    No not by "default" if you do not pull routes, or your vpn server doesn't hand that out then no it all traffic is not sent out the vpn.

                                    Most vpn services do want all your traffic though - how else would they make any money if info was given to them that they could monetize ;)

                                    Not sure what you think the AP IP has to do with anything? The only reason an "access point" has an IP is for management of that AP... It has zero to do with clients connecting to that AP.. Unless your natting and NOT actually using it as an AP..

                                    Your policy routing if using the AP IP it would only route the AP traffic, maybe it checking for an update?? Have no idea why an AP would need to talk to anything other than the IP of its controller.. It has zero reason to talk to the internet - unless maybe you told it to pull an update or something.. Or it checks on its own for update? Or maybe sync time with ntp?

                                    I think your AP are more than like natting your traffic and not actually AP.

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    1 Reply Last reply Reply Quote 0
                                    • JKnottJ
                                      JKnott @Live4soccer7
                                      last edited by

                                      @Live4soccer7 said in Wired APs drop internet access but not LAN, help:

                                      Is there any way that the address of the AP (not set to be routed around VPN, nor am I even sure that would work that way) could be getting misinterpreted when it goes down and making all traffic from the AP go through the VPN, hence making it appear that everything wireless is not able to connect to the internet.

                                      Not a chance. The router address is only used to access the management interface. In AP mode, it's 100% irrelevant. A device attached via WiFi AP appears exactly as though it were wired to the network. There is absolutely no difference.

                                      PfSense running on Qotom mini PC
                                      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                      UniFi AC-Lite access point

                                      I haven't lost my mind. It's around here...somewhere...

                                      1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by

                                        @JKnott said in Wired APs drop internet access but not LAN, help:

                                        There is absolutely no difference.

                                        Not sure I would say that ;) Its going to be slower and have more latency then its wired buddies ;) heheh

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        L 1 Reply Last reply Reply Quote 0
                                        • L
                                          Live4soccer7
                                          last edited by

                                          Thanks. It was just a though of possibility. I'll post up if it drops again and with some more relevant troubleshooting info/logs.

                                          1 Reply Last reply Reply Quote 0
                                          • L
                                            Live4soccer7 @johnpoz
                                            last edited by

                                            @johnpoz said in Wired APs drop internet access but not LAN, help:

                                            @JKnott said in Wired APs drop internet access but not LAN, help:

                                            There is absolutely no difference.

                                            Not sure I would say that ;) Its going to be slower and have more latency then its wired buddies ;) heheh

                                            haha, that's the truth. I wired the house last year for that reason.

                                            JKnottJ 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.