Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    circuit bouncing and DNS

    Scheduled Pinned Locked Moved General pfSense Questions
    24 Posts 4 Posters 2.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      ryno5514
      last edited by

      I am aware that in the end all traffic is IP traffic, I statement is simply to point out there is something wrong with the Firewalls ability to do DNS.

      I have an CPU Type: Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz
      Current: 3200 MHz, Max: 3201 MHz
      4 CPUs: 1 package(s) x 4 core(s)
      AES-NI CPU Crypto: Yes (active)
      With 8GB of Ram

      I dont think its a resource issue, like I said it only happens after the Comcast circuit bounces. The WAN interface will get large packet loss, go down come back up and some select trafffic will route but not any other traffic until I hard reboot.

      I have made no changes to the units config the only change is comcast is not having capacity issues in the area now.

      I statement of " and it looks like the DNS is request hit the firewall" is simply to state the device seems to not know how to handle DNS requests.

      If check that box and the host I changes on an aliases will that impact that route?

      GertjanG 1 Reply Last reply Reply Quote 0
      • GertjanG
        Gertjan @ryno5514
        last edited by

        @ryno5514 said in circuit bouncing and DNS:

        The WAN interface will get large packet loss, go down come back u

        The WAN actually goes down ?

        When the dpinger test scores to many ping failure - a bad connection -, it could take down the interface .... check your the settings.
        Which resets the interface,
        Which restart the resolver ...
        Which explains DNS isseus - added to the connection issues.

        45b94d6c-6187-4224-b48c-6934f724b1f3-image.png

        No "help me" PM's please. Use the forum, the community will thank you.
        Edit : and where are the logs ??

        1 Reply Last reply Reply Quote 0
        • R
          ryno5514
          last edited by

          Yes the interface will go down, it also sometimes bounces the modem so hard it gives me a NAT IP over a bridged IP sometimes.

          Are you saying I should have those unchecked? I do have them as follows

          1cdff44d-8341-4fd4-80a0-ac6f4c9ac9f9-image.png

          The WAN does come back up and my SIP phone, Roku comcast app, and I can ping 151.101.129.67 but not Ping cnn.com [151.101.129.67]

          1 Reply Last reply Reply Quote 0
          • R
            ryno5514 @Gertjan
            last edited by

            Keep in mind :
            595871fa-9626-49ef-a4ee-48a0ff70f95a-image.png

            I am not 100% sure but this might have fixed it, waiting for a bounce again. Will this cause issues with IPs changing on the an aliases updates?

            R GertjanG 2 Replies Last reply Reply Quote 0
            • R
              ryno5514 @ryno5514
              last edited by

              @ryno5514 said in circuit bouncing and DNS:

              Keep in mind :
              595871fa-9626-49ef-a4ee-48a0ff70f95a-image.png

              I am not 100% sure but this might have fixed it, waiting for a bounce again. Will this cause issues with IPs changing on the an aliases updates?

              Nope still not working

              1 Reply Last reply Reply Quote 0
              • GertjanG
                Gertjan @ryno5514
                last edited by

                @ryno5514 said in circuit bouncing and DNS:

                Keep in mind :
                595871fa-9626-49ef-a4ee-48a0ff70f95a-image.png

                I am not 100% sure but this might have fixed it, waiting for a bounce again. Will this cause issues with IPs changing on the an aliases updates?

                The "DHCP registration" unchecked results in unbound being restarted less often.

                In the system logs you can see for yourself if dpinger restarts the WAN connection/interface. Normally, this is a good thing, but it can also make things worse, and transforms pfSense entirely in some sort of network on/off switch.
                Whats happing, I guess, is : upstream you have a lot of traffic congestion. The regular dpinger ping starts to notice this (can be seen in the logs) and it restarts the WAN, which will restart other services like unbound.

                No "help me" PM's please. Use the forum, the community will thank you.
                Edit : and where are the logs ??

                R 1 Reply Last reply Reply Quote 0
                • R
                  ryno5514 @Gertjan
                  last edited by

                  @Gertjan Thats correct the link at the areas local hub is "well over 80%" this is my home internet and this issue is causing so many issues I am running off a cradle point most of the day. That being said my company is putting in business class circuit so we can escalate the capacity issue.

                  In the mean time I really hate having to reboot my firewall 10+ times a day. Is there anything you can think of that can kick start the DNS "unbound" into working again without reboot?

                  Really trying to avoid moving all my traffic over to my lab Velocould and FE60.

                  1 Reply Last reply Reply Quote 0
                  • GertjanG
                    Gertjan
                    last edited by

                    To be sure, check this option :

                    b9aaa8df-b7dd-480e-8b01-fe8c259ce0e0-image.png

                    if the WAN still goes bad, your issue is most probably upstream.

                    No "help me" PM's please. Use the forum, the community will thank you.
                    Edit : and where are the logs ??

                    R 1 Reply Last reply Reply Quote 0
                    • R
                      ryno5514 @Gertjan
                      last edited by

                      @Gertjan said in circuit bouncing and DNS:

                      To be sure, check this option :

                      b9aaa8df-b7dd-480e-8b01-fe8c259ce0e0-image.png

                      if the WAN still goes bad, your issue is most probably upstream.

                      Turning that off also.

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        Are you policy routing traffic from clients out of the WAN gateway? You mentioned you're using aliases to route traffic.

                        If the default route from the firewall in System > Routing > Gateways is set to auto still it may be choosing a bad gateway when the WAN goes down. Make sure it's set to WANGW or a valid failover group etc.

                        In that situation Unbound will not be able to resolve as won't have a route but clients that are hitting policy routing rules will still be able to connect by IP.

                        Steve

                        R 1 Reply Last reply Reply Quote 0
                        • R
                          ryno5514 @stephenw10
                          last edited by

                          @stephenw10

                          The edits @Gertjan had be make seems to helped a good amount. I am only having this issue when the Comcast link goes down for more than a few minutes. I updated the "Disable Gateway Monitoring Action" this morning so waiting on a bounce to happen.

                          Yesterday I only needed to hard reboot 2 times so this is much better.

                          b8de5f71-ff6f-4d97-9f24-da3a57bc38d5-image.png

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            You should, obviously, not need to reboot at all.

                            Was the default gateway already set to WAN_DHCP?

                            Steve

                            R 1 Reply Last reply Reply Quote 0
                            • R
                              ryno5514 @stephenw10
                              last edited by

                              @stephenw10 Yes it was.

                              So after the edit to "Disable Gateway Monitoring Action" and the static DHCP it seems that all is much better now. I bounced 7 times yesterday and recovered each time all services.

                              I only worry about static DHCP is that going to mess any of my lookups up? or is that only for the LAN side?

                              GertjanG 1 Reply Last reply Reply Quote 0
                              • GertjanG
                                Gertjan @ryno5514
                                last edited by

                                @ryno5514 said in circuit bouncing and DNS:

                                I only worry about static DHCP is that going to mess any of my lookups up?

                                All the "Static DHCP" lease details are written to the system hosts file, so they are known 'for live'.
                                Lookups for a device will work, even if the device isn't present in the network, and the last recent lease expired.

                                @ryno5514 said in circuit bouncing and DNS:

                                s that only for the LAN side?

                                "Static DHCP" are leases that the DHCP server hands out to devices on LAN's.
                                Has nothing to do with the WAN side, where a DHCP-client might be setup, so it can ask an IP/Gateway/DNS/etc from the upstream DHCP server, probably your ISP router .... which has a ... DHCP server on board.

                                No "help me" PM's please. Use the forum, the community will thank you.
                                Edit : and where are the logs ??

                                R 1 Reply Last reply Reply Quote 1
                                • R
                                  ryno5514 @Gertjan
                                  last edited by

                                  @Gertjan Fantastic sir. Looks a lot better, I have my second circuit being installed tomorrow and might put a Velo for a 3rd WAN link to be safe.

                                  1 Reply Last reply Reply Quote 0
                                  • R
                                    Redy321 Banned @ryno5514
                                    last edited by

                                    This post is deleted!
                                    1 Reply Last reply Reply Quote 0
                                    • First post
                                      Last post
                                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.