Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Fetching package: connection reset by peer

    Scheduled Pinned Locked Moved pfSense Packages
    89 Posts 4 Posters 17.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DaddyGoD
      DaddyGo @float
      last edited by DaddyGo

      @float said in Fetching package: connection reset by peer:

      All my IPv4 DNS-servers are not responding.

      because the Suricata
      home NET / external NET

      c82db21e-04fc-4962-aead-be14ae718dd3-image.png

      or pfBlockerNG blocks lists CloudFlare DNS IPs in a stupid way

      617c9333-f60a-4820-a55e-de25cebe5836-image.png

      Cats bury it so they can't see it!
      (You know what I mean if you have a cat)

      1 Reply Last reply Reply Quote 0
      • F
        float
        last edited by

        The problem occurred before installing pfblocker.

        e03df456-6435-4195-9396-87b43707a54b-image.png

        Installed packages:

        575556de-9ae0-43b9-a6f1-5b8abbf79919-image.png

        DaddyGoD 1 Reply Last reply Reply Quote 0
        • DaddyGoD
          DaddyGo @float
          last edited by

          @float said in Fetching package: connection reset by peer:

          The problem occurred before installing pfblocker.

          Temporarily stop all packages and PING out the box to 1.1.1.1

          Cats bury it so they can't see it!
          (You know what I mean if you have a cat)

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            Are you even using those? Unbound running in forwarding mode?

            1 Reply Last reply Reply Quote 0
            • F
              float
              last edited by float

              Yes in forward mode - I have no issues on the network clients - everything is resolved by pfsense

              3635f75a-bd12-4bc5-b57e-fb0772d6e834-image.png

              DaddyGoD 1 Reply Last reply Reply Quote 0
              • DaddyGoD
                DaddyGo @float
                last edited by DaddyGo

                @float

                Here the cat was buried...😉

                79d4227b-cfad-473f-adaf-74389a9df010-image.png

                because.... DoT!!!!

                da4e2003-21da-48e2-82a5-4186080438fa-image.png

                your shared image above....

                6e06cf28-17b3-44d5-9884-9442fd201021-image.png

                Cats bury it so they can't see it!
                (You know what I mean if you have a cat)

                DaddyGoD 1 Reply Last reply Reply Quote 0
                • F
                  float
                  last edited by float

                  Yes, I changed them 5 minutes ago to test and take a screenshot
                  Do you mean that the no response is normal in "dns lookup" because they have to use port 853 and not the standard port 53?

                  DaddyGoD 1 Reply Last reply Reply Quote 0
                  • DaddyGoD
                    DaddyGo @DaddyGo
                    last edited by

                    @DaddyGo

                    TRY:
                    DNS hostname - cloudflare-dns.com

                    Cats bury it so they can't see it!
                    (You know what I mean if you have a cat)

                    1 Reply Last reply Reply Quote 0
                    • DaddyGoD
                      DaddyGo @float
                      last edited by

                      @float said in Fetching package: connection reset by peer:

                      because they have to use port 853 and not the standard port 53?

                      BINGO

                      90d18f64-ae5b-4842-9d5f-32aca309297c-image.png

                      Cats bury it so they can't see it!
                      (You know what I mean if you have a cat)

                      1 Reply Last reply Reply Quote 0
                      • F
                        float
                        last edited by

                        Ok, thanks. So I don't have to worry about the "dns lookup" saying no response?

                        c353d42f-7c32-4eb4-823c-7d3b9d0826a0-image.png

                        DaddyGoD 1 Reply Last reply Reply Quote 0
                        • DaddyGoD
                          DaddyGo @float
                          last edited by DaddyGo

                          @float said in Fetching package: connection reset by peer:

                          dns lookup" saying no response?

                          but yes and it's getting weirder

                          e16dff5a-66de-4a98-8fa5-7f1107874e9b-image.png

                          Cats bury it so they can't see it!
                          (You know what I mean if you have a cat)

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            No that not OK. All of those servers should respond to DoT queries.

                            If you have a host name there it must match as it will be used for verification. But you don't need to have one.

                            Steve

                            1 Reply Last reply Reply Quote 0
                            • DaddyGoD
                              DaddyGo
                              last edited by

                              Try something, really just optional

                              DNS hostname - cloudflare-dns.com

                              Cats bury it so they can't see it!
                              (You know what I mean if you have a cat)

                              1 Reply Last reply Reply Quote 0
                              • F
                                float
                                last edited by

                                8d395eb0-9ff9-448e-b4e6-1f815af8ce18-image.png

                                DaddyGoD 1 Reply Last reply Reply Quote 0
                                • DaddyGoD
                                  DaddyGo @float
                                  last edited by DaddyGo

                                  @float

                                  can you PING 1.1.1.1 under windows or linux (behind pfSense)
                                  what do you see in the firewall log then?

                                  +++edit:
                                  this can also be interesting

                                  9e1faf4f-7bb9-4e7a-91c6-8fed4bc7f04d-image.png

                                  Cats bury it so they can't see it!
                                  (You know what I mean if you have a cat)

                                  1 Reply Last reply Reply Quote 0
                                  • F
                                    float
                                    last edited by float

                                    I changed the dns server to only 8.8.8.8

                                    I can ping it:

                                    5a730425-3036-463c-9c3b-7dcbe5dcd782-image.png

                                    I can resolve hosts:

                                    Sep 13 15:03:07 	unbound 	36154:0 	info: control cmd: stats_noreset
Sep 13 15:03:02 	unbound 	36154:1 	info: validation success 157.228.27.193.in-addr.arpa. PTR IN
Sep 13 15:03:02 	unbound 	36154:1 	info: validate(nxdomain): sec_status_secure
Sep 13 15:03:02 	unbound 	36154:1 	info: validated DNSKEY 193.in-addr.arpa. DNSKEY IN
Sep 13 15:03:02 	unbound 	36154:1 	info: query response was ANSWER
Sep 13 15:03:02 	unbound 	36154:1 	info: reply from <.> 8.8.8.8#853
Sep 13 15:03:02 	unbound 	36154:1 	info: response for 193.in-addr.arpa. DNSKEY IN
Sep 13 15:03:02 	unbound 	36154:0 	info: validation success 157.228.27.193.in-addr.arpa. PTR IN
Sep 13 15:03:02 	unbound 	36154:0 	info: validate(nxdomain): sec_status_secure
Sep 13 15:03:02 	unbound 	36154:0 	info: validated DNSKEY 193.in-addr.arpa. DNSKEY IN
Sep 13 15:03:02 	unbound 	36154:0 	info: query response was ANSWER
Sep 13 15:03:02 	unbound 	36154:0 	info: reply from <.> 8.8.8.8#853
Sep 13 15:03:02 	unbound 	36154:0 	info: response for 193.in-addr.arpa. DNSKEY IN
Sep 13 15:03:02 	unbound 	36154:1 	info: resolving 193.in-addr.arpa. DNSKEY IN
Sep 13 15:03:02 	unbound 	36154:1 	info: validated DS 193.in-addr.arpa. DS IN
Sep 13 15:03:02 	unbound 	36154:1 	info: query response was ANSWER
Sep 13 15:03:02 	unbound 	36154:1 	info: reply from <.> 8.8.8.8#853
Sep 13 15:03:02 	unbound 	36154:1 	info: response for 193.in-addr.arpa. DS IN
Sep 13 15:03:02 	unbound 	36154:0 	info: resolving 193.in-addr.arpa. DNSKEY IN
Sep 13 15:03:02 	unbound 	36154:0 	info: validated DS 193.in-addr.arpa. DS IN
Sep 13 15:03:02 	unbound 	36154:0 	info: query response was ANSWER
Sep 13 15:03:02 	unbound 	36154:0 	info: reply from <.> 8.8.8.8#853
Sep 13 15:03:02 	unbound 	36154:0 	info: response for 193.in-addr.arpa. DS IN
Sep 13 15:03:02 	unbound 	36154:1 	info: resolving 193.in-addr.arpa. DS IN
Sep 13 15:03:02 	unbound 	36154:1 	info: query response was NXDOMAIN ANSWER
Sep 13 15:03:02 	unbound 	36154:1 	info: reply from <.> 8.8.8.8#853
Sep 13 15:03:02 	unbound 	36154:1 	info: response for 157.228.27.193.in-addr.arpa. PTR IN
Sep 13 15:03:02 	unbound 	36154:0 	info: resolving 193.in-addr.arpa. DS IN
Sep 13 15:03:02 	unbound 	36154:0 	info: query response was NXDOMAIN ANSWER
Sep 13 15:03:02 	unbound 	36154:0 	info: reply from <.> 8.8.8.8#853
Sep 13 15:03:02 	unbound 	36154:0 	info: response for 157.228.27.193.in-addr.arpa. PTR IN
Sep 13 15:03:02 	unbound 	36154:1 	info: resolving 157.228.27.193.in-addr.arpa. PTR IN
Sep 13 15:03:02 	unbound 	36154:0 	info: resolving 157.228.27.193.in-addr.arpa. PTR IN
Sep 13 15:03:02 	unbound 	36154:2 	info: validation success time-a.timefreq.bldrdoc.gov. AAAA IN
Sep 13 15:03:02 	unbound 	36154:2 	info: validate(cname_noanswer): sec_status_secure
Sep 13 15:03:02 	unbound 	36154:2 	info: validation success time-c.timefreq.bldrdoc.gov. AAAA IN
Sep 13 15:03:02 	unbound 	36154:2 	info: validate(cname_noanswer): sec_status_secure
Sep 13 15:03:02 	unbound 	36154:2 	info: validation success time-b.timefreq.bldrdoc.gov. AAAA IN
Sep 13 15:03:02 	unbound 	36154:2 	info: validate(cname_noanswer): sec_status_secure
Sep 13 15:03:02 	unbound 	36154:2 	info: validated DNSKEY nist.gov. DNSKEY IN
Sep 13 15:03:02 	unbound 	36154:2 	info: validated DNSKEY nist.gov. DNSKEY IN
Sep 13 15:03:02 	unbound 	36154:2 	info: validated DNSKEY nist.gov. DNSKEY IN
Sep 13 15:03:02 	unbound 	36154:2 	info: query response was ANSWER
Sep 13 15:03:02 	unbound 	36154:2 	info: reply from <.> 8.8.8.8#853
Sep 13 15:03:02 	unbound 	36154:2 	info: response for nist.gov. DNSKEY IN
Sep 13 15:03:02 	unbound 	36154:3 	info: validation success time-b.timefreq.bldrdoc.gov. AAAA IN
Sep 13 15:03:02 	unbound 	36154:3 	info: validate(cname_noanswer): sec_status_secure
Sep 13 15:03:02 	unbound 	36154:3 	info: validation success time-a.timefreq.bldrdoc.gov. AAAA IN
Sep 13 15:03:02 	unbound 	36154:3 	info: validate(cname_noanswer): sec_status_secure
Sep 13 15:03:02 	unbound 	36154:3 	info: validated DNSKEY nist.gov. DNSKEY IN
Sep 13 15:03:02 	unbound 	36154:3 	info: validated DNSKEY nist.gov. DNSKEY IN
Sep 13 15:03:02 	unbound 	36154:3 	info: query response was ANSWER
Sep 13 15:03:02 	unbound 	36154:3 	info: reply from <.> 8.8.8.8#853
Sep 13 15:03:02 	unbound 	36154:3 	info: response for nist.gov. DNSKEY IN
Sep 13 15:03:02 	unbound 	36154:1 	info: validation success 124.25.26.194.in-addr.arpa. PTR IN
Sep 13 15:03:02 	unbound 	36154:1 	info: validate(nxdomain): sec_status_secure
Sep 13 15:03:02 	unbound 	36154:1 	info: validated DNSKEY 194.in-addr.arpa. DNSKEY IN
Sep 13 15:03:02 	unbound 	36154:1 	info: query response was ANSWER
Sep 13 15:03:02 	unbound 	36154:1 	info: reply from <.> 8.8.8.8#853
Sep 13 15:03:02 	unbound 	36154:1 	info: response for 194.in-addr.arpa. DNSKEY IN
Sep 13 15:03:02 	unbound 	36154:2 	info: validation success 124.25.26.194.in-addr.arpa. PTR IN
Sep 13 15:03:02 	unbound 	36154:2 	info: validate(nxdomain): sec_status_secure
Sep 13 15:03:02 	unbound 	36154:2 	info: validated DNSKEY 194.in-addr.arpa. DNSKEY IN
Sep 13 15:03:02 	unbound 	36154:2 	info: query response was ANSWER
Sep 13 15:03:02 	unbound 	36154:2 	info: reply from <.> 8.8.8.8#853
Sep 13 15:03:02 	unbound 	36154:2 	info: response for 194.in-addr.arpa. DNSKEY IN
Sep 13 15:03:02 	unbound 	36154:2 	info: resolving nist.gov. DNSKEY IN
Sep 13 15:03:02 	unbound 	36154:2 	info: validated DS nist.gov. DS IN
Sep 13 15:03:02 	unbound 	36154:2 	info: validated DS nist.gov. DS IN
Sep 13 15:03:02 	unbound 	36154:2 	info: validated DS nist.gov. DS IN
Sep 13 15:03:02 	unbound 	36154:2 	info: query response was ANSWER
Sep 13 15:03:02 	unbound 	36154:2 	info: reply from <.> 8.8.8.8#853
Sep 13 15:03:02 	unbound 	36154:2 	info: response for nist.gov. DS IN
Sep 13 15:03:02 	unbound 	36154:3 	info: resolving nist.gov. DNSKEY IN
Sep 13 15:03:02 	unbound 	36154:3 	info: validated DS nist.gov. DS IN
Sep 13 15:03:02 	unbound 	36154:3 	info: validated DS nist.gov. DS IN
Sep 13 15:03:02 	unbound 	36154:3 	info: query response was ANSWER
Sep 13 15:03:02 	unbound 	36154:3 	info: reply from <.> 8.8.8.8#853
Sep 13 15:03:02 	unbound 	36154:3 	info: response for nist.gov. DS IN
                                    DaddyGoD 1 Reply Last reply Reply Quote 0
                                    • DaddyGoD
                                      DaddyGo @float
                                      last edited by

                                      @float said in Fetching package: connection reset by peer:

                                      and inside pfSense? (nslookup)

                                      Cats bury it so they can't see it!
                                      (You know what I mean if you have a cat)

                                      1 Reply Last reply Reply Quote 0
                                      • F
                                        float
                                        last edited by

                                        [2.4.5-RELEASE][admin@]/root: nslookup www.facebook.com 8.8.8.8
                                        Server: 8.8.8.8
                                        Address: 8.8.8.8#53

                                        Non-authoritative answer:
                                        www.facebook.com canonical name = star-mini.c10r.facebook.com.
                                        Name: star-mini.c10r.facebook.com
                                        Address: 157.240.210.35
                                        Name: star-mini.c10r.facebook.com
                                        Address: 2a03:2880:f121:83:face:b00c:0:25de

                                        DaddyGoD 1 Reply Last reply Reply Quote 0
                                        • DaddyGoD
                                          DaddyGo @float
                                          last edited by DaddyGo

                                          @float

                                          Okay, if you like 8.8.8.8

                                          just a little plus, you might want to disable 53 if you only want to use DoT
                                          and point all DNS requests to pfSense (manualy or DHCP)
                                          try to use only static entries (DHCP) and uncheck it, this

                                          2482df19-ebfe-40d8-8d6d-f00cf8834357-image.png

                                          oh and get ready for the new craziness DoH 😉

                                          Cats bury it so they can't see it!
                                          (You know what I mean if you have a cat)

                                          1 Reply Last reply Reply Quote 0
                                          • F
                                            float
                                            last edited by

                                            Thank you. Everything is working as it should, only pfsense is being funny, right?

                                            DaddyGoD 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.