pfSense CE 2.5.1 RC update/upgrade

pete

Updated today to V2.5.1.r.20210325.0300.

No issues to report.

pete

Updated today to:

2.5.1.r.20210328.0300

IP6 is not working on LAN interface.

I can ping IP6 addresses from the WAN interface but not the LAN interface.

IP6 test ==> test-ipv6.com/ ==> 0/10

Update

A couple of reboots and all fine now.

I can ping IP6 addresses from WAN and LAN interfaces.

--- 2001:4860:4860::8888 ping6 statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss

IP6 test ==> test-ipv6.com/ ==> Your readiness score
10/10

pete

Update 2.5.1.r.20210329.0300.

Updated - reboot

No IP6 showing on interfaces. IP6 showing on gateways.

Rebooted again. No IP4 showing on WAN interface and no IP4/IP6 gateways showing.

Removed IP6 references on WAN and LAN interfaces.

Rebooted.

IP4 WAN interface and gateways look fine now.

Adding IP6 to WAN / LAN configuration.

Dynamically no IP6 seen on Interface or Gateways.

Rebooted.

Now see IP6 on interface and gateways.

Dashboard Interfaces and Gateways now show IP6.

Ping IP6 DNS from WAN via PFSense / Diagnostic / Ping works fine.

Testing IP6 on Internet ==> ipv6-test.com ===> works fine.

pete

Update #2

NDP tables populated fine with all Alexa devices. Each Alexa device is showing local IP6 link address and internet IP6 address.

It is a bit of a PITA to upgrade and not see IP6 connectivity come up on reboot. I would expect the upgraded PFSense to come up right away with functioning IP6.

pete

Updated to 2.5.1.r.20210329.1241 yesterday 29th of March.

It was not a dynamic update.

After removing then reinstalling IP6 everything was OK.

pete

Updated to:

2.5.1.r.20210331.0300

This morning; 31st of March, 2021

Again as previously documented. On initial after upgrade reboot WAN / LAN interfaces showed no IP6. WAN Gateway showed same IP6 FE80 address.

Let it run awhile and never saw the WAN IP6 address.

As before removed any reference to IP6, rebooted, configured IP6 on LAN / WAN / RA and rebooted.

Dashboard interfaces show IP6 addresses and Dashboard gateway shows IP6 addresses.

Note my secondary ISP / CPE IP6 NAT'd address continues to work fine after update / reboot. Only the primary XFinity IP6 connection doesn't come back after initial update and reboot.

pete

2nd of April, 2021 update(s).

Updated twice yesterday. With each update lost my main WAN IP6 connection. I did as before which was disabling all IP6 on WAN and LAN, rebooting, re-enabling IP6, rebooting and all was well.

This morning updated to:
2.5.1.r.20210402.0300

Before update disabled WAN2 IP6 configuration. WAN2 is a CPE on T-Mobile. I am using a LAN interface on the device which is in a DMZ. I have it configured IP6 wise identical to the Comcast connection on main WAN.

With the updates to PFSense this WAN2 connection always stayed up IP4/IP6; but not the XFinity IP6 connection.

This time before the update disabled IP6 on WAN2.

I did the update and it worked fine and I never lost the IP6 connectivity on main WAN.

I do not know why having IP6 running on the failover CPE WAN2 connection would prevent IP6 from running on WAN connection when doing an update / rebooting.

So update went fine this time after reboot and after disabling IP6 on the WAN2 CPE connection.

All appears fine after update. (with WAN2 IP6 off)

2.5.1.r.20210402.0300.jpg

No updates have affected the NTP server. Working fine here.
I did move the GPS from the attic talking serially to the basement installed PFSense box to the basement with the GPS antenna near a SW windows with a cover on it 6 feet below ground level.

Configured WAN2 - TMobile CPE with IP6.
CPE ==> LAN interface ==> PFSense WAN2 interface.
I cannot bridge the interface. I can shut off firewall pieces and directly connect to WAN port but then I cannot get to the CPE interface on the LAN side.
The CPE is an el cheapo Yeacomm 4G LTE CPE Router on Amazon.

Here is a direct connection to the CPE interface GUI.

pete

Update 2147 c time 2nd April, 2021

XFinity has been up and down twice in the last 8 hours.

The default gateway IPv6 icon is no longer present.

pete

3rd of April, 2021

Upgraded to 2.5.1.r.20210403.0300

LAN device (laptop) would not pass IP6 test on internet after update reboot.

The assumption is that RA wasn't working?

Both IP4 and IP6 gateway icons (globes) came back.

After 2-3 hours of not seeing IP6 on my laptop removed all references to IP6 on WAN and LAN interfaces, rebooted, re-entered all IP6 stuff, rebooted and all was well.

pete

Update 4th of April, 2021 to:

2.5.1.r.20210404.0300

After reboot all functions continued to work; specfically IP6 came back fine and IP6 internet test worked fine.

Have kept the WAN #2 IP6 pieces disabled for the last couple of days.

Note here I have disabled IP6 on WAN2 for time bean as for whatever reason that seemed to be an issue after updates. I am not sure why this would cause a loss of IP6 on the primary WAN interface after an update / reboot.

The CPE is router:

I am attaching to IP4 via a NAT'd DHCP address on the LAN side of the CPE.

I have the IP6 configuration for TMobile CPE same as the Comcast connection which has worked for me:

IPv6 Configuration Type: DHCP6
Use IPv4 connectivity as parent interface - checked
DHCPv6 Prefix Delegation size - /60
Send IPv6 prefix hint

For failover only using IP4 on WAN #1 and WAN #2.

I do see 4 gateways in the router configuration:

1 - WAN IP4 gateway
2 - WAN IP6 gateway
3 - WAN #2 IP4 gateway
4 - WAN #2 IP6 gateway

If I enable IP6 on WAN #2 a reboot causes WAN #1 IP6 to disconnect and not come back unless I remove IP6 from all of the interfaces, reboot, reinstall IP6 and reboot.

T-Mobile gives me a 26XX address on the WAN #2 link. PFSense is connected to a LAN link on the CPE. So I get a private IP4 LAN address and a 26XX address on same LAN link but that is the same as the CPE WAN link.

I cannot bridge the interface on the CPE. I can though shut off the router piece and directly connect to the WAN interface but then I do not get to see the GUI on the CPE. So if I connect my laptop to the LAN port or WLAN port of the CPE I do get internet connectivity with an IP4 and IP6 T-Mobile address.

jimp

There are known issues with having multiple DHCPv6 WANs. It's not technically supported currently. It may have partially worked in the past by chance alone, but it's not viable at the moment.

https://redmine.pfsense.org/issues/6880

pete

@jimp

Thank you.

pete

5th of April, 2021

Updated to:

2.5.1.r.20210405.0300

Left WAN#2 IP6 off, updated, rebooted and all is well.

encyklopedi

Please write ipv4 and ipv6, not ip4 and ip6.

pete

Will do.

Update 2200c 6th of April, 2021 to:

2.5.1.r.20210406.1302

Left failover WAN 2 IPv6 settings off when updating.

Noticed that I do not see Dashboard status on IPSec server when active tunnel is present.

pete

Update:
8th of April, 2021 - 1200c
2.5.1.r.20210406.1302

Looks like XFinity / Comcast rebooted my SB 6190 modem this morning...

Software version on SB6190 ==> 9.1.103AA65L

Uptime: 0 d: 1 h: 42 m

PFsense lost WAN #1 connection around the same time as modem being rebooted by XFinity.

Failed over to WAN #2 at this time.

PFSense didn't automagically reconnect to the modem (WAN #1) after XFinity restarted Modem as Dashboard indicated no WAN IPv4 or IPv6 address on the WAN interface.

I had to manually reboot PFSense to get it to connect to the SB6190.

Gertjan

@pete said in pfSense CE 2.5.1 RC update/upgrade:

I had to manually reboot PFSense

Not optimal.
Better - not still not best - would be Status > Interfaces and try a Release and re connect for the concerning WAN interface.
This should give a kick to the DHCP client.
If that works, you know that the issue is that "DHCP client" didn't manage to get a new WAN IP on it's own. Check the DHCP logs if it was doing so.
When the "DHCP client" issue is confirmed, goto Interface > WAN and check DHCP Client Configuration > Advanced Configuration
Now you have some extra options that you can be used to 'back off' when the modem goes down.

pete

@gertjan

Thank you.

It happened again around 3AM here and the IPv4/IPv6 interface did not come back to life.

Will test a release and reapply of the DHCP WAN client.

The release and reapply of the WAN IPv4/IPv6 side did not work.

Logs show:

Apr 9 09:42:33 dhclient 24862 DHCPDISCOVER on em1 to 255.255.255.255 port 67 interval 12
Apr 9 09:42:28 dhclient 24862 DHCPDISCOVER on em1 to 255.255.255.255 port 67 interval 5
Apr 9 09:42:26 dhclient 24862 DHCPDISCOVER on em1 to 255.255.255.255 port 67 interval 2
Apr 9 09:42:25 dhclient 24862 DHCPDISCOVER on em1 to 255.255.255.255 port 67 interval 1
Apr 9 09:42:24 dhclient 24862 DHCPDISCOVER on em1 to 255.255.255.255 port 67 interval 1
Apr 9 09:42:23 dhclient 24862 DHCPDISCOVER on em1 to 255.255.255.255 port 67 interval 1
Apr 9 09:42:17 dhclient 24862 DHCPREQUEST on em1 to 255.255.255.255 port 67
Apr 9 09:42:12 dhclient 24862 DHCPREQUEST on em1 to 255.255.255.255 port 67
Apr 9 09:42:12 dhclient 24862 DHCPREQUEST on em1 to 255.255.255.255 port 67
Apr 9 09:42:12 dhclient 44358 PREINIT
Apr 9 09:42:08 dhclient 24862 Cannot open or create pidfile: No such file or directory
Apr 9 09:42:06 dhcp6c 999 exiting
Apr 9 09:42:05 dhclient 97160 exiting.
Apr 9 09:42:05 dhclient 97160 connection closed
Apr 9 09:42:05 dhcp6c 999 Sending Solicit
Apr 9 09:42:04 dhcpd 27848 Server starting service.

Watching the Dashboard seeing an IPv4 come up then go away. Nothing seen on the IPv6 interface in the Dashboard.

Looks like it is trying. What changes can I make to the DHCP advanced section of the WAN interface to maybe fix this?

Rebooted PFSense and all is well for time bean.

This issue appears to have cropped up with latest upgrade.

2.5.1.r.20210406.1302

Gertjan

As you can see, the dhclient stops. Probably because their is no reason for it to keep running as the WAN interface went down. That is, the other end - the modem - was rebooting.
As usual, it takes a small eternity for it to come back on-line.
So, dhclient is launched again.

As the last lease wasn't expired, a couple of DHCPREQUEST are fired away.
The modem doesn't reply.
After 3 DHCPREQUEST, dhclient start to obtain a new lease :
After 0,1 second, a DHCPDISCOVER is fired : no reply.
0,2 seconds another DHCPDISCOVER is fired : no reply.
after 0,5 seconds another DHCPDISCOVER is fired : no reply.
after 1 second another DHCPDISCOVER is fired : no reply.
after 2 second another DHCPDISCOVER is fired : no reply.
after 5 second another DHCPDISCOVER is fired : no reply.
after 10 second another DHCPDISCOVER is fired : no reply.
Etc.

yes, we all love these modems.

As said, with the DHCP log measure the time the modem decides to reply, and add 30 seconds margin.

Now, as said above, use the DHCP Client Configuration > Advanced Configuration and use these option to introduce an initial hold-off time.

Or get a modem that is a bit faster and/or actually replies after it started up.

If IPv4 is down, then IPv6 is also down, that's normal.

pete

@gertjan

Thank you.

The modem is an Arris Surfboard 6190.

While I do see an uptime of a few hours I do not see a reboot of the modem in the modem logs. The reboot of the modem is typically around a minute or so.

I have been considering updating the owned modem to a new Arris Surfboard SB8200.

Guessing here a PFSense / Interfaces / WAN / advanced DHCP configuration setting to Protocal timing:

The options are timeout, retry, select timeout, reboot, back off or initial interval.

Which option should I use? and for how long?

See the first option default timeout to be 60 seconds. Should I change this to 120 seconds?