pfSense keeps disconnecting/reconnecting in UniFi Controller

johnpoz

@dragonfire1119 said in pfSense keeps disconnecting/reconnecting in UniFi Controller:

With the Unifi I'm guessing if the LAN disconnects it disconnects my VLAN Networks since the LAN is the main Network?

Thought you never lost a ping? Then it wasn't actually disconnected - how could it have been if you didn't loose a ping? Was the disconnection less then 1 second and happened inbetween pings? That seems highly unlikely.. especially if you had multiple disconnects.

dragonfire1119

@johnpoz I checked ping on my Macbook Pro over two nights and never lost a packet. When I'm surfing on the web sometimes google will just load and load until I disconnect then reconnect and it's fine again.

I can't test ping on my echo's but they're giving me problems not sure if it's WiFi or something else. We have had the Wifi working just fine for a year but that was without the fiber service we have now. I've factory reset the echo's nothing has really helped them disconnecting or dropping out on music streaming.

I'm trying to diagnose things but I'm not sure if these messages are to do with any of these issues that I'm having? I haven't gotten a clear reason why these messages even show up from Ubiquiti and my own research.

When these disconnects are happening this Netgate forum comes up on the bottom right and says something about Network error? This message on the bottom right doesn't stay for long though it's around just a second. Looks like it can't connect to the WebSocket/polling server on the Network tab.

I'm getting 900s directly off the Netgate so it's not my ISP.

I set up ping tests on my Home Assistant and it hasn't gone down but that's directly hard wired on my switch.

Update:

These are the new things that I have changed on the Network since our new internet:

Removed the UDM Pro
Changed over to using Raspberry PI 4+ 8GB for the Unifi Controller.
Hooked up the Netgate XG-1541 to the Unifi 48 Port Switch.
Added VLANs for Guest Network and IOT Network with isolating those from the Main Network.

dragonfire1119

@johnpoz I noticed another thing that happens in the Netgate logs it's blocking my WAN IP for abuse 1.

Aug 30 13:31:59 sshguard	84939	Blocking "(My IP)" for 160 secs (1 attacks in 0 secs, after 1 abuses over 0 secs.)
Aug 30 13:31:59	sshguard	84939	Attack from "(My IP)" on service SSH with danger 10.
Aug 30 13:31:59	sshd	84405	Did not receive identification string from (My IP) port 46863

This is happening right around the time. I'm not sure why this happens since I'm new to Netgate? ntopng is fine on the flows.

johnpoz

Its blocking your lan IP? Why are you trying to login to ssh without sending the correct info?

I can generate those on the fly by trying to connect to ssh from a box on my network - but I have public key auth setup

Aug 30 13:52:35 	sshguard 	81488 	Attack from "192.168.2.12" on service SSH with danger 2.
Aug 30 13:52:35 	sshd 	83302 	Connection closed by authenticating user root 192.168.2.12 port 34882 [preauth]
Aug 30 13:52:34 	sshguard 	81488 	Attack from "192.168.2.12" on service SSH with danger 2.
Aug 30 13:52:34 	sshd 	82979 	Connection closed by authenticating user root 192.168.2.12 port 34880 [preauth]
Aug 30 13:52:32 	sshguard 	81488 	Attack from "192.168.2.12" on service SSH with danger 2.
Aug 30 13:52:32 	sshd 	82701 	Connection closed by authenticating user root 192.168.2.12 port 34878 [preauth]
Aug 30 13:52:30 	sshguard 	81488 	Attack from "192.168.2.12" on service SSH with danger 2.
Aug 30 13:52:30 	sshd 	82337 	Connection closed by authenticating user root 192.168.2.12 port 34876 [preauth]
Aug 30 13:52:26 	sshguard 	81488 	Attack from "192.168.2.12" on service SSH with danger 2.
Aug 30 13:52:26 	sshd 	80674 	Connection closed by authenticating user root 192.168.2.12 port 34874 [preauth]

root@192.168.2.253: Permission denied (publickey).
root@NewUC:/home/user# ssh 192.168.2.253
root@192.168.2.253: Permission denied (publickey).
root@NewUC:/home/user# ssh 192.168.2.253
root@192.168.2.253: Permission denied (publickey).
root@NewUC:/home/user# ssh 192.168.2.253
root@192.168.2.253: Permission denied (publickey).
root@NewUC:/home/user# ssh 192.168.2.253
root@192.168.2.253: Permission denied (publickey).
root@NewUC:/home/user#

dragonfire1119

@johnpoz No, it's blocking my static WAN IP.

I had an issue in the beginning with the ISP and they were being attacked and I finally got to a level 2 he moved me to a different GPON and static IP. Because the NTOPNG was saying my ISP was a flow flooder. I thought the attack was gone but I'm not sure if it's gone or just gotten smarter and getting around the NTOPNG flow log.

This SSH request is coming from my ISP because the (My IP) is my WAN IP.

You got me thinking about if there is anything in the logs. The Unifi Controller is reporting right that it's disconnecting.

I've gone and looked at the logs when my echo's drop streaming and the forum shows me the red box down on the bottom right and sure enough, Netgate is saying it blocked my WAN IP again.

Do you think I'm on the right track?

I really appreciate your help on this.

johnpoz

@dragonfire1119 said in pfSense keeps disconnecting/reconnecting in UniFi Controller:

This SSH request is coming from my ISP because the (My IP) is my WAN IP.

Huh?? Why would pfsense try talking to itself.. That makes no sense.. Your saying the IP that is being blocked is the IP that pfsense shows for its wan?

dragonfire1119

@johnpoz Yes correct.

johnpoz

Off the top of my head I know of nothing in pfsense that would be talking to itself on ssh.. From itself?

What packages are you running?

dragonfire1119

@johnpoz here is a list of my packages installed and uninstalled:

aws-wizard
bandwidth
ipsec-profile-wizard
Netgate_Firmware_Upgrade
ntopng
Zabbix (Uninstalled though)

johnpoz

@dragonfire1119 ntopng does have the ability to do monitoring - that could be doing it??? I have not played with ntop in along time..

Turn if off for testing - does your problem go away.. Do the sshguard lockouts go away.

Zabbix would also be able to do monitoring.. But you say that is uninstalled.

dragonfire1119

@johnpoz I just disabled it and monitoring it.

bingo600

@johnpoz
I have ntopng + zabbix agent installed.
Have never seen any strange ssh.

/Bingo

johnpoz

@bingo600 yeah I have no idea why something would try and ssh to itself from its own IP? But ntop does have the ability to active monitor.. Atleast the full current version does - not sure about the package version in pfsense.

Not sure if ssh was available as one of the things to check? I know like icmp, ping, http, etc was..

dragonfire1119

@johnpoz Been monitoring it no more logs with blocking so far. We're getting better speeds and 4 ms ping now.

bingo600

@johnpoz

If something from the inside tried to ssh to the "outside/wan"
Would it be natt'ed to the wan first ?

So that wan ssh's wan

If it was comming from real wan (spoof) , then i'd hope the packets would be blocked , and not getting a "ban"

/Bingo

johnpoz

@bingo600 said in pfSense keeps disconnecting/reconnecting in UniFi Controller:

Would it be natt'ed to the wan first ?

No..

I just hit my wan IP from lan side IP, as you can see the state is showing the lan side rfc1918 address.

dragonfire1119

@johnpoz It's been working and I'm streaming music now without interruption or static. So if this stays like this it was the NTOPNG being analyzed as an attacker for some reason. Is there any way to whitelist NTOPNG?

Update: The Unifi Messages have stopped saying disconnected from Netgate.

johnpoz

Well when you have some time, we can re-enable it and go over the settings and see what could be causing the issue.

I will have to fire it up and refresh my memory on its features.. Use to use it all the time, outside of pfsense back in the day.. But never really needed it on home network..

edit: switch just got here - man is that tiny! ;)

mcury

@johnpoz man, that is a nice beer =)

dragonfire1119

@johnpoz wow, that thing is tiny! I don't think that one has POE or anything?