How to troubleshoot WAN connection?

mark81

Hi,

I have some problems with my WAN connection. Since yesterday evening the connection goes up, down, up, down.
I already rebooted PFSense. I also rebooted my modem.

When the connection is down I cannot ping my ISPs gateway. When it's up I can ping my ISPs gateway. I called my ISP but they don't see connections down in their logging.
Or they just didn't look very hard. What I see on PFSense:

Aug 30 20:03:07 kernel igb1: link state changed to DOWN
Aug 30 20:04:07 kernel igb1: link state changed to DOWN
Aug 30 20:04:15 kernel igb1: link state changed to DOWN
Aug 30 20:12:22 kernel igb1: link state changed to DOWN
Aug 30 20:13:06 kernel igb1: link state changed to DOWN
Aug 30 20:13:16 kernel igb1: link state changed to DOWN
Aug 30 20:29:31 kernel igb1: link state changed to DOWN
Aug 30 20:29:38 kernel igb1: link state changed to DOWN
Aug 30 20:45:55 kernel igb1: link state changed to DOWN
Aug 30 20:46:02 kernel igb1: link state changed to DOWN
Aug 30 20:50:53 kernel igb1: link state changed to DOWN
Aug 30 20:51:01 kernel igb1: link state changed to DOWN
Aug 30 21:09:49 kernel igb1: link state changed to DOWN
Aug 30 21:10:23 kernel igb1: link state changed to DOWN
Aug 30 21:10:32 kernel igb1: link state changed to DOWN

How can I properly troubleshoot this? How can I rule out PFSense? Is there any logging other then the system log I can inspect to define the root cause?

Kind regards,

Mark

KOM

While you look into it, you can get around it by going to System - Routing - Gateways and disable gateway monitoring.

mark81

Hi,

GW monitoring is already off for the def GW.
Below some logging, Hope it helps.

Aug 30 21:40:50 check_reload_status Linkup starting igb1
Aug 30 21:40:50 kernel igb1: link state changed to DOWN
Aug 30 21:40:50 Squid_Alarm 93662 Squid has exited. Reconfiguring filter.
Aug 30 21:40:50 Squid_Alarm 94221 Attempting restart…
Aug 30 21:40:51 (squid-1) No HTTP, HTTPS, or FTP ports configured
Aug 30 21:40:52 php-fpm 53415 /rc.linkup: DEVD Ethernet detached event for wan
Aug 30 21:40:52 kernel arpresolve: can't allocate llinfo for 195.35.208.105 on igb1
Aug 30 21:40:53 kernel arpresolve: can't allocate llinfo for 195.35.208.105 on igb1
Aug 30 21:40:54 Squid_Alarm 96922 Reconfiguring filter…
Aug 30 21:40:54 check_reload_status Reloading filter
Aug 30 21:40:54 Squid_Alarm 98329 Squid has resumed. Reconfiguring filter.
Aug 30 21:40:54 check_reload_status Reloading filter
Aug 30 21:40:54 (squid-1) No HTTP, HTTPS, or FTP ports configured
Aug 30 21:40:54 kernel igb1: link state changed to UP
Aug 30 21:40:55 check_reload_status Linkup starting igb1
Aug 30 21:40:55 php-fpm 96808 /rc.filter_configure_sync: [squid] Installed but disabled. Not installing 'nat' rules.
Aug 30 21:40:56 kernel arpresolve: can't allocate llinfo for 195.35.208.105 on igb1
Aug 30 21:40:56 xinetd 18917 Starting reconfiguration
Aug 30 21:40:56 kernel arpresolve: can't allocate llinfo for 195.35.208.105 on igb1
Aug 30 21:40:56 xinetd 18917 Swapping defaults
Aug 30 21:40:56 xinetd 18917 readjusting service 6969-udp
Aug 30 21:40:56 xinetd 18917 Reconfigured: new=0 old=1 dropped=0 (services)
Aug 30 21:40:56 php-fpm 96808 /rc.filter_configure_sync: [squid] Installed but disabled. Not installing 'pfearly' rules.
Aug 30 21:40:56 kernel arpresolve: can't allocate llinfo for 195.35.208.105 on igb1
Aug 30 21:40:56 php-fpm 858 /rc.linkup: DEVD Ethernet attached event for wan
Aug 30 21:40:56 php-fpm 858 /rc.linkup: HOTPLUG: Configuring interface wan
Aug 30 21:40:56 php-fpm 858 /rc.linkup: Accept router advertisements on interface igb1
Aug 30 21:40:56 php-fpm 858 /rc.linkup: ROUTING: setting default route to 195.35.208.105

mark81

Nobody can help me with this?

hell bomb

At first glance, it looks like one of your interfaces are going down. Next time you see your GW go down, look for link lights on both the pfSense box and the modem and see if there is any weird lighting such as orange as it may indicate issues with the NIC.