Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    pfSense rebooted by root?

    Scheduled Pinned Locked Moved General pfSense Questions
    29 Posts 7 Posters 4.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • RyanMR
      RyanM
      last edited by

      My machine does not support IPMI. A fuller copy of the log is available here: https://docs.google.com/spreadsheets/d/1JC-8D-RQ44JRlXGF4PXnRid32aUxdZ8RrHdE7Z4GQnk/edit?usp=sharing

      I had avoided posting the whole thing because I didn't want to cleanse it.

      The reboot is on row 549.

      I do have some open ports on the WAN with forwarding rules:
      Port - Description
      80, 81 - HTTP
      2222 - SSH
      1194, 1196 - OpenVPN
      8080 - Docker / Rancher
      32400, 32444 - Plex

      1 Reply Last reply Reply Quote 0
      • chpalmerC
        chpalmer
        last edited by

        Is port 2222 just to your firewall?

        Triggering snowflakes one by one..
        Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

        1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          Nothing looks very out of place. Something on your network (192.168.1.4) is trying to open pages on the firewall that don't exist:

          Nov 15 16:37:48	***REMOVED_ROUTER_HOSTNAME***		nginx: 2018/11/15 16:37:48 [error] 20989#100149: *217580 "/usr/local/www/JNAP/index.php" is not found (2: No such file or directory), client: 192.168.1.4, server: , request: "POST /JNAP/ HTTP/1.1", host: "192.168.1.1"
Nov 15 16:37:48	***REMOVED_ROUTER_HOSTNAME***		nginx: 2018/11/15 16:37:48 [error] 20989#100149: *217578 "/usr/local/www/HNAP1/index.php" is not found (2: No such file or directory), client: 192.168.1.4, server: , request: "GET /HNAP1/ HTTP/1.1", host: "192.168.1.1"

          But that's pretty common, probably just something misconfigured on the client.

          You could certainly make it more secure by setting ssh to key only and restricting gui access to limited source IPs. If that's not already the case.

          Steve

          1 Reply Last reply Reply Quote 0
          • RyanMR
            RyanM
            last edited by

            Port 2222 actually goes to an internal Ubuntu server.

            192.168.1.4 is a Linksys 4200v2 WiFi router configured as a bridge/access point.

            I will look into using Key only and restricting the GUI access.

            B 1 Reply Last reply Reply Quote 0
            • B
              biggsy @RyanM
              last edited by

              @ryanm

              Assuming that only you should have SSH access to that server, not the whole Internet, would it not be better to use OpenVPN to pfSense and then SSH to the Ubuntu server?

              1 Reply Last reply Reply Quote 0
              • RyanMR
                RyanM
                last edited by

                I may have to look into this a bit deeper. My router just rebooted again on it's own today:

                Nov 28 12:01:59	syslogd		kernel boot file is /boot/kernel/kernel
Nov 28 12:01:00	syslogd		exiting on signal 15
Nov 28 12:01:00	reboot		rebooted by root
Nov 28 12:00:00	php		[pfBlockerNG] No changes to Firewall rules, skipping Filter Reload
Nov 28 12:00:00	php		[pfBlockerNG] Starting cron process.
Nov 28 11:00:00	php		[pfBlockerNG] No changes to Firewall rules, skipping Filter Reload
Nov 28 11:00:00	php		[pfBlockerNG] Starting cron process.

                Could this be caused by some kind of scheduled job trying to reboot my router periodically?

                1 Reply Last reply Reply Quote 0
                • RyanMR
                  RyanM
                  last edited by

                  Ok, I just locked down some ports, included SSH (port 2222). Still, this feels like something on the router and causing causing it to reboot. Either a scheduled process, or something causing a fault that results in a reboot.

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    ssh is not port 2222, 22 yes not 2222

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                    1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by

                      They are forwarding port 2222 to ssh here. I assume you locked it down to known source IPs only.

                      Has it rebooted again since?

                      Steve

                      1 Reply Last reply Reply Quote 0
                      • RyanMR
                        RyanM
                        last edited by

                        Yes, my isp blocks port 22 so I was forwarding port 2222 from wan to port 22 to the internal machine. I turned this off. The router rebooted another 2.5 hours later. I don’t think it has rebooted since.

                        1 Reply Last reply Reply Quote 0
                        • RyanMR
                          RyanM
                          last edited by

                          I just updated to 2.4.4-RELEASE-p1. I will continue to monitor and see if this makes a difference.

                          1 Reply Last reply Reply Quote 0
                          • O
                            Overbay11
                            last edited by

                            @RyanM @stephenw10 Did you ever find a solution to this? I'm experiencing the same exact thing and my logs read the same with random daily reboots.

                            1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              Exactly the same?

                              Let's see logs covering the run up to the reboot.

                              Steve

                              1 Reply Last reply Reply Quote 0
                              • O
                                Overbay11
                                last edited by

                                I guess not "exactly" but very similar. For no reason each morning I lose the internet connection to see pfsense is rebooting. I see this in the logs:

                                Oct 30 10:18:34 gateway syslogd: kernel boot file is /kernel
                                Oct 30 10:18:34 gateway kernel: Copyright (c) 1992-2018 The FreeBSD Project.
                                Oct 30 10:18:34 gateway kernel: Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
                                Oct 30 10:18:34 gateway kernel: The Regents of the University of California. All rights reserved.
                                Oct 30 10:18:34 gateway kernel: FreeBSD is a registered trademark of The FreeBSD Foundation.
                                Oct 30 10:18:34 gateway kernel: FreeBSD 11.2-RELEASE-p10 #21 10fea60fdde(factory-RELENG_2_4_4): Thu May 16 06:26:11 EDT 2019
                                Oct 30 10:18:34 gateway kernel: root@buildbot1-nyi.netgate.com:/build/factory-crossbuild-244/obj/aarch64/upm8hD25/arm64.aarch64/build/factory-crossbuild-244/pfSense/tmp/FreeBSD-src/sys/pfSense arm64
                                Oct 30 10:18:34 gateway kernel: FreeBSD clang version 6.0.0 (tags/RELEASE_600/final 326565) (based on LLVM 6.0.0)
                                Oct 30 10:18:34 gateway kernel: VT: init without driver.
                                Oct 30 10:18:34 gateway kernel: Starting CPU 1 (1)
                                Oct 30 10:18:34 gateway kernel: FreeBSD/SMP: Multiprocessor System Detected: 2 CPUs
                                Oct 30 10:18:34 gateway kernel: random: entropy device external interface
                                Oct 30 10:18:34 gateway kernel: ipw_bss: You need to read the LICENSE file in /usr/share/doc/legal/intel_ipw.LICENSE.
                                Oct 30 10:18:34 gateway kernel: ipw_bss: If you agree with the license, set legal.intel_ipw.license_ack=1 in /boot/loader.conf.

                                Oct 30 10:18:48 gateway php-cgi: rc.bootup:
                                Oct 30 10:19:07 gateway kernel: .done.
                                Oct 30 10:19:56 gateway php-cgi: rc.bootup: Creating rrd update script
                                ct 30 10:19:57 gateway root: /etc/rc.d/hostid: WARNING: hostid: unable to figure out a UUID from DMI data, generating a new one
                                Oct 30 10:20:00 gateway syslogd: exiting on signal 15
                                Oct 30 10:20:00 gateway syslogd: kernel boot file is /kernel
                                Oct 30 10:20:00 gateway kernel: done.
                                Oct 30 10:20:00 gateway kernel: done.
                                Oct 30 10:20:06 gateway php-fpm[363]: /rc.start_packages: Restarting/Starting all packages.
                                Oct 30 10:20:06 gateway php-fpm[363]: [pfBlockerNG] Starting cron process.
                                Oct 30 10:20:08 gateway getty[7801]: open /dev/ttyv0: No such file or directory
                                Oct 30 10:20:08 gateway login: login on ttyu0 as root

                                And I was not logged into the console and was sitting right next to the box so nobody was physically here.

                                1 Reply Last reply Reply Quote 0
                                • O
                                  Overbay11
                                  last edited by

                                  @RyanM @stephenw10 I just updated with some logs. Thanks for the help.

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    Ok, importantly you are not seeing rebooted by root there. Rather it just appears to reboot.

                                    That's an SG-1100 I assume?

                                    Are you able to connect to the serial console and log the output there across a reboot? That would show what's happening.

                                    Steve

                                    1 Reply Last reply Reply Quote 0
                                    • O
                                      Overbay11
                                      last edited by

                                      yep its an 1100. Are you thinking maybe its rebooting due to some overload on the hardware or potential hardware issue then?

                                      I should be able to connect to the serial console directly. How would I log the output from there and then do a reboot?

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        If you are using putty in Windows (or Linux) you can just enable logging there to get a file directly. Most terminal clients will have enough scroll back anyway to just copy and paste it out.
                                        You would need to just leave it connected and wait for it to reboot unless you are able to predict when it will happen.

                                        Steve

                                        1 Reply Last reply Reply Quote 0
                                        • First post
                                          Last post
                                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.