Logon / Performance oddity

nehumanuscrede

If I allow the pfSense appliance unrestricted access off of my network ( to the internet ) my login attempt to the appliance happens almost instantly ( as expected ).

However, if I BLOCK* the pfSense appliance from talking outside of my local network, ( via firewall rules on the edge router ) the login screen takes approximately 90 seconds to transition between the login and the dashboard screen.

*Selective block. I block all TCP / UDP traffic from the appliance off the local network with the exception of what is needed for the OpenVPN server.

The same is true for a transition between the Dashboard screen and the System -> Update screen. 90 seconds.

It does not appear to impact transitions to other screens other than the aforementioned two nor does is appear to impact the performance of what I am utilizing the appliance for ( OpenVPN Server ).

I will make an assumption here that upon login and / or transition to the updates page, the appliance is going out and doing a version check / comparison against what the appliance is currently running.

Even when I disable the option to do said check from the Dashboard, I still see the 90 second delay on login and / or Update page.

Why is this ?

Can this check be done in the background so it doesn't impact login performance ?

The appliance is one of your original ones running v2.4.4 software I believe.

johnpoz

If your not going to let the box do dns, do you have unbound running?

nehumanuscrede

Unbound is currently disabled.

johnpoz

So you have pfsense pointing nowhere for dns?

nehumanuscrede

Correct.

There are no DNS servers configured within the appliance.

The only services actually running are:

ntpd
openvpn
syslogd

Also noteworthy, modifying the configuration in any way and saving it takes quite some time* as well with the unit blocked from talking outside the local network.

*~60 seconds

nehumanuscrede

My workaround fix:

The edge router who is playing firewall duty is now allowing the pfSense appliance to send out DNS requests. It is also allowing outbound UDP traffic where the source port is the OpenVPN server.

Everything else is denied so while the DNS query gets resolved, the appliance can't do much with it beyond that since all other traffic is blocked.

Login and page transition are now working at a normal pace, though I don't know why a DNS query would have any impact on the speed at which the web gui login / page transitions happen.

While this means the unit won't be able to check for updates, I'm actually ok with that as I've had to reload from scratch ( via USB stick ) the entire appliance multiple times after the usual update process left me with a non-bootable unit. :|

johnpoz

To be honest if you turned off the update.. it shouldn't be doing any dns queries.. and since you said you don't have any dns enabled nor pfsense pointing any dns.. What/How could it be do queries... If I find some time I will do some playing around with this this weekend... I have a 2440 on my bench I can take home put on the network and just block it from talking outbound like your doing..

I would be curious what dns queries its doing exactly.

nehumanuscrede

As a test, I wiped out my blocking statements for the pfSense ( allowing full access to the world ) on the edge router and simply removed the DNS entry from the pfSense appliance ( the /etc/resolv.conf file confirms no DNS servers are configured ).

With an empty ( or an invalid ) DNS address in the pfSense appliance, the web / gui login takes approximately 90 seconds after supplying your login credentials before it will transition to the Dashboard page. Once there, if you try to go to the System -> Update page, it will take another 90 seconds before you actually get there and another 90 if you try to get to the System -> Update -> Update Settings page.

( This page is where I disabled / verify the Dashboard auto-update check is disabled )

It should be noted that this has no impact on a SSH login. Only the web / gui is impacted.

Once I supply a valid DNS address, the login and page transitions run as expected.

Basically, it pitches a fit if it doesn't have a valid DNS address to use and / or if it isn't allowed to actually talk to it :D

SteveITS

In general if DNS isn't working then requests will have to time out, I've found. Why it does that if there is no DNS I don't know.

You can disable the update check on the dashboard (so it doesn't check) in system/update/update settings. Then you can add a DNS server and do the check manually.

nehumanuscrede

@teamits

The interesting part is even after the auto-update check is disabled, the appliance still attempts to update and / or talk to an external network device on its own.
( the ip resolves to pfSense so it's most likely an update or telemetry check )

I think disabling it via the GUI only prevents the check from the GUI dashboard, it doesn't appear to disable the check completely.

Example:

Dec 2 09:06:18 CST:
tcp 192.168.20.10(32392) -> 162.208.119.40(443), 17 packets

Gertjan

@nehumanuscrede said in Logon / Performance oddity:

tcp 192.168.20.10(32392) -> 162.208.119.40(443), 17 packets

That's a request to a https port on some remote server (without any reverse ? strange). I bet : not originating from pfSense itself

johnpoz

While there is no reverse that is pfsense IP.. It ends up being files.pfsense.org

But trying to hit an IP is different than a dns query.. And that shouldn't really cause a waiting for dns delay.

Gertjan

@johnpoz said in Logon / Performance oddity:

While there is no reverse that is pfsense IP.. It ends up being files.pfsense.org

Yes !

[2.4.4-RELEASE][admin@pfsense.brit-hotel-fumel.net]/root: host files.pfsense.org
files.pfsense.org has address 162.208.119.40
files.pfsense.org has address 162.208.119.41
files.pfsense.org has IPv6 address 2610:1c1:0:6::40
files.pfsense.org has IPv6 address 2610:1c1:0:6::41

Thanks

SteveITS

@nehumanuscrede said in Logon / Performance oddity:

even after the auto-update check is disabled, the appliance still attempts to update and / or talk to an external network device

I don't recall the location offhand but there is an option somewhere to "do not send the device ID to Netgate" or something like that.