Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    PfSense looses connection every 28-30 days.

    General pfSense Questions
    7
    41
    1025
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      jacksnack2 last edited by

      PfSense 2.4.4-RELEASE-p2 (amd64)
      modem: Arris TM822G
      Personal computer build.
      Armstrong Networks, Mercer PA.
      This is a remote site.
      Initial install: December 2018.
      Running BIND package.
      WAN is DHCP
      Running Dynamic DNS

      Hello,

      I have a reoccurring issue I can not resolve. Every 28-30 days the PfSense box looses a connection.

      The first several times this happened i was able to access the box via ssh. However the last thing I tried was to disable dpinger. Yesterday (after another drop) I lost an IP address. (I assume because dpinger was disabled???)

      I initially changed the DNS servers to those of Google for forwarders thinking this was a DNS issue. It now appears it is not as last night I lost an IP address and had a remote user physically reboot the router.

      The first several times this happened I was able to ssh into the box. It appears the subnets behind the PfSense were not able to get DNS resolution. The PfSense box was able to ping external machines (Yahoo).

      However, as mentioned above I don't think this DNS is the issue as yesterday the IP was lost.

      Because this is cyclical (every 28-30 days) I would think this is either:
      -ISP IP renewal/polling of sorts
      -A service running on the PfSense box the runs every 28-30 days causing a conflict

      Thoughts on how I can test this (without waiting 28-30 days)?

      I'm out of options (and can't afford commercial support).

      Any help is greatly appreciated!

      1 Reply Last reply Reply Quote 0
      • johnpoz
        johnpoz LAYER 8 Global Moderator last edited by

        @jacksnack2 said in PfSense looses connection every 28-30 days.:

        PfSense box looses a connection.

        So you mean it looses its lease on its IP, the IP changes and your ddns no longer points to your current wan IP..

        What do the logs say when this happens... You say when it happened before you could ssh to it? But not access the gui? If you have ssh open to the internet, you can always tunnel down the ssh connection to hit the gui.

        How is that clients behind not resolve but pfsense can? Are you pointing pfsense to other than itself? Maybe your bind just went offline if that is what is providing your users dns?

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

        J 1 Reply Last reply Reply Quote 0
        • stephenw10
          stephenw10 Netgate Administrator last edited by

          @jacksnack2 said in PfSense looses connection every 28-30 days.:

          I lost an IP address

          Yes. What exactly do you mean by that?

          Steve

          1 Reply Last reply Reply Quote 0
          • J
            jacksnack2 last edited by

            Sorry, let me clarify.

            The WAN does not show an IP address assigned via DHCP from the ISP.

            More information, even though "Disable Gateway Monitoring Daemon" is checked under the WAN gateway, I still show this from yesterday from the gateway.log:

            Mar 31 14:50:39 hostanme dpinger: WAN_DHCP GATEWAY_IP: Alarm latency 26705us stddev 25984us loss 21%
            Mar 31 14:52:28 hostanme dpinger: WAN_DHCP GATEWAY_IP: Clear latency 22320us stddev 21882us loss 14%
            Mar 31 15:45:31 hostanme dpinger: send_interval 500ms loss_interval 2000ms time_period 60000ms report_interval 0ms data_len 0 alert_interval 1000ms latency_alarm 500ms loss_alarm 20% dest_addr GATEWAY_IP bind_addr HOST_IP identifier "WAN_DHCP "
            Mar 31 15:45:31 hostanme dpinger: send_interval 500ms loss_interval 2000ms time_period 60000ms report_interval 0ms data_len 0 alert_interval 1000ms latency_alarm 500ms loss_alarm 20% dest_addr 172.16.110.1 bind_addr 172.16.110.1 identifier "LAN101VPN3JEAN_VPNV4 "
            Mar 31 15:45:31 hostanme dpinger: send_interval 500ms loss_interval 2000ms time_period 60000ms report_interval 0ms data_len 0 alert_interval 1000ms latency_alarm 500ms loss_alarm 20% dest_addr GATEWAY_IP bind_addr HOST_IP identifier "WAN_DHCP "
            Mar 31 15:45:31 hostanme dpinger: send_interval 500ms loss_interval 2000ms time_period 60000ms report_interval 0ms data_len 0 alert_interval 1000ms latency_alarm 500ms loss_alarm 20% dest_addr 172.16.110.1 bind_addr 172.16.110.1 identifier "LAN101VPN3JEAN_VPNV4 "
            Mar 31 15:45:31 hostanme dpinger: send_interval 500ms loss_interval 2000ms time_period 60000ms report_interval 0ms data_len 0 alert_interval 1000ms latency_alarm 500ms loss_alarm 20% dest_addr GATEWAY_IP bind_addr HOST_IP identifier "WAN_DHCP "
            Mar 31 15:45:31 hostanme dpinger: send_interval 500ms loss_interval 2000ms time_period 60000ms report_interval 0ms data_len 0 alert_interval 1000ms latency_alarm 500ms loss_alarm 20% dest_addr 172.16.110.1 bind_addr 172.16.110.1 identifier "LAN101VPN3JEAN_VPNV4 "

            1 Reply Last reply Reply Quote 0
            • Derelict
              Derelict LAYER 8 Netgate last edited by

              Those logs are from March 31.

              Chattanooga, Tennessee, USA
              The pfSense Book is free of charge!
              DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • J
                jacksnack2 last edited by

                😨

                copied too quick, indeed they are.

                1 Reply Last reply Reply Quote 0
                • stephenw10
                  stephenw10 Netgate Administrator last edited by

                  I would check the dhcp logs when this happens. What is dhclient doing on WAN when it fails?

                  Steve

                  1 Reply Last reply Reply Quote 0
                  • J
                    jacksnack2 last edited by

                    Looks like dhclient is having issues.

                    Apr 30 16:52:54 hostanme dhcpd: DHCPREQUEST for 172.16.21.3 from 00:1b:a9:a9:7f:eb via em1
                    Apr 30 16:52:54 hostanme dhcpd: DHCPACK on 172.16.21.3 to 00:1b:a9:a9:7f:eb via em1
                    Apr 30 17:04:10 hostanme dhcpd: DHCPREQUEST for 172.16.11.2 from 28:18:78:7d:5e:e1 via em0
                    Apr 30 17:04:10 hostanme dhcpd: DHCPACK on 172.16.11.2 to 28:18:78:7d:5e:e1 via em0
                    Apr 30 17:04:26 hostanme dhcpd: DHCPREQUEST for 172.16.21.114 from 3c:5c:c4:e2:04:4d (amazon-51f9125fe) via em1
                    Apr 30 17:04:26 hostanme dhcpd: DHCPACK on 172.16.21.114 to 3c:5c:c4:e2:04:4d (amazon-51f9125fe) via em1
                    Apr 30 17:07:55 hostanme dhcpd: DHCPDISCOVER from 94:65:9c:22:7c:70 via em1
                    Apr 30 17:07:56 hostanme dhcpd: DHCPOFFER on 172.16.21.116 to 94:65:9c:22:7c:70 (PHN-LPC06TU0C) via em1
                    Apr 30 17:08:00 hostanme dhcpd: DHCPDISCOVER from 94:65:9c:22:7c:70 (PHN-LPC06TU0C) via em1
                    Apr 30 17:08:00 hostanme dhcpd: DHCPOFFER on 172.16.21.116 to 94:65:9c:22:7c:70 (PHN-LPC06TU0C) via em1
                    Apr 30 17:08:05 hostanme dhcpd: DHCPDISCOVER from 94:65:9c:22:7c:70 (PHN-LPC06TU0C) via em1
                    Apr 30 17:08:05 hostanme dhcpd: DHCPOFFER on 172.16.21.116 to 94:65:9c:22:7c:70 (PHN-LPC06TU0C) via em1
                    Apr 30 17:08:05 hostanme dhcpd: DHCPREQUEST for 172.16.21.116 (172.16.21.1) from 94:65:9c:22:7c:70 (PHN-LPC06TU0C) via em1
                    Apr 30 17:08:05 hostanme dhcpd: DHCPACK on 172.16.21.116 to 94:65:9c:22:7c:70 (PHN-LPC06TU0C) via em1
                    Apr 30 17:12:29 hostanme dhcpd: DHCPDISCOVER from 38:59:f9:b9:9c:2a via em1
                    Apr 30 17:12:30 hostanme dhcpd: DHCPOFFER on 172.16.21.105 to 38:59:f9:b9:9c:2a (Hellstrom) via em1
                    Apr 30 17:12:30 hostanme dhcpd: DHCPREQUEST for 172.16.21.105 (172.16.21.1) from 38:59:f9:b9:9c:2a (Hellstrom) via em1
                    Apr 30 17:12:30 hostanme dhcpd: DHCPACK on 172.16.21.105 to 38:59:f9:b9:9c:2a (Hellstrom) via em1
                    Apr 30 17:12:34 hostanme dhcpd: DHCPINFORM from 172.16.21.105 via em1
                    Apr 30 17:12:34 hostanme dhcpd: DHCPACK to 172.16.21.105 (38:59:f9:b9:9c:2a) via em1
                    Apr 30 17:13:49 hostanme dhcpd: DHCPINFORM from 172.16.21.105 via em1
                    Apr 30 17:13:49 hostanme dhcpd: DHCPACK to 172.16.21.105 (38:59:f9:b9:9c:2a) via em1
                    Apr 30 17:15:24 hostanme dhcpd: DHCPREQUEST for 172.16.31.2 from 50:e5:49:3d:8a:37 via em3
                    Apr 30 17:15:24 hostanme dhcpd: DHCPACK on 172.16.31.2 to 50:e5:49:3d:8a:37 via em3
                    Apr 30 17:15:58 hostanme dhcpd: DHCPINFORM from 172.16.21.105 via em1
                    Apr 30 17:15:58 hostanme dhcpd: DHCPACK to 172.16.21.105 (38:59:f9:b9:9c:2a) via em1
                    Apr 30 17:17:06 hostanme dhcpd: DHCPREQUEST for 172.16.21.107 from 54:ae:27:26:7f:ca (iPad) via em1
                    Apr 30 17:17:06 hostanme dhcpd: DHCPACK on 172.16.21.107 to 54:ae:27:26:7f:ca (iPad) via em1
                    Apr 30 17:18:00 hostanme dhcpd: DHCPINFORM from 172.16.21.105 via em1
                    Apr 30 17:18:00 hostanme dhcpd: DHCPACK to 172.16.21.105 (38:59:f9:b9:9c:2a) via em1
                    Apr 30 17:18:31 hostanme dhclient[8918]: send_packet: No route to host
                    Apr 30 17:18:33 hostanme dhclient[8918]: send_packet: No route to host
                    Apr 30 17:18:35 hostanme dhclient[8918]: send_packet: No route to host
                    Apr 30 17:18:39 hostanme dhclient[8918]: send_packet: No route to host
                    Apr 30 17:18:50 hostanme dhclient[8918]: send_packet: No route to host
                    Apr 30 17:19:16 hostanme dhcpd: DHCPINFORM from 172.16.21.105 via em1
                    Apr 30 17:19:16 hostanme dhcpd: DHCPACK to 172.16.21.105 (38:59:f9:b9:9c:2a) via em1
                    Apr 30 17:19:28 hostanme dhclient[8918]: send_packet: No route to host

                    Gertjan 1 Reply Last reply Reply Quote 0
                    • stephenw10
                      stephenw10 Netgate Administrator last edited by

                      Hmm, OK and that's it from dhclient?

                      Do you have to reboot to fix this? Resave the WAN? Replug the cable?

                      Check the system log any interface events at that time. No route to host implies the interface may have done down entirely.

                      Steve

                      1 Reply Last reply Reply Quote 0
                      • J
                        jacksnack2 last edited by

                        Yesterday the remote user had to physically restart the modem. An IP was then obtained.
                        Other times if I can ssh in I simply restart the PfSense box. (And DNS seems to start serving the subnets) See original post.

                        Yes, that is it from dhclient.
                        A 'good' entry would be something like this, I assume:
                        Apr 30 22:32:08 host dhclient: RENEW
                        Apr 30 22:32:08 host dhclient: Creating resolv.conf

                        system.log shows nothing regarding links during the time in question.
                        Apr 30 15:58:40 host sshd[30847]: Bad protocol version identification '' from 125.64.94.212 port 33564
                        Apr 30 15:58:40 host sshguard[5379]: Attack from "125.64.94.212" on service 100 with danger 10.
                        Apr 30 15:58:40 host sshd[31019]: Bad protocol version identification '\026\003\001' from 125.64.94.212 port 35787
                        Apr 30 15:58:40 host sshguard[5379]: Attack from "125.64.94.212" on service 100 with danger 10.
                        Apr 30 18:12:00 host syslogd: exiting on signal 15

                        1 Reply Last reply Reply Quote 0
                        • stephenw10
                          stephenw10 Netgate Administrator last edited by

                          Hmm well both restarting the modem and the pfSense box re-negotiates the Ethernet link there. You might try just pulling th link and reconnecting it.
                          Otherwise I think you'd have to get connected from the LAN side and see what is really happening, what works, what doesn't work.

                          Steve

                          1 Reply Last reply Reply Quote 0
                          • J
                            jacksnack2 last edited by

                            Thanks Stephen.

                            It is my experience that NICs rarely fail. Apart from a hardware problem, do you have any ideas what is causing this issue every 28-30 days?

                            1 Reply Last reply Reply Quote 0
                            • J
                              jacksnack2 @johnpoz last edited by

                              @johnpoz Thanks for the input.

                              I originally blamed BIND as well, but with the complete loss of the IP lease yesterday, I assumed other factors are at work.

                              "How is that clients behind not resolve but pfsense can? Are you pointing pfsense to other than itself? Maybe your bind just went offline if that is what is providing your users dns?"

                              I am assuming this has something to do with BIND. But more importantly it appears a result of the DHCP Lease in some way. I only disabled dpinger 30 days ago. I assume dpinger worked its magic to restore the IP address, but routing tables were hosed in the process.

                              Yesterday dpinger had been disabled already, so I assume this is why the IP collapsed completely.

                              1 Reply Last reply Reply Quote 0
                              • Gertjan
                                Gertjan @jacksnack2 last edited by Gertjan

                                @jacksnack2 said in PfSense looses connection every 28-30 days.:

                                Looks like dhclient is having issues.

                                You gave a list with mostly dhcp server logs, the process that hands out IP's on your LAN.

                                These are the details from the DHCP client : :

                                Apr 30 17:18:31 hostanme dhclient[8918]: send_packet: No route to host
                                Apr 30 17:18:33 hostanme dhclient[8918]: send_packet: No route to host
                                Apr 30 17:18:35 hostanme dhclient[8918]: send_packet: No route to host
                                Apr 30 17:18:39 hostanme dhclient[8918]: send_packet: No route to host
                                Apr 30 17:18:50 hostanme dhclient[8918]: send_packet: No route to host
                                Apr 30 17:19:28 hostanme dhclient[8918]: send_packet: No route to host
                                

                                Conclusion : the WAN interface is down .... (doesn't exist).

                                edit : btw : why do your LAN client called "PHN-LPC06TU0C" have to repeat server times their DHCP request (DISCOVER), pfSense received it and replied with an OFFER, and the LAN clients wait 5 seconds to send out another DISCOVER.
                                After several tries the LAN client finally accepts (receives ??) the OFFER and acknowledges with an ACK ....
                                A set of bad network cables ? Network overload ? VLAN issues ? Bad wifi connection ?

                                No "help me" PM's please. Use the forum.

                                1 Reply Last reply Reply Quote 0
                                • Derelict
                                  Derelict LAYER 8 Netgate last edited by

                                  Look at the DHCP logs and filter on process dhclient and post what's there.

                                  The interval from before it fails to after it recovers would be most telling.

                                  My hunch is the WAN port is asking for a renewal and not getting it then reverting to a full DHCP request and not getting that either, then the lease expires and it just stops working - which would probably be an ISP/modem problem. All pfSense can do is ask for a renewal. The server has to respond to it.

                                  Something else you might want to do is just start a Diagnostics > Packet Capture on WAN for UDP 67, set it for something like 1000000 packets and just let it run. Stop it after it fails. Even better would be to try something like disconnect/reconnect ethernet or restart the modem to see if you can get a capture including a recovery too.

                                  Chattanooga, Tennessee, USA
                                  The pfSense Book is free of charge!
                                  DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    jacksnack2 last edited by jacksnack2

                                    @Derelict I have attached filtered DHCP logs as you suggested.[0_1556895346233_dhcp.log.filtered](Uploading 100%) dhcp.log.filtered.txt

                                    Thanks all for your help.

                                    1 Reply Last reply Reply Quote 0
                                    • Derelict
                                      Derelict LAYER 8 Netgate last edited by

                                      Please use wireshark to filter what you want to show and upload the actual pcap.

                                      Chattanooga, Tennessee, USA
                                      The pfSense Book is free of charge!
                                      DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                      1 Reply Last reply Reply Quote 0
                                      • J
                                        jacksnack2 last edited by

                                        Thanks again all,

                                        I have enabled Wireshark and will report back when more information is available.

                                        I should also note that the previous router did not seem to have these issues, It was a Netgear router. I replaced it with PfSense because the PfSense box sports faster interfaces and more functionality.

                                        1 Reply Last reply Reply Quote 0
                                        • johnpoz
                                          johnpoz LAYER 8 Global Moderator last edited by

                                          @jacksnack2 said in PfSense looses connection every 28-30 days.:

                                          I have enabled Wireshark and will report back when more information is available.

                                          What dude - just download the pcap from pfsense info wireshark - filter out what you don't want to show with wireshark... Save the pcap and upload it.

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                                          1 Reply Last reply Reply Quote 0
                                          • J
                                            jacksnack2 last edited by

                                            Sorry, I don't know what "What dude" means.

                                            I understand how to use Wireshark.

                                            Derelict advised to "Stop it after it fails". It may take weeks before another failure event takes place.

                                            Until then Wireshark will show normal traffic. I doubt this is of any use.

                                            1 Reply Last reply Reply Quote 0
                                            • Derelict
                                              Derelict LAYER 8 Netgate last edited by Derelict

                                              That's why I said just let it run for 1000000 packets on WAN filtered on UDP port 67.

                                              If you want to tie up a laptop or something running wireshark that's cool too.

                                              Chattanooga, Tennessee, USA
                                              The pfSense Book is free of charge!
                                              DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                              1 Reply Last reply Reply Quote 0
                                              • J
                                                jacksnack2 last edited by jacksnack2

                                                Hello,

                                                It was about ~35 days this time.

                                                pcap uploaded filtered.pcap .

                                                The pfsense machine was not rebooted, only the modem.

                                                After a reboot, a new IP address was assigned. Connections are now normal.

                                                Thanks Again.

                                                1 Reply Last reply Reply Quote 0
                                                • Derelict
                                                  Derelict LAYER 8 Netgate last edited by Derelict

                                                  Another case of the ISP device simply stopping responses to DHCP Requests and DHCP Discovers.

                                                  It looks to me like there is another MAC address out there making DHCP requests.

                                                  1051 2019-06-04 16:20:05.338922 0.0.0.0 68 255.255.255.255 67 DHCP 64 538 9.496981000 0x0000 (0) DHCP Discover - Transaction ID 0x4b38b221

                                                  Ethernet II, Src: ac:ec:80:79:2e:77, Dst: ff:ff:ff:ff:ff:ff

                                                  I'm assuming your WAN port MAC address is:

                                                  Ethernet II, Src: 38:60:77:04:e8:2c, Dst: ac:ec:80:79:2e:75

                                                  I do not know why what looks like the ISP modem would be making DHCP requests on that network but it seems fishy to me.

                                                  If pfSense renews the lease every 2 hours for a month then it just stops getting a response when issuing identical requests, it is a problem with the modem, not pfSense. Look for yourself. What is the difference between the requests in Frames 1,3,5, and 7 that did receive a response vs the requests in 9,10,11,12, etc that did not?

                                                  I would certainly put 192.168.100.1 in the Reject leases from area on the WAN configuration if it is not already there.

                                                  I don't see that pfSense is doing anything wrong here. The modem simply stops responding, apparently.

                                                  Chattanooga, Tennessee, USA
                                                  The pfSense Book is free of charge!
                                                  DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                                  1 Reply Last reply Reply Quote 0
                                                  • stephenw10
                                                    stephenw10 Netgate Administrator last edited by

                                                    Ok, so you can see in the pacp that it renews the IP s few times but then the DHCP server stops responding. it keep trying and eventually starts broadcasting for any DHCP servers. Then it looses it's own DHCP lease but keeps sending requests.

                                                    Then after sometime the modem starts up it's dhcp server and gives the pfSense WAN a private IP.

                                                    You probably want to prevent that happening by adding 192.168.100.1 to the 'Reject leases from' field on the WAN DHCP setup.

                                                    However that doesn't explain why the remote dhcp server stopped responding.

                                                    Steve

                                                    1 Reply Last reply Reply Quote 0
                                                    • chpalmer
                                                      chpalmer last edited by chpalmer

                                                      @jacksnack2 said in PfSense looses connection every 28-30 days.:

                                                      Arris TM822G

                                                      Arris TM822G while not listed below it is a Puma 5 modem and has issues. Quite old actually if I remember right. Its a telephone modem so it would get an address of its own bridge mode or not.

                                                      Badmodems.com

                                                      POS.

                                                      Replace the old sparkplugs before any further diagnosis is the norm in my book.

                                                      Triggering snowflakes one by one..

                                                      1 Reply Last reply Reply Quote 0
                                                      • J
                                                        jacksnack2 last edited by

                                                        Thank you all for the quick feedback.

                                                        I am a Linux Admin by trade, although networking does occasionally fall under my perview :>

                                                        I blocked the modem IP as suggested. Also, I have re-enabled dpinger as this allows the router to re-obtain a lease. However the issue is the while obtaining a lease via dpinger, DNS resolution fails for internal clients. A router reboot is required.

                                                        I don't see a solution here. But again, I do appreciate the help.

                                                        1 Reply Last reply Reply Quote 0
                                                        • johnpoz
                                                          johnpoz LAYER 8 Global Moderator last edited by

                                                          @jacksnack2 said in PfSense looses connection every 28-30 days.:

                                                          while obtaining a lease via dpinger,

                                                          Huh? Dpinger doesn't have anything to do with renewing a dhcp lease??

                                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                                          If you get confused: Listen to the Music Play
                                                          Please don't Chat/PM me for help, unless mod related
                                                          2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                                                          J 1 Reply Last reply Reply Quote 0
                                                          • J
                                                            jacksnack2 @johnpoz last edited by

                                                            @johnpoz dpinger does not directly deal with leases, but it does fire actions:

                                                            /usr/local/sbin/pfSctl
                                                            -c "service reload dyndns ${GW}"
                                                            -c "service reload ipsecdns"
                                                            -c "service reload openvpn ${GW}"
                                                            -c "filter reload" >/dev/null 2>&1

                                                            I can state the when dpinger was enabled, the router held an IP address, even though DNS did not work internally.

                                                            This allowed me to ssh into the machine and reboot.

                                                            Once I disabled dpinger, no IP address existed for the WAN.

                                                            Are you saying this is a coincidence?

                                                            1 Reply Last reply Reply Quote 0
                                                            • johnpoz
                                                              johnpoz LAYER 8 Global Moderator last edited by

                                                              None of that would have anything to do with dhcp lease renew..

                                                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                                                              If you get confused: Listen to the Music Play
                                                              Please don't Chat/PM me for help, unless mod related
                                                              2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                                                              1 Reply Last reply Reply Quote 0
                                                              • stephenw10
                                                                stephenw10 Netgate Administrator last edited by

                                                                Indeed the dhclient is independent of dpinger. Something it triggered may have restarted the dhclient perhaps but if it was able to pull a lease it would have done so anyway.

                                                                You said the rebooting the modem also allowed it to come back up. I would try simply pulling the WAN cable from either the modem or pfSense and reconnecting it. Does that also bring back the connection?

                                                                Are you running 2.4.4p3 now? It's possible you're hitting this: https://redmine.pfsense.org/issues/9267

                                                                That is fixed in current 2.5 snapshots if you're able to test one.

                                                                Steve

                                                                J 1 Reply Last reply Reply Quote 0
                                                                • J
                                                                  jacksnack2 @stephenw10 last edited by

                                                                  @stephenw10 Bug #9267 does give me hope in a resolution.

                                                                  I will look into this.

                                                                  Thank You.

                                                                  1 Reply Last reply Reply Quote 0
                                                                  • Derelict
                                                                    Derelict LAYER 8 Netgate last edited by

                                                                    That redmine does not seem to match. The packet capture is pretty clear. At least it seems pretty clear to me.

                                                                    Another test would be not rebooting anything and simply disconnecting the coax from the modem, letting it drop, and reconnecting it. That would eliminate any interface bounces unless the modem does one in that case.

                                                                    Chattanooga, Tennessee, USA
                                                                    The pfSense Book is free of charge!
                                                                    DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                                                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                                                    1 Reply Last reply Reply Quote 0
                                                                    • stephenw10
                                                                      stephenw10 Netgate Administrator last edited by

                                                                      Yes, you're right. In the case of that bug the client stops requesting a new lease but here it clearly continues. Ignore me! 🙄

                                                                      Steve

                                                                      1 Reply Last reply Reply Quote 0
                                                                      • J
                                                                        jacksnack2 last edited by jacksnack2

                                                                        https://redmine.pfsense.org/issues/9267
                                                                        "...DHCP timeout occurs and the cached gateway address is not pingable. This results in a case where the cached IP is removed from the interface, but dhclient is informed via the exit status of 0 that the IP was added successfully. As a result, the impacted interface remains without an IPv4 address..."

                                                                        Seems plausible this is the issue.

                                                                        Why remove the cached IP?

                                                                        1 Reply Last reply Reply Quote 0
                                                                        • Derelict
                                                                          Derelict LAYER 8 Netgate last edited by

                                                                          I have no doubt that might cause some people problems, but I don't see how it will make your modem stop responding to DHCPREQUEST/DHCPDISCOVER as it apparently does.

                                                                          Chattanooga, Tennessee, USA
                                                                          The pfSense Book is free of charge!
                                                                          DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                                                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                                                          1 Reply Last reply Reply Quote 0
                                                                          • K
                                                                            Kimberly3475 last edited by Kimberly3475

                                                                            What is happening when those ARP resolve messages start? You showed the end, what about the beginning? Is the MTU showing anything strange on the interface when it is not working?

                                                                            dpinger is trying to ping the gateway address but it cannot because it is not receiving an ARP response for it on WAN. Then it miraculously does for some reason. ttrockstars

                                                                            If it were me I'd packet capture for ARP on WAN and see what is happening. I'd just set interface WAN protocol ARP and a packet count of 100000 or 1000000 and let it run. Then get the times of the start and end of the can't allocate llinfo logs and see what's happening there in wireshark.

                                                                            J 1 Reply Last reply Reply Quote 0
                                                                            • J
                                                                              jacksnack2 @Kimberly3475 last edited by jacksnack2

                                                                              @Kimberly3475 Thanks.

                                                                              I will most likely start a packet capture in the next several weeks, as this is the time for the next event to occur.

                                                                              1 Reply Last reply Reply Quote 0
                                                                              • Derelict
                                                                                Derelict LAYER 8 Netgate last edited by Derelict

                                                                                I would run it on the command line and capture both DHCP and ARP.

                                                                                Something like this should work:

                                                                                1. Stop any running capture in the gui
                                                                                2. SSH or console in
                                                                                3. Menu option 8
                                                                                4. nohup /usr/sbin/tcpdump -i eth0 -c 1000000 -s 0 -w /root/packetcapture.cap arp or port 67 &
                                                                                5. exit

                                                                                eth0 needs to be your WAN interface (em0, igb1, etc). You can get that interface name from Status > Interfaces.

                                                                                You should be able to log out and the GUI should show the capture running there. Should be able to stop it and view it normally when the time comes.

                                                                                You might want to start one, let it soak, and stop it to see how much ARP there is out there. It might be a lot and will vary due to the design at the ISP. You might want to up that count to 10000000.

                                                                                Chattanooga, Tennessee, USA
                                                                                The pfSense Book is free of charge!
                                                                                DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                                                                                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                                                                J 1 Reply Last reply Reply Quote 0
                                                                                • J
                                                                                  jacksnack2 last edited by jacksnack2

                                                                                  @Derelict hello.

                                                                                  I am going to do exactly that, but may from a Linux box on the network via ssh.

                                                                                  I’ll post back when something comes up.

                                                                                  Thanks again for all the help.

                                                                                  1 Reply Last reply Reply Quote 0
                                                                                  • J
                                                                                    jacksnack2 @Derelict last edited by

                                                                                    @Derelict Thanks again for the reply.

                                                                                    However I think there is error in you command:

                                                                                    what does '1.' represent?

                                                                                    I ran this via ssh without the '1.'

                                                                                    ARP captures are brutal...filling the logs. Already at 554684. Is there anyway to minimize the captures to something more specific?

                                                                                    Thanks.

                                                                                    1 Reply Last reply Reply Quote 0
                                                                                    • First post
                                                                                      Last post