• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Random internet connection drops

Scheduled Pinned Locked Moved General pfSense Questions
18 Posts 4 Posters 1.7k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • J
    JohanÅ @Raffi_
    last edited by JohanÅ Aug 30, 2019, 2:27 PM Aug 30, 2019, 2:27 PM

    @Raffi_ Yes that's a typo, 87 % full of course :D Thanks for the advise, I change it to Google DNS :)

    1 Reply Last reply Reply Quote 1
    • R
      Raffi_
      last edited by Raffi_ Aug 30, 2019, 2:33 PM Aug 30, 2019, 2:32 PM

      If you have trouble again, try clearing your blocks tab (assuming legacy mode) in Suricata and then refresh the web page. If that immediately solves it, then you have to look into your rules to figure out what is triggering the block.

      J 1 Reply Last reply Aug 30, 2019, 3:20 PM Reply Quote 0
      • J
        JohanÅ @Raffi_
        last edited by Aug 30, 2019, 3:20 PM

        @Raffi_ My Suricata has been on blocking mode about 24 hours so that's not the problem. Will paste logs when the outage happens again!

        1 Reply Last reply Reply Quote 0
        • R
          Raffi_
          last edited by Aug 30, 2019, 3:22 PM

          Blocking is disabled in Suricata? It is only used for monitoring?

          J 1 Reply Last reply Aug 30, 2019, 3:23 PM Reply Quote 0
          • J
            JohanÅ @Raffi_
            last edited by Aug 30, 2019, 3:23 PM

            @Raffi_ It was only for monitoring, I collected logs to and viewed them in separate platform. But now it is in blocking mode, just configured it!

            1 Reply Last reply Reply Quote 0
            • R
              Raffi_
              last edited by Aug 30, 2019, 3:26 PM

              If you are having trouble loading sites. I would advise to disable blocking mode for now and go back to monitoring. Also, when you disable blocking, you still have to clear the blocks tab in order to allow that traffic to pass again.

              1 Reply Last reply Reply Quote 0
              • J
                JohanÅ
                last edited by JohanÅ Aug 31, 2019, 3:40 PM Aug 31, 2019, 3:38 PM

                I think that it happened again. Was playing playstation and tried to look someones profile and eventually playstation informed me that there is something wrong with DNS. Immediately went to Pfsense, took a glance at the logs and noticed that there are events like this:

                Aug 31 18:27:29 	unbound 	79372:0 	info: start of service (unbound 1.9.1).
                Aug 31 18:27:29 	unbound 	79372:0 	notice: init module 1: iterator
                Aug 31 18:27:29 	unbound 	79372:0 	notice: init module 0: validator
                Aug 31 18:27:07 	unbound 	79372:0 	notice: Restart of unbound 1.9.1.
                Aug 31 18:27:07 	unbound 	79372:0 	info: server stats for thread 3: requestlist max 2 avg 1 exceeded 0 jostled 0
                Aug 31 18:27:07 	unbound 	79372:0 	info: server stats for thread 3: 3 queries, 0 answers from cache, 3 recursions, 0 prefetch, 0 rejected by ip ratelimiting
                Aug 31 18:27:07 	unbound 	79372:0 	info: server stats for thread 2: requestlist max 2 avg 1 exceeded 0 jostled 0
                Aug 31 18:27:07 	unbound 	79372:0 	info: server stats for thread 2: 3 queries, 0 answers from cache, 3 recursions, 0 prefetch, 0 rejected by ip ratelimiting
                Aug 31 18:27:07 	unbound 	79372:0 	info: server stats for thread 1: requestlist max 2 avg 1 exceeded 0 jostled 0
                Aug 31 18:27:07 	unbound 	79372:0 	info: server stats for thread 1: 3 queries, 0 answers from cache, 3 recursions, 0 prefetch, 0 rejected by ip ratelimiting
                Aug 31 18:27:07 	unbound 	79372:0 	info: server stats for thread 0: requestlist max 0 avg 0 exceeded 0 jostled 0
                Aug 31 18:27:07 	unbound 	79372:0 	info: server stats for thread 0: 0 queries, 0 answers from cache, 0 recursions, 0 prefetch, 0 rejected by ip ratelimiting
                Aug 31 18:27:07 	unbound 	79372:0 	info: service stopped (unbound 1.9.1).
                Aug 31 18:27:07 	unbound 	79372:2 	info: generate keytag query _ta-4f66. NULL IN
                Aug 31 18:27:07 	unbound 	79372:0 	info: start of service (unbound 1.9.1).
                Aug 31 18:27:07 	unbound 	79372:0 	notice: init module 1: iterator
                Aug 31 18:27:07 	unbound 	79372:0 	notice: init module 0: validator
                Aug 31 18:26:45 	unbound 	79372:0 	notice: Restart of unbound 1.9.1.
                

                From DHCP logs I saw this

                Aug 31 18:26:45 	dhcpleases 		Sending HUP signal to dns daemon(79372)
                Aug 31 18:26:45 	dhcpleases 		Sending HUP signal to dns daemon(79372) 
                

                I googled it and based on that I unticked the option "Register DHCP leases in the DNS Resolver" from my router. I will see if that helps.

                1 Reply Last reply Reply Quote 1
                • S
                  stephenw10 Netgate Administrator
                  last edited by Aug 31, 2019, 5:04 PM

                  Hmm, 27s seems excessive for Unbound to restart. Do you have pfBlocker running with DNS-BL enabled and a lot of lists?

                  Steve

                  J 1 Reply Last reply Aug 31, 2019, 5:56 PM Reply Quote 0
                  • J
                    JohanÅ @stephenw10
                    last edited by Aug 31, 2019, 5:56 PM

                    @stephenw10 I do have quite a list on DNSBL.

                    1 Reply Last reply Reply Quote 0
                    • S
                      stephenw10 Netgate Administrator
                      last edited by Aug 31, 2019, 6:30 PM

                      Hmm, OK if it takes that long reloading then adding dhcp leases probably isn't a practical option. That is probably what you're hitting there.

                      Steve

                      1 Reply Last reply Reply Quote 1
                      • R
                        Raffi_
                        last edited by Sep 3, 2019, 12:47 PM

                        Good catch @JohanÅ ! Yea, I agree with Steve on this. The combination of large pfblocker lists and the register DHCP leases option in unbound has high potential for trouble. I had to disable DHCP registration in resolver also. Let us know how it goes.

                        1 Reply Last reply Reply Quote 0
                        18 out of 18
                        • First post
                          18/18
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                          This community forum collects and processes your personal information.
                          consent.not_received