pfSense cannot get WAN IP after reboot

PzrrL · May 28, 2020, 6:53 AM

pfSense 2.4.5-RELEASE, a VM running on UnRAID.
Passthrough an NIC (INTEL I350-T4v2)
My Setup: Modem -> pfSense -> Switch -> Other devices

It works fine all the time, until I reboot. No matter if I reboot from the Web GUI or restart the VM, I am having the same problem.

After restart, these are what I got:
login-to-view

login-to-view

I do have a LAN interface, but it is not shown in the photo above.

I need to unplug and plug in the cable from modem to WAN port every time after restarting in order to let the pfSense to get a WAN IP. Can anyone please give me some advice on this? I don't want to do the plugging every time after restart. Cheers.

DaddyGo · May 28, 2020, 9:03 AM

This is probably some kind of speed negotiation (Auto-negotiation) issue on the part of the modem. (ethernet controller to ethernet controller compatibility issue, the I350 doesn't usually have this problem)

As a result, the DHCP request does not get lease time.
When you unplug the cable, you interrupt the communication (such as a cold start), physically separate the two units, when you reconnect the default state is restored.

Anyway, these are just guesses as to what might happen
What matters is what you see in the DHCP log in this case..

what about that:

login-to-view

PzrrL · May 28, 2020, 9:18 AM

@DaddyGo said in pfSense cannot get WAN IP after reboot:

Anyway, these are just guesses as to what might happen
What matters is what you see in the DHCP log in this case..

So you mean I should provide the DHCP log?

what about that:

login-to-view

What do you mean sorry?

DaddyGo · May 28, 2020, 9:46 AM

@PzrrL

so no one can help if you don't provide log data as we don't know your system...
Like:

login-to-view

The Gateway Monitoring Daemon is important because it monitors the existence of your WAN connection

login-to-view

and

login-to-view

PzrrL · May 28, 2020, 1:32 PM

@DaddyGo

Thanks for your reply. Sorry I was not knowing which log should I provide. Here is the log of after rebooting, then wait for awhile then re plug the WAN cable.
igb3 is WAN, igb2 is LAN.

login-to-view
login-to-view

BTW may I know why your WAN RTT is so low? Mine is around 14-15ms which i think is quite high.

DaddyGo · May 28, 2020, 2:29 PM

there is more (T) in the log, let's go step by step

So, if you disconnect and reconnect, you get a lease this is the fact...
I am still thinking of a link speed - negotiation (Auto-negotiation), so please do this and see what happens (set WAN to 100baseTX full-duplex, because your modem eth. port offers this):

login-to-view

there are more things, what I wouldn't do on the LAN like this,
for example, if you have only few devices on your LAN network, set up DHCP Static mapping for all (it’s an older issue and I just suggest it)

for learning:
https://redmine.pfsense.org/issues/9383

PS: (you shouldn’t have edited the image so much

-it would have been easier for you to log, if you connected from static IP to pfSense box and nothing else, so there would be less data and we only scan the WAN

-broadcast addresses do not need to be obscured

DaddyGo · May 28, 2020, 2:46 PM

@PzrrL: BTW may I know why your WAN RTT is so low? Mine is around 14-15ms which i think is quite high.

(14 - 15 ms RTT is not bad, many would be happy about that........)

BTW - WAN RTT (really good):

-since this is an Altice Network GPON FTTH 1000/1000 (ISP)
-a purely CloudFlare setting, almost everywhere.... + ExpressVPN
-the data center is located two blocks away from my place (this is the most important)
-and a pretty serious Supermicro Epyc 3151MOBO on which I built pfSense + Intel I350-F4

login-to-view

PzrrL · May 28, 2020, 4:36 PM

@DaddyGo said in pfSense cannot get WAN IP after reboot:

there is more (T) in the log, let's go step by step

What is this (T)?

So, if you disconnect and reconnect, you get a lease this is the fact...
I am still thinking of a link speed - negotiation (Auto-negotiation), so please do this and see what happens (set WAN to 100baseTX full-duplex, because your modem eth. port offers this):

Will get back to you and see if it works.

there are more things, what I wouldn't do on the LAN like this,
for example, if you have only few devices on your LAN network, set up DHCP Static mapping for all (it’s an older issue and I just suggest it)

I am actually setting up DHCP Static mapping for my devices, but still tracing which one is which. And btw I see there is a static ARP setting provided. After some research, I don't still get the use of static ARP. Does it means that only device without setting a static IP and its MAC address is in my table, will be able to connect to my LAN?

PS: (you shouldn’t have edited the image so much

-it would have been easier for you to log, if you connected from static IP to pfSense box and nothing else, so there would be less data and we only scan the WAN

Sorry for that. I am stilling setting up the static DHCP.

PzrrL · May 28, 2020, 4:38 PM

@DaddyGo

No wonder you got a good RTT with all these combined. So you use 1.1.1.1 as your DNS server (without DNS resolver), plus ExpressVPN? So why don't you use ExpressVPN's DNS?

DaddyGo · May 28, 2020, 5:31 PM

@PzrrL
slang: T = thing

DHCP Static Mapping = useful for few devices therefore (old thing):
https://forum.netgate.com/topic/115482/frequent-unbound-restarts

I am very interested in this WAN DHCP issue so i will be waiting for your results!!! (this is also an old topic, for a long time I was investigating a DOCSIS cable modem was the problem)

and this is necessary:

login-to-view

use the ARPWATCH package for tracking

DaddyGo · May 28, 2020, 5:35 PM

@PzrrL No wonder you got a good RTT with all these combined. So you use 1.1.1.1 as your DNS server (without DNS resolver), plus ExpressVPN? So why don't you use ExpressVPN's DNS?

for greater safety:

-DNS resolv. is slightly slower via ExpVPN DNS
-and otherwise I use DoT (DNS over TLS) + DNSSEC (Unbound), this is not provided by ExpVPN

this is the configuration:

login-to-view

so, finally:

in principle, CloudFlare stores DNS logs for 1 day and does not analyze ...
Who knows?
Is it better, if ExpVPN to store logs? / Who knows?
so at least DoT and DNSSEC work

PzrrL · May 28, 2020, 5:52 PM

@DaddyGo said in pfSense cannot get WAN IP after reboot:

I do have around 20-30 devices, so is it still a good idea to make all of the recognized devices static? Cuz I am planning on segregate IoT /Guest devices to another VLAN (not familiar with it), so I think I might possible to keep only reserved devices on LAN, and others goes to IoT VLAN.

and this is necessary:

login-to-view

use the ARPWATCH package for tracking

May I know where can I find this setting? And tracking of what? I know what is DHCP Static mapping, like mapping devices to my desired IP. But what about ARP?

PzrrL · May 28, 2020, 5:57 PM

@DaddyGo said in pfSense cannot get WAN IP after reboot:

this is the configuration:

Thanks for letting me know. Will try replicate it HAHA. Since my setup was up only few days ago (though I did research for months already), I am still working on it and adding more "features" on it.

And I thought people generally use DNS resolver on pfSense instead of 3rd parties.

PzrrL · May 28, 2020, 6:04 PM

@DaddyGo Great news I brought you (and to myself)! set WAN to 100baseTX full-duplex works! Thanks!!!! But what is the reason behind?

DaddyGo · May 28, 2020, 6:34 PM

What I wrote above is that the different ethernet controllers (chip) (one is the modem eth. port the other is the pfSense WAN port) can't match the link speed properly, since I have seen that when it works you are on 100base, so you should be forced the WAN port not to use the Auto-negotiation.

@PzrrL PzrrL
"And I thought people generally use DNS resolver on pfSense instead of 3rd parties"

with this I too have experimented a lot over the years and all my systems are built that way
so I can control everything and in the greatest security I think

You know (privacy is a myth):

login-to-view

@PzrrL
May I know where can I find this setting?

login-to-view

PzrrL · May 28, 2020, 6:38 PM

@DaddyGo said in pfSense cannot get WAN IP after reboot:

and this is necessary:

login-to-view

use the ARPWATCH package for tracking

Do you usually turn this on or off then?

PzrrL · May 28, 2020, 6:40 PM

@DaddyGo Really huge thanks to you, thank you!

DaddyGo · May 28, 2020, 6:46 PM

@PzrrL Do you usually turn this on or off then?
for a static entry always on

NinthWave · Sep 26, 2021, 7:54 PM

@daddygo I have the same problem but my pfSense is running in Proxmox. I have a 30 Mbs connexion and the only option I have in the interface config is 10baseT.

Any option ?

login-to-view

NinthWave · Sep 26, 2021, 8:15 PM

@ninthwave
Is there a way to use pastebin ?

https://imgur.com/i7GsbW0