pfSense cannot get WAN IP after reboot

[DaddyGo]

This is probably some kind of speed negotiation (Auto-negotiation) issue on the part of the modem. (ethernet controller to ethernet controller compatibility issue, the I350 doesn't usually have this problem)

As a result, the DHCP request does not get lease time.
When you unplug the cable, you interrupt the communication (such as a cold start), physically separate the two units, when you reconnect the default state is restored.

Anyway, these are just guesses as to what might happen
What matters is what you see in the DHCP log in this case..

what about that:

🔒 Log in to view

[PzrrL]

@DaddyGo said in pfSense cannot get WAN IP after reboot:

Anyway, these are just guesses as to what might happen
What matters is what you see in the DHCP log in this case..

So you mean I should provide the DHCP log?

what about that:

🔒 Log in to view

What do you mean sorry?

[DaddyGo]

@PzrrL

so no one can help if you don't provide log data as we don't know your system...
Like:

🔒 Log in to view

The Gateway Monitoring Daemon is important because it monitors the existence of your WAN connection

🔒 Log in to view

and

🔒 Log in to view

[PzrrL]

@DaddyGo

Thanks for your reply. Sorry I was not knowing which log should I provide. Here is the log of after rebooting, then wait for awhile then re plug the WAN cable.
igb3 is WAN, igb2 is LAN.

🔒 Log in to view
🔒 Log in to view

BTW may I know why your WAN RTT is so low? Mine is around 14-15ms which i think is quite high.

[DaddyGo]

there is more (T) in the log, let's go step by step

So, if you disconnect and reconnect, you get a lease this is the fact...
I am still thinking of a link speed - negotiation (Auto-negotiation), so please do this and see what happens (set WAN to 100baseTX full-duplex, because your modem eth. port offers this):

🔒 Log in to view

there are more things, what I wouldn't do on the LAN like this,
for example, if you have only few devices on your LAN network, set up DHCP Static mapping for all (it’s an older issue and I just suggest it)

for learning:
https://redmine.pfsense.org/issues/9383

PS: (you shouldn’t have edited the image so much

-it would have been easier for you to log, if you connected from static IP to pfSense box and nothing else, so there would be less data and we only scan the WAN

-broadcast addresses do not need to be obscured

[DaddyGo]

@PzrrL: BTW may I know why your WAN RTT is so low? Mine is around 14-15ms which i think is quite high.

(14 - 15 ms RTT is not bad, many would be happy about that........)

BTW - WAN RTT (really good):

-since this is an Altice Network GPON FTTH 1000/1000 (ISP)
-a purely CloudFlare setting, almost everywhere.... + ExpressVPN
-the data center is located two blocks away from my place (this is the most important)
-and a pretty serious Supermicro Epyc 3151MOBO on which I built pfSense + Intel I350-F4

🔒 Log in to view

[PzrrL]

@DaddyGo said in pfSense cannot get WAN IP after reboot:

there is more (T) in the log, let's go step by step

What is this (T)?

So, if you disconnect and reconnect, you get a lease this is the fact...
I am still thinking of a link speed - negotiation (Auto-negotiation), so please do this and see what happens (set WAN to 100baseTX full-duplex, because your modem eth. port offers this):

Will get back to you and see if it works.

there are more things, what I wouldn't do on the LAN like this,
for example, if you have only few devices on your LAN network, set up DHCP Static mapping for all (it’s an older issue and I just suggest it)

I am actually setting up DHCP Static mapping for my devices, but still tracing which one is which. And btw I see there is a static ARP setting provided. After some research, I don't still get the use of static ARP. Does it means that only device without setting a static IP and its MAC address is in my table, will be able to connect to my LAN?

PS: (you shouldn’t have edited the image so much

-it would have been easier for you to log, if you connected from static IP to pfSense box and nothing else, so there would be less data and we only scan the WAN

Sorry for that. I am stilling setting up the static DHCP.

[PzrrL]

@DaddyGo

No wonder you got a good RTT with all these combined. So you use 1.1.1.1 as your DNS server (without DNS resolver), plus ExpressVPN? So why don't you use ExpressVPN's DNS?

[DaddyGo]

@PzrrL
slang: T = thing

DHCP Static Mapping = useful for few devices therefore (old thing):
https://forum.netgate.com/topic/115482/frequent-unbound-restarts

I am very interested in this WAN DHCP issue so i will be waiting for your results!!! (this is also an old topic, for a long time I was investigating a DOCSIS cable modem was the problem)

and this is necessary:

🔒 Log in to view

use the ARPWATCH package for tracking

[DaddyGo]

@PzrrL No wonder you got a good RTT with all these combined. So you use 1.1.1.1 as your DNS server (without DNS resolver), plus ExpressVPN? So why don't you use ExpressVPN's DNS?

for greater safety:

-DNS resolv. is slightly slower via ExpVPN DNS
-and otherwise I use DoT (DNS over TLS) + DNSSEC (Unbound), this is not provided by ExpVPN

this is the configuration:

🔒 Log in to view

🔒 Log in to view

🔒 Log in to view

so, finally:

in principle, CloudFlare stores DNS logs for 1 day and does not analyze ...
Who knows?
Is it better, if ExpVPN to store logs? / Who knows?
so at least DoT and DNSSEC work

[PzrrL]

@DaddyGo said in pfSense cannot get WAN IP after reboot:

I do have around 20-30 devices, so is it still a good idea to make all of the recognized devices static? Cuz I am planning on segregate IoT /Guest devices to another VLAN (not familiar with it), so I think I might possible to keep only reserved devices on LAN, and others goes to IoT VLAN.

and this is necessary:

🔒 Log in to view

use the ARPWATCH package for tracking

May I know where can I find this setting? And tracking of what? I know what is DHCP Static mapping, like mapping devices to my desired IP. But what about ARP?

[PzrrL]

@DaddyGo said in pfSense cannot get WAN IP after reboot:

this is the configuration:

Thanks for letting me know. Will try replicate it HAHA. Since my setup was up only few days ago (though I did research for months already), I am still working on it and adding more "features" on it.

And I thought people generally use DNS resolver on pfSense instead of 3rd parties.

[PzrrL]

@DaddyGo Great news I brought you (and to myself)! set WAN to 100baseTX full-duplex works! Thanks!!!! But what is the reason behind?

[DaddyGo]

What I wrote above is that the different ethernet controllers (chip) (one is the modem eth. port the other is the pfSense WAN port) can't match the link speed properly, since I have seen that when it works you are on 100base, so you should be forced the WAN port not to use the Auto-negotiation.

@PzrrL PzrrL
"And I thought people generally use DNS resolver on pfSense instead of 3rd parties"

with this I too have experimented a lot over the years and all my systems are built that way
so I can control everything and in the greatest security I think

You know (privacy is a myth):

🔒 Log in to view

@PzrrL
May I know where can I find this setting?

🔒 Log in to view

[PzrrL]

@DaddyGo said in pfSense cannot get WAN IP after reboot:

and this is necessary:

🔒 Log in to view

use the ARPWATCH package for tracking

Do you usually turn this on or off then?

[PzrrL]

@DaddyGo Really huge thanks to you, thank you!

[DaddyGo]

@PzrrL Do you usually turn this on or off then?
for a static entry always on

[NinthWave]

@daddygo I have the same problem but my pfSense is running in Proxmox. I have a 30 Mbs connexion and the only option I have in the interface config is 10baseT.

Any option ?

🔒 Log in to view

[NinthWave]

@ninthwave
Is there a way to use pastebin ?

https://imgur.com/i7GsbW0

[Gertjan]

@ninthwave said in pfSense cannot get WAN IP after reboot:

Is there a way to use pastebin ?

There is a way.

If this forum complains about the URL, do the 'smart' thing :

https: slash slash pastebin dot com/cMNrLnjC