pfSense keeps disconnecting/reconnecting in UniFi Controller

johnpoz · Aug 28, 2021, 6:18 PM

And if you get say a constant ping going from something in that vlan to the pfsense IP in that guest or lan... Does it not do it? Do pings fail?

dragonfire1119 · Aug 28, 2021, 9:06 PM

@johnpoz I've set up a ping test on my mac for a day and no packet loss.

johnpoz · Aug 29, 2021, 2:10 AM

@dragonfire1119 and while you were pinging - did it still say it disconnected?

dragonfire1119 · Aug 30, 2021, 3:52 PM

@johnpoz Yes, it did.

johnpoz · Aug 30, 2021, 4:03 PM

@dragonfire1119 so you never lost a ping, yet the controller was saying that IP was disconnected?

Hmmm that is strange.. What really need to understand is how unifi determines if something is disconnected or not. The only way I could see it doing it for something that is not wireless is mac address in the table..

One theory is arp table on controller, or whatever table it uses for clients is only updated on arps? So its quite possible for arp table on device to be longer than controller, so while the client knows where to send the pings, it doesn't have to arp for X minutes. But controller looses this entry when its table expires and doesn't refresh until it sees an arp again.

My switch should be here today.. Atleast then I will have a way to try and duplicate your problem. I will see if I can find any info/doc on how exactly unifi determines if something is disconnected.

NGUSER6947 · Aug 30, 2021, 4:21 PM

I have a Netgate SG-1100 -> Unifi Switch -> Unifi AP

No problems. I'd arrange in the same order I have and see if that resolves the issue.

dragonfire1119 · Aug 30, 2021, 4:40 PM

@johnpoz I'm noticing my Echo's are disconnecting when the event happens with it showing disconnected from the Netgate. Not sure if this issue is why I'm having music streaming issues going in and out then it completely stops sometimes.

With the Unifi I'm guessing if the LAN disconnects it disconnects my VLAN Networks since the LAN is the main Network?

I'm using the DHCP server on Netgate all Unifi uses are Switches and AP's and gets all ip's from Netgate.

johnpoz · Aug 30, 2021, 4:46 PM

@dragonfire1119 said in pfSense keeps disconnecting/reconnecting in UniFi Controller:

With the Unifi I'm guessing if the LAN disconnects it disconnects my VLAN Networks since the LAN is the main Network?

Thought you never lost a ping? Then it wasn't actually disconnected - how could it have been if you didn't loose a ping? Was the disconnection less then 1 second and happened inbetween pings? That seems highly unlikely.. especially if you had multiple disconnects.

dragonfire1119 · Aug 30, 2021, 5:17 PM

@johnpoz I checked ping on my Macbook Pro over two nights and never lost a packet. When I'm surfing on the web sometimes google will just load and load until I disconnect then reconnect and it's fine again.

I can't test ping on my echo's but they're giving me problems not sure if it's WiFi or something else. We have had the Wifi working just fine for a year but that was without the fiber service we have now. I've factory reset the echo's nothing has really helped them disconnecting or dropping out on music streaming.

I'm trying to diagnose things but I'm not sure if these messages are to do with any of these issues that I'm having? I haven't gotten a clear reason why these messages even show up from Ubiquiti and my own research.

When these disconnects are happening this Netgate forum comes up on the bottom right and says something about Network error? This message on the bottom right doesn't stay for long though it's around just a second. Looks like it can't connect to the WebSocket/polling server on the Network tab.

I'm getting 900s directly off the Netgate so it's not my ISP.

I set up ping tests on my Home Assistant and it hasn't gone down but that's directly hard wired on my switch.

Update:

These are the new things that I have changed on the Network since our new internet:

Removed the UDM Pro
Changed over to using Raspberry PI 4+ 8GB for the Unifi Controller.
Hooked up the Netgate XG-1541 to the Unifi 48 Port Switch.
Added VLANs for Guest Network and IOT Network with isolating those from the Main Network.

dragonfire1119 · Aug 30, 2021, 6:44 PM

@johnpoz I noticed another thing that happens in the Netgate logs it's blocking my WAN IP for abuse 1.

Aug 30 13:31:59 sshguard	84939	Blocking "(My IP)" for 160 secs (1 attacks in 0 secs, after 1 abuses over 0 secs.)
Aug 30 13:31:59	sshguard	84939	Attack from "(My IP)" on service SSH with danger 10.
Aug 30 13:31:59	sshd	84405	Did not receive identification string from (My IP) port 46863

This is happening right around the time. I'm not sure why this happens since I'm new to Netgate? ntopng is fine on the flows.

johnpoz · Aug 30, 2021, 6:54 PM

Its blocking your lan IP? Why are you trying to login to ssh without sending the correct info?

I can generate those on the fly by trying to connect to ssh from a box on my network - but I have public key auth setup

Aug 30 13:52:35 	sshguard 	81488 	Attack from "192.168.2.12" on service SSH with danger 2.
Aug 30 13:52:35 	sshd 	83302 	Connection closed by authenticating user root 192.168.2.12 port 34882 [preauth]
Aug 30 13:52:34 	sshguard 	81488 	Attack from "192.168.2.12" on service SSH with danger 2.
Aug 30 13:52:34 	sshd 	82979 	Connection closed by authenticating user root 192.168.2.12 port 34880 [preauth]
Aug 30 13:52:32 	sshguard 	81488 	Attack from "192.168.2.12" on service SSH with danger 2.
Aug 30 13:52:32 	sshd 	82701 	Connection closed by authenticating user root 192.168.2.12 port 34878 [preauth]
Aug 30 13:52:30 	sshguard 	81488 	Attack from "192.168.2.12" on service SSH with danger 2.
Aug 30 13:52:30 	sshd 	82337 	Connection closed by authenticating user root 192.168.2.12 port 34876 [preauth]
Aug 30 13:52:26 	sshguard 	81488 	Attack from "192.168.2.12" on service SSH with danger 2.
Aug 30 13:52:26 	sshd 	80674 	Connection closed by authenticating user root 192.168.2.12 port 34874 [preauth]

root@192.168.2.253: Permission denied (publickey).
root@NewUC:/home/user# ssh 192.168.2.253
root@192.168.2.253: Permission denied (publickey).
root@NewUC:/home/user# ssh 192.168.2.253
root@192.168.2.253: Permission denied (publickey).
root@NewUC:/home/user# ssh 192.168.2.253
root@192.168.2.253: Permission denied (publickey).
root@NewUC:/home/user# ssh 192.168.2.253
root@192.168.2.253: Permission denied (publickey).
root@NewUC:/home/user#

dragonfire1119 · Aug 30, 2021, 7:03 PM

@johnpoz No, it's blocking my static WAN IP.

I had an issue in the beginning with the ISP and they were being attacked and I finally got to a level 2 he moved me to a different GPON and static IP. Because the NTOPNG was saying my ISP was a flow flooder. I thought the attack was gone but I'm not sure if it's gone or just gotten smarter and getting around the NTOPNG flow log.

This SSH request is coming from my ISP because the (My IP) is my WAN IP.

You got me thinking about if there is anything in the logs. The Unifi Controller is reporting right that it's disconnecting.

I've gone and looked at the logs when my echo's drop streaming and the forum shows me the red box down on the bottom right and sure enough, Netgate is saying it blocked my WAN IP again.

Do you think I'm on the right track?

I really appreciate your help on this.

johnpoz · Aug 30, 2021, 7:02 PM

@dragonfire1119 said in pfSense keeps disconnecting/reconnecting in UniFi Controller:

This SSH request is coming from my ISP because the (My IP) is my WAN IP.

Huh?? Why would pfsense try talking to itself.. That makes no sense.. Your saying the IP that is being blocked is the IP that pfsense shows for its wan?

dragonfire1119 · Aug 30, 2021, 7:03 PM

@johnpoz Yes correct.

johnpoz · Aug 30, 2021, 7:05 PM

Off the top of my head I know of nothing in pfsense that would be talking to itself on ssh.. From itself?

What packages are you running?

dragonfire1119 · Aug 30, 2021, 7:08 PM

@johnpoz here is a list of my packages installed and uninstalled:

aws-wizard
bandwidth
ipsec-profile-wizard
Netgate_Firmware_Upgrade
ntopng
Zabbix (Uninstalled though)

johnpoz · Aug 30, 2021, 7:08 PM

@dragonfire1119 ntopng does have the ability to do monitoring - that could be doing it??? I have not played with ntop in along time..

Turn if off for testing - does your problem go away.. Do the sshguard lockouts go away.

Zabbix would also be able to do monitoring.. But you say that is uninstalled.

dragonfire1119 · Aug 30, 2021, 7:10 PM

@johnpoz I just disabled it and monitoring it.

bingo600 · Aug 30, 2021, 7:13 PM

@johnpoz
I have ntopng + zabbix agent installed.
Have never seen any strange ssh.

/Bingo

johnpoz · Aug 30, 2021, 7:27 PM

@bingo600 yeah I have no idea why something would try and ssh to itself from its own IP? But ntop does have the ability to active monitor.. Atleast the full current version does - not sure about the package version in pfsense.

Not sure if ssh was available as one of the things to check? I know like icmp, ping, http, etc was..