pfSense keeps disconnecting/reconnecting in UniFi Controller

johnpoz

@dragonfire1119 said in pfSense keeps disconnecting/reconnecting in UniFi Controller:

This SSH request is coming from my ISP because the (My IP) is my WAN IP.

Huh?? Why would pfsense try talking to itself.. That makes no sense.. Your saying the IP that is being blocked is the IP that pfsense shows for its wan?

dragonfire1119

@johnpoz Yes correct.

johnpoz

Off the top of my head I know of nothing in pfsense that would be talking to itself on ssh.. From itself?

What packages are you running?

dragonfire1119

@johnpoz here is a list of my packages installed and uninstalled:

aws-wizard
bandwidth
ipsec-profile-wizard
Netgate_Firmware_Upgrade
ntopng
Zabbix (Uninstalled though)

johnpoz

@dragonfire1119 ntopng does have the ability to do monitoring - that could be doing it??? I have not played with ntop in along time..

Turn if off for testing - does your problem go away.. Do the sshguard lockouts go away.

Zabbix would also be able to do monitoring.. But you say that is uninstalled.

dragonfire1119

@johnpoz I just disabled it and monitoring it.

bingo600

@johnpoz
I have ntopng + zabbix agent installed.
Have never seen any strange ssh.

/Bingo

johnpoz

@bingo600 yeah I have no idea why something would try and ssh to itself from its own IP? But ntop does have the ability to active monitor.. Atleast the full current version does - not sure about the package version in pfsense.

Not sure if ssh was available as one of the things to check? I know like icmp, ping, http, etc was..

dragonfire1119

@johnpoz Been monitoring it no more logs with blocking so far. We're getting better speeds and 4 ms ping now.

bingo600

@johnpoz

If something from the inside tried to ssh to the "outside/wan"
Would it be natt'ed to the wan first ?

So that wan ssh's wan

If it was comming from real wan (spoof) , then i'd hope the packets would be blocked , and not getting a "ban"

/Bingo

johnpoz

@bingo600 said in pfSense keeps disconnecting/reconnecting in UniFi Controller:

Would it be natt'ed to the wan first ?

No..

I just hit my wan IP from lan side IP, as you can see the state is showing the lan side rfc1918 address.

dragonfire1119

@johnpoz It's been working and I'm streaming music now without interruption or static. So if this stays like this it was the NTOPNG being analyzed as an attacker for some reason. Is there any way to whitelist NTOPNG?

Update: The Unifi Messages have stopped saying disconnected from Netgate.

johnpoz

Well when you have some time, we can re-enable it and go over the settings and see what could be causing the issue.

I will have to fire it up and refresh my memory on its features.. Use to use it all the time, outside of pfsense back in the day.. But never really needed it on home network..

edit: switch just got here - man is that tiny! ;)

mcury

@johnpoz man, that is a nice beer =)

dragonfire1119

@johnpoz wow, that thing is tiny! I don't think that one has POE or anything?

johnpoz

@mcury hehe not really my fav, but its very drinkable on a hot day that is for sure. It was on sale a few days back, $8 for a 12er - limit 2, so got 2.. And yeah have to sport the correct glassware..

Needed something to compare with scale, and didn't have a banana handy - hehehe.. Some of you sure will get that joke. If you hang out on the net you will.

johnpoz

@dragonfire1119 No it can be powered by poe, but no doesn't output any poe.. Will hook it up in the morning to the controller. But damn the thing is tiny..

I could see how they could be handy - especially in a place where you might have some equipment but not any extra power outlets because you can power the thing via poe.

edit: Well got it adopted and updated its firmware. It sees pfsense on the vlan its currently on.. And it sees the mac of switch its connected my sg300-28

johnpoz

Ok - switch has been online for a few hours now.. Since last night. And am seeing these disconnection notices.. This doesn't make a lot of sense.. Clearly the switch didn't freaking go down.. And if the connection did go down - then where is the notification that pfsense went down? They are connected via the same wire, the uplink to my sg300-28

Ok I think this is related to the "trunk" or all profile.. It is seeing the sg300 internal mac.. And this is most likely being seen on both "networks" from unifi point of view.. Is so that is just shit show on unifi part. Going to change the port on sg300 back to access with only 1 untagged vlan being sent to the unifi switch and see if these go away..

Ok switched at say 9:17 - lets see if see any more of those disconnects after that timestamp

stephenw10

Yeah it has to be the same MAC address appearing in different segments.

johnpoz

@stephenw10 yeah - what a shit show from unifi.. Its only been like 15 minutes, but since I changed to only send 1 vlan (untagged) down that link no more alerts.