Upgrade 2.5.2 to 2.6.0, upgrade success, Limiters not passing
-
Ok, let me think about that.
With pfSense I was doing just that for the many years. Maybe pfSense is less FreeBSD as I thought it was.
Scary situation, though, as the captive portal is a 'must have' for my usage.
Limiters, on the other hand, should be part of the standard toolkit of what a router firewall has to offer. -
I want to add a +1 as a new pfsense user, I've encountered this issue. I started chasing faulty hardware initially with no luck, but when working back through my changes I found that disabling either captive portal or the floating rules assigning limiters solved the issues I was seeing.
In my case, connected clients would start a speedtest and the test would go from 500mbps to 0, and then all connectivity stopped. This affected all clients and not just the captive portal ones, so I'm reasonably confident I'm affected by this regression too.
-
+1 here, i've same problem.
After upgrading 2.5.2 to 2.6.0 all machine seems hung..... some ping from local to firewall passes for few seconds...I've removed all limiters but nothing solved.. this firewall config had 20+ openvpn servers. I'll think there is something in routes that causes this problem... anyway i reinstalled 2.5.2 and it's all ok.
-
Do you have the captive portal enabled on any interface? If not then you're not hitting the issue discussed here.
-
Hi we are facing similar issues:
pFsense with about 140 interfaces. On one of them captive Portal is enabled.
WAN PPPoE Connection 1G.
Limiters with basic configuration, Tail Drop, default scheduler.
With 2.5.2. everything worked fine, upgrade to 2.6.0 with very odd problems, ping drops, ipv6 partially working, after applying interfaces they were working for a short time.Disabling limiters seems to solve the problems.
-
I've not captive portal only limiters and VLANs and many OpenVPN servers.
-
@blackangel84 You should start a new thread then unless there is already another thread with similar symptoms. You are not hitting the issue being discussed here.
-
G Gertjan referenced this topic on
-
G Gertjan referenced this topic on
-
@stephenw10 said in Upgrade 2.5.2 to 2.6.0, upgrade success, Limiters not passing:
https://redmine.pfsense.org/issues/12834
Good afternoon.
I have the same problem. As a test we create a new VLAN, we create new limits and the same thing happens, it does not have a WAN connection.
We remove the limits and this VLAN has an internet connection. It is difficult to understand how they perform an update to a stable version having these flaws.
If someone could solve this problem, it would be good to tell us how. Since in my case, the VLANS are intended for public Wi-Fi and need to be limited.
Greetings.
-
Do you have a captive portal enabled?
If so you are probably hitting that. You can still use the Limiters defined via the captive portal though.
Steve
-
L luckman212 referenced this topic on
-
So, I am actually experiencing this problem on 2.6.0 with limiters, without Captive Portal enabled. We were using Captive Portal a week ago, but we just switched over to using just RADIUS MAC authentication. I actually upgraded to 2.6.0 in the middle of the migration (that was a really poor choice as now I can't revert) and had to disable Captive Portal earlier than anticipated. I had tried the Captive Portal patch while we were still using Captive Portal, but that caused so much lag that I instantly reverted and didn't have time to do any further testing. After finishing the migration, I tried setting up limiters and found that they couldn't work without the Captive Portal patch either. I installed the patch again, and I was able to limit the downstream bandwidth for individual users (for some reason I can't get upstream limiters to work, but that is probably just a poor configuration on my part). When I enable the limiters, I start dropping tons of packets as soon as the link comes under load from my host (even with a very small load like a video game).
-
Check if ipfw is still active. Try running
ipfw showat the command line.
It should return an error. If if returns a list of ipfw rules then it's still active and Limiters cannot work correctly. If you have not rebooted since disabling the CP then do so.Steve
-
@stephenw10
'ipfw show' returns an error:
ipfw: retrieving config failed: Protocol not available
And I have definitely rebooted since disabling Captive Portal. That was certainly a good suggestion, though, as I have 100 users and try to reboot as seldom as possible. -
Hmm so how exactly do you have the Limiters configured?
I've not been able to replicate any issues as long as ipfw is not enabled.
-
@stephenw10
So, I did some more testing today and discovered that normal traffic over the limiters isn't causing any issues. It is actually only specific video games that are experiencing the issue. When I launch a multiplayer game of Heroes of the Storm with the limiters, my latency goes through the roof and I start dropping packets, but without the limiters, it works better, but with still some packet loss. However, I run a co-op vs AI game with the limiters enabled and I have no problems at all. I tried Overwatch, and a multiplayer game blows up my connection so badly that I get instantly disconnected, whether or not I have the limiters enabled. It looks like I am on the wrong thread, I apologize. I'll have to do some more research to figure out where I should actually be posting this. As of note, I didn't have this issue on 2.5.2 and I did the uPnP and latency spike patch at the same time as the captive portal patch. Sorry for not testing further earlier, Steve. -
No worries, thanks for confirming.
-
@destello Apologies if I missed it somewhere but may I ask what the latency spike patch is? I'm running 2.6.0 CE, bare metal, no captive portal, and getting terrible latency spikes and packet loss on heavy parallel downloads even when I limit to 12% or less of my downstream cap. I'd heard of the captive portal issue but your mention here is the first I recall seeing with respect to a latency spike patch. Thanks!
-
This, in the System Patches package:
Steve
-
Bingo!! Disable Limiters was the solution for me.
Where limiters are actives the ping to google.com crush every time but ping 8.8.8.8 answer without problem; with limiters disable ping to google and 8.8.8.8 are ok -
Test a 2.7 or 22.05 snapshot if you can. Limiters + Captive Portal is fixed there.
-
@stephenw10 Just to confirm, there is no System Patch to fix the Captive Portal/Limiter interaction on 22.01, the only option is to disable Captive Portal or upgrade to the Beta/Devel Branch of 22.05?
I couldn't see anything regarding this on the System Patches Package.
