pfSense 2.6 issues

Jaltus

@stephenw10
After upgrade of master, everything is ok.
After review screenshot of number in pfsync node, PF was not well synchronize before upgrade.

Thanks a lot for your help

KpuCko

Hmmm, to be honest I really don't know where to start...

Ok, let's not complain about some missing files, probably this can be ignored safely, but - DEINSTALL script failed, IMO is a problem, because I expect to have some left overs from the last stable version, anyway.

The device rebooted successfully, so I had a hope, unfortunately my hope disappeared almost immediately when I logged to the dashboard, I started getting errors:

When I checked the logs I saw such errors appear over and over again:

/rc.filter_configure_sync: The command '/sbin/pfctl -Of /tmp/rules.limits' returned exit code '1', the output was 'pfctl: DIOCSETSYNCOOKIES'

This made me a bit angry, I really got angry when I noticed that I'm unable to go to the internet anymore. The appliance is able to connect to the Internet, but all of the networks are unable, so this is a problem in the core firewall function.... really sad

Beside that I also noticed that my CPU hardware crypto support simply disappeared:

Then with non working production firewall, I had no choices - I decided to go back to the old version. When I went to update tab and selected the old stable branch, the check said - you are using newer version, so no way back, really?!!

My last option was to try to go upper - 2.7.0-devel but I just wanted to see if the issues about the internet has fixed. Well, not really:

There were error(s) loading the rules: pfctl: pfctl_rules - The line in question reads [0]: @ 2022-03-19 16:11:15

stephenw10

Those errors during the upgrade are expected and not an issue.

Re-installing is the only (supported) way to go back to 2.5.2.

What is in /tmp/rules.limits though?

Steve

KpuCko

@stephenw10 I don't know, and can't check because I already reverted back to 2.5.2

I suppose it is something related to pfBlockerNG but who knows.

I tried to remove the package, but this haven't resolved the issue.

stephenw10

What's in the file 2.5.2 then?

I'm not aware of anything than would have changed there but you might have something obscure set.

Steve

KpuCko

@stephenw10 said in pfSense 2.6 issues:

What's in the file 2.5.2 then?

I'm not aware of anything than would have changed there but you might have something obscure set.

Steve

stephenw10

Did you set that state table size or just have a lot of ram?

KpuCko

@stephenw10 said in pfSense 2.6 issues:

Did you set that state table size or just have a lot of ram?

I have 16g of ram

KpuCko

So guys, how to make it more official?
I mean, look at the big post I have created, I have few issues mentioned in there.

Do I need to file a bug report, or as I'm a free user, someone else has to do that?

stephenw10

Anyone can open a bug report: https://redmine.pfsense.org/

We need clear steps to recreate it though and I don't think we have that yet. I've updated numerous devices from 2.5.2 to 2.6 and never hit this and I don't see and other reports of it. There must be something unusual in your ruleset that it hitting an issue.

Can we see your ruleset? (/tmp/rules.debug)

If not can you generate another ruleset that still hits this?

Are you using any obscure features?

Steve

KpuCko

@stephenw10 I have sent to you the needed information via PM

FirewallProblemsOops

I posted in the Limiter thread, but that thread has taken on a life of its own, and is rightly focused only on the limiter issue.

There seems to be a problem in 2.6 and the 2.7 developmental versions, where I only connect to addresses 50% of the time.

I changed nothing in my configuration from 2.5.2 to 2.6 / 2.7(trying these currently, same problem). Pretty straightforward, NO connection limiters, simple ruleset for the Firewall, using DNS Forwarder to OpenDNS.

My Firewall has the pfB_BinaryDefense and pfB_EmergingThreatsDShield lists ( from https://linuxincluded.com/using-pfblockerng-on-pfsense/ ) but obviously basic sites like duckduckgo.com aren't in there, yet my computers on the 2.6/2.7 PFSense box fail around 50% of the time to such basic commercial websites.

I have the Bogon network rule block, WAN to PFsense block, WAN telnet to Pfsense block rules, and that's pretty much it. LAN side, the anti-lockout rule, and a basic block DNS attempts that aren't to PFsense(and thus forwarded to OpenDNS) rule.

Another 2.5.2 box running with the same config, in the same house, with the same ISP obviously, has no issues at all.

These configs have worked through multiple version of PFSense up until 2.6, and the issue persists in the 2.7 developmental versions.

Thanks, any help would be appreciated.

stephenw10

How does it fail? What error do you see?

Are you able to resolve the sites every time?

Are you able to connect in other ways such as ping them reliably?

Steve

FirewallProblemsOops

@stephenw10 said in pfSense 2.6 issues:

How does it fail? What error do you see?

Are you able to resolve the sites every time?

Are you able to connect in other ways such as ping them reliably?

Steve

Using Firefox browser for example, getting this error message:

"Hmm. We’re having trouble finding that site.

We can’t connect to the server at www.tyrrellscrisps.co.uk.

If that address is correct, here are three other things you can try:

Try again later.
Check your network connection.
If you are connected but behind a firewall, check that Firefox has permission to access the Web. "

When I try again/Reload/Refresh, it works, so the site itself is not down. This happens for any major site seemingly at random.

Also noticeable inside services such as Steam, half the page won't load, etc. while other portions load fine. Reloading resolves it usually.

I do not have any Captive Portal or Limiters active, this isn't even through WiFi via FreeRadius3 account, just ethernet cables connected to the PFsense box. Windows 10 machine, a Mint Linux machine, both have the same issue, around 50% connections fail to major websites, but can be reloaded to connect.

And as I said, the configuration has not changed since 2.5.2, where this was working fine, now 2.6 and whatever the current 2.7 snapshot is, both have the DNS failure/blocking issue.

EDIT I am able to ping most sites, not noticing any failures via PING, except to duckduckgo.com ironically which seems to block ping by default. Disclaimer I did not do an extensive test of pinging 300+ sites or anything, a random 20 or so of major websites responded 4 out of 4 pings.

meluvalli

@mohkhalifa
Hello. I upgraded pfSense from 2.5.2. I have pfSense running in Hyper-V machine. For some reason, now my vhdx (virtual hard disk file) keeps growing non stop.

Is this a known issue or is there a setting that got changed that causes this? I tried installing on a fresh VM and restoring my config, but get same result.

When I setup the machine as fresh install, it starts out at 1.5GB image. I have ran it for 24 hours and now it's 5GB and growing.

This didn't happen with previous versions. Largest my image got was about 3GB.

Any idea what could be causing the change?

stephenw10

@firewallproblemsoops said in pfSense 2.6 issues:

When I try again/Reload/Refresh, it works, so the site itself is not down

That sounds a lot like what happens if you have IPv6 addresses but no connectivity. Is that possible? Not sure why anything would have changed going to 2.6 though.
Do you see anything blocked in the firewall logs?

Steve

stephenw10

@meluvalli That's not a known issue. You should start a new thread in the Virtualisation section.

meluvalli

@stephenw10
Thanks.

Found others with the same issue. :) They found a band-aid for it.
https://forum.netgate.com/topic/170992/solved-high-disk-usage-on-hyper-v/4

FirewallProblemsOops

@stephenw10 said in pfSense 2.6 issues:

@firewallproblemsoops said in pfSense 2.6 issues:

When I try again/Reload/Refresh, it works, so the site itself is not down

That sounds a lot like what happens if you have IPv6 addresses but no connectivity. Is that possible? Not sure why anything would have changed going to 2.6 though.
Do you see anything blocked in the firewall logs?

Steve

My Pfsense 2.7 box had, from previous configs in 2.5.2 and prior, Deny All IPv6 in System/Advanced/Network/ set to Deny. In case that was a new issue in 2.6 and 2.7, I checked that box to allow IPv6 traffic; still getting the same problem:

Tried to load wikipedia's main page, failed the first time, then reloading I could get to it.

Pinging wikipedia:

ping www.wikipedia.org

Pinging dyna.wikimedia.org [208.80.154.224] with 32 bytes of data:
Reply from 208.80.154.224: bytes=32 time=29ms TTL=53
Reply from 208.80.154.224: bytes=32 time=28ms TTL=53
Reply from 208.80.154.224: bytes=32 time=29ms TTL=53
Reply from 208.80.154.224: bytes=32 time=29ms TTL=53

Ping statistics for 208.80.154.224:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 28ms, Maximum = 29ms, Average = 28ms

No issues, I looked for any blocks in the firewall for 208.80.154.224, or anything even close to that, nothing at all in the firewall for that IP, let alone anything for about a minute around the time I tried to open wikipedia.org via Firefox.

stephenw10

Try running a packet capture whilst you try to open something. See where the actual failure is.