Question - Issue w/Power Cycle WAN Access & Randomly Resetting LAN Conn.
-
Background
- I'm on 23.01 release
- WAN is 2 Gb AT&T fiber
- BGW320 modem
- Custom PC for pfsense; shared dual SFP+ NIC; AMD Ryzen 5 2400G; 1 package(s) x 4 core(s) x 2 hardware threads; AES-NI CPU Crypto: Yes (active); QAT Crypto: No
TL:DR Version
- System power cycles
- It comes back online, flags both WAN/LAN interfaces as active and green; has WAN IP; re-established LAN side DHCP leases (IPV4)
- Problem #01: Nothing can get out from LAN to WAN; pfsense can ping out to WAN
What would one expect to cause this?
- Problem #02: Irrespective of PC, anything on wired LAN >1 Gb loses / cycles connection randomly; causes breaks in VM connections, or online game sessions dropping; if I stay on WiFi (which has 2.5 Gb wired to pfsense over same routers) no issue
Any thoughts there?
NOTE: All of the above only seemed to start around the time of my change from pfsense community to plus, when I upgraded my internet speed/modem
What I've Tried
- At first I thought it was a WAN side; so, I'd unplug/replug and/or reboot WAN modem & pfsense; it seemed to work at first then stopped
- Second, I noticed certain key routers (all Mikrotik; on latest SWoS) were showing as inactive for static DHCP; ping them from pfsense, and that seemed to find them as active again and seemed to work, then stopped
- Most recently I tried clearing ARP table and all DHCP leases; that seems to be resolving
What I Think I Should Do
-
I think I should set reboot functionality to force a pause of say 120 seconds so other systems can come online, then continue with reboot so ARP/DHCP leases are refreshed post their reboot cycle; or,
-
After reboot, force clear all ARP/DHCP to be cleared/reset
The question is, can either of the above be done, and how? Do you think they would resolve?
Other Things I Am Doing to Prevent
- I will be reworking the core network infra to be in a cabinet w/UPS
- NOTE: All other network infra will not be on UPS
-
You can add a boot delay in /boot/loader.conf.local (create that file) like:
autoboot_delay="120"
But you shouldn't have to. That's really only used for problematic WAN side modems.If the firewall can connect out to remote sites from the cli but LAN clients connot it's probably a firewall rule or NAT issue at that point.
If the firewall can only reach the gateway and nothing beyond it's probably a missing default route. Make the sure the WAN gateway is set as default and not automatic in System > Routing > Gateways.
What do you do to restore access from the LAN when this happens?
Steve
