Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Despite months of config, still having connection issues

    Scheduled Pinned Locked Moved General pfSense Questions
    29 Posts 6 Posters 2.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      rheritier
      last edited by

      Hello everybody,

      I have been trying to use my Netgate SG-2100 for months now and despite ALL my efforts, I still can't have it work properly, with main issues being:

      • App on clients not working, such as Netflix
      • App on clients not loading pictures, such as Amazon app
      • Website very slow
      • Squid Proxy Server increasing these issues

      So 1st...I have NO knowledge in network so barely can type a line of command...apology for that! But I'm a fast learner and very motivated....it helps!

      My system is extremely simple: firewall SG-2100 connected to my ISP directly on WAN and a LINKSYS VELOP mesh connected on LAN to the Netgate. I then have 5 more Velop Mesh connected by Wifi in the house.

      I've been said "it's a DNS issue"..."it's a firewall rule issue" and "it's a DHCP issue".
      Search lot of solution, tried them and nothing solve it.

      I even resetted my Netgate with a USB and the files from Netgate Support team to start from scratch (but actually, I realized that despite this new installation on the netgate, some settings were still here!) and followed all Netgate Troubleshouting installation videos but it's still not working.

      I also created ACL rules in the Squid Server puting *.com *.net etc. hoping it would "open" everything and limit non-working App and Website...but it didn't help much (maybe a little bit?).

      Any ideas??? If so, could you kindly ask me what to do and be exhaustive in how to do it (=step by step for dummies) since as I said before, that I don't know anything at all this!

      Thanks a lot in advance!

      S JonathanLeeJ NollipfSenseN 3 Replies Last reply Reply Quote 0
      • S
        SteveITS Galactic Empire @rheritier
        last edited by

        @rheritier I would start by removing complexity…if you’re not a network guru why have a proxy server? Btw note Netgate recommends an SSD for Squid : https://www.netgate.com/supported-pfsense-plus-packages. I’ve never used it but I assume that’s for the logging or caching.

        Run “Ping -n 1800 8.8.4.4” to ping Google for half an hour and see if any packets are lost. Also “ping -n 1800 pfsense_LAN_IP” at the same time to check between your PC and pfSense.

        Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
        When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
        Upvote 👍 helpful posts!

        R 1 Reply Last reply Reply Quote 1
        • JonathanLeeJ
          JonathanLee @rheritier
          last edited by

          @rheritier

          This is my favorite how to for Squid and Squidguard.

          I recommend you only use transparent mode so you don't need certificates to make it easier.

          This guide covers certificates however.
          https://forum.it-monkey.net/index.php?topic=23.0

          Make sure to upvote

          R 1 Reply Last reply Reply Quote 0
          • R
            rheritier @SteveITS
            last edited by

            @SteveITS Hi Steve,

            I'm pretty new at this but want to learn!
            I did the pings (from the Diagnostic/Command Prompt) and got:

            Shell Output - Ping -n 1800 8.8.4.4
            sh: Ping: not found

            Note that I use 1.1.1.1 and 1.0.0.1 (is it why it can't ping google?)

            Shell Output - ping -n 1800 pfsense 192.168.1.1
            usage:
            ping [-4AaDdfHnoQqRrv] [-C pcp] [-c count] [-G sweepmaxsize]
            [-g sweepminsize] [-h sweepincrsize] [-i wait] [-l preload]
            [-M mask | time] [-m ttl] [-P policy] [-p pattern] [-S src_addr]
            [-s packetsize] [-t timeout] [-W waittime] [-z tos] IPv4-host
            ping [-4AaDdfHLnoQqRrv] [-C pcp] [-c count] [-I iface] [-i wait]
            [-l preload] [-M mask | time] [-m ttl] [-P policy] [-p pattern]
            [-S src_addr] [-s packetsize] [-T ttl] [-t timeout] [-W waittime]
            [-z tos] IPv4-mcast-group
            ping [-6AaDdfHnNoOquvyY] [-b bufsiz] [-c count] [-e gateway]
            [-I interface] [-i wait] [-k addrtype] [-l preload] [-m hoplimit]
            [-p pattern] [-P policy] [-S sourceaddr] [-s packetsize] [-t timeout]
            [-W waittime] [-z tclass] [IPv6-hops ...] IPv6-host

            Not sure what I am doing incorrectly...

            stephenw10S S 2 Replies Last reply Reply Quote 0
            • R
              rheritier @JonathanLee
              last edited by

              @JonathanLee Thanks Jonathan for the link!

              I see it's from 2017, and both Pfsense and Squid have changed a lot. I'm a bit worried to try and be stuck since the options are now very different...

              JonathanLeeJ 1 Reply Last reply Reply Quote 0
              • NollipfSenseN
                NollipfSense @rheritier
                last edited by

                @rheritier said in Despite months of config, still having connection issues:

                So 1st...I have NO knowledge in network so barely can type a line of command...apology for that!

                No apology needed; however, I agree with SteveTS to remain with as simple as possible until you start acquiring network knowledge by hanging out here...we all had to do that...

                pfSense+ 23.09 Lenovo Thinkcentre M93P SFF Quadcore i7 dual Raid-ZFS 128GB-SSD 32GB-RAM PCI-Intel i350-t4 NIC, -Intel QAT 8950.
                pfSense+ 23.09 VM-Proxmox, Dell Precision Xeon-W2155 Nvme 500GB-ZFS 128GB-RAM PCIe-Intel i350-t4, Intel QAT-8950, P-cloud.

                1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator @rheritier
                  last edited by

                  @rheritier said in Despite months of config, still having connection issues:

                  Shell Output - Ping -n 1800 8.8.4.4
                  sh: Ping: not found

                  Note that I use 1.1.1.1 and 1.0.0.1 (is it why it can't ping google?)

                  The ping command, like everything in FreeBSD and hence pfSense, is case sensitive. So if you're running that in pfSense you need to use ping.

                  It fails the second time because -n is a Windows switch. You have to use -c in pfSense. So to run that command from pfSense you would use:
                  ping -c 1800 8.8.4.4

                  However you would need to run that at the command line dircetly not using Diag > Command Prompt in the webgui. It will take 30mins to return and the page will time out before that if you try to run it through the gui.

                  I would add that pfSense already pings out continually and logs the results in a nice graph. See Status > Monitoring > Quality graph. You can set the IP it's monitoring to be 8.8.4.4 and you will see any packet loss.

                  Steve

                  1 Reply Last reply Reply Quote 0
                  • S
                    SteveITS Galactic Empire @rheritier
                    last edited by

                    @rheritier I meant, run that from something behind pfSense like your PC.

                    Packet loss is when packets of data are sent but not received. Indicative of bad wiring, bad equipment, overworked equipment, saturated connection, etc.

                    Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                    When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                    Upvote 👍 helpful posts!

                    1 Reply Last reply Reply Quote 1
                    • JonathanLeeJ
                      JonathanLee @rheritier
                      last edited by

                      @rheritier said in Despite months of config, still having connection issues:

                      @JonathanLee Thanks Jonathan for the link!

                      I see it's from 2017, and both Pfsense and Squid have changed a lot. I'm a bit worried to try and be stuck since the options are now very different...

                      All the configuration options are the same just better code today.

                      Make sure to upvote

                      R 1 Reply Last reply Reply Quote 0
                      • R
                        rheritier
                        last edited by

                        Thanks so much @NollipfSense, @stephenw10, @SteveITS for your responses.

                        I'm learning and improving slowly but would like to first have something stable before entering into too much complexity, so I'm really to try to setup a very straight forward system, using the firewall with Squid.

                        Steve, thanks for the feedback, really appreciate you take the time to explain (today, another good learn about case sensitive!).
                        I pinged from the terminal and didn't have any loss so far (it's been 10min).

                        Here is what I have on the monitoring:

                        Screen Shot 2023-09-22 at 9.54.22 AM.png

                        S 1 Reply Last reply Reply Quote 0
                        • S
                          SteveITS Galactic Empire @rheritier
                          last edited by

                          @rheritier Click the wrench at the top and change to Quality:

                          2d1f155c-e195-45ff-a55b-41c15c09726e-image.png

                          Packet loss was just a guess/starting point. You could also disable Squid temporarily, and any other packages that are installed. If you're not plugged directly in to the 2100 it could also be unstable wireless.

                          Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                          When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                          Upvote 👍 helpful posts!

                          R 1 Reply Last reply Reply Quote 0
                          • R
                            rheritier @JonathanLee
                            last edited by

                            @JonathanLee OK! I'll try that then!
                            I'll probably reset my netgate to start from scratch.

                            JonathanLeeJ R 2 Replies Last reply Reply Quote 0
                            • JonathanLeeJ
                              JonathanLee @rheritier
                              last edited by

                              @rheritier remember to simple first, do only transparent mode. Make sure you have the correct ACL for DNS, HTTP, https etc also.

                              Good luck.

                              Make sure to upvote

                              1 Reply Last reply Reply Quote 0
                              • R
                                rheritier @SteveITS
                                last edited by

                                @SteveITS Here it is!
                                Yes, someone told me wifi was an issue and to hardwire my meshs but where they are located make hardwire impossible.
                                But I still have the same issues even when I only keep 1 mesh on, which is hardwired on the Netgate...

                                Here is the result of the quality:

                                Screen Shot 2023-09-22 at 10.18.31 AM.png

                                1 Reply Last reply Reply Quote 0
                                • R
                                  rheritier @rheritier
                                  last edited by

                                  @JonathanLee Thanks Jonathan

                                  I'll start with transparent mode.
                                  On the ACL, should putting what I have below helps limiting the system blocking some websites? (example: *.com to leave all website in .com accessible)?
                                  I need to learn more about the DNS and its configuration also.

                                  Screen Shot 2023-09-22 at 10.22.58 AM.png

                                  JonathanLeeJ 1 Reply Last reply Reply Quote 0
                                  • JonathanLeeJ
                                    JonathanLee @rheritier
                                    last edited by JonathanLee

                                    @rheritier I just have that set as .* for allow all. Squidguard does my blocking

                                    Keep it simple

                                    Screenshot_20230922-072758.png
                                    Regular expression based works great

                                    Make sure to upvote

                                    1 Reply Last reply Reply Quote 0
                                    • R
                                      rheritier
                                      last edited by

                                      Thanks @JonathanLee, I like that!!
                                      Will try it now

                                      JonathanLeeJ 1 Reply Last reply Reply Quote 0
                                      • JonathanLeeJ
                                        JonathanLee @rheritier
                                        last edited by JonathanLee

                                        @rheritier

                                        https://docs.netgate.com/pfsense/en/latest/recipes/http-client-proxy-transparent.html
                                        really good transparent mode guide

                                        https://docs.netgate.com/pfsense/en/latest/packages/cache-proxy/squidguard.html
                                        squidguard guide

                                        Make sure to upvote

                                        1 Reply Last reply Reply Quote 0
                                        • R
                                          rheritier
                                          last edited by

                                          So I did everything so far and it seem it is a bit smoother and block less things.
                                          But I still have for example difficult access to Amazon App. I have to deselect the wifi, let it charge a bit, reselect the Wifi and then it'll work propertly.

                                          Here is the screenshot of my Firewall block. Anyone sees something specific??

                                          Screenshot 2023-09-22 134602.png

                                          JonathanLeeJ 1 Reply Last reply Reply Quote 0
                                          • JonathanLeeJ
                                            JonathanLee @rheritier
                                            last edited by

                                            @rheritier do you have any IPv6 access?

                                            Make sure to upvote

                                            R 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.