DNS resolver exiting when loading pfblocker 25.03.b.20250409.2208
-
@stephenw10 said in DNS resolver exiting when loading pfblocker 25.03.b.20250409.2208:
OK try this. It should apply against the June 10th 25.03 build.
Applied and testing.
2025-06-17 08:48:44.587745+01:00 php-fpm 64902 System Patches: Patch applied successfully (ID: 685080088725a, DESCR: PPPoE IPv6 RA Changes 685080088725a for 25.03.b.20250610.1659)Well, presuming 'applied successfully' means no reboot required?
️ -
Yup you shouldn't need a reboot there. The scripts get run at interface events and will have changed after applying the patch.
-
Probably this is not related to the current patch, ... I think this issue has been present since the early 23.05 versions, but I’ve only recently started to understand what’s going on. Sometimes, but not always, when PPPoE disconnects and reconnects, I receive an IPv6 address on the WAN interface, but nothing is assigned on the LAN interface, which is configured as a track interface. After some time, the IPv6 address on the WAN interface also disappears. I’ll try to collect logs later.
-
-
@RobbieTT said in DNS resolver exiting when loading pfblocker 25.03.b.20250409.2208:
net.inet6.ip6.rfc6204w3
Hmm, does it reflected in pfSense GUI somewhere? I don't have this option at all when listing sysctl net.inet6.ip6, I can add it via tunables anyway, but…
-
Check it at the command line:
[2.8.0-RELEASE][admin@t70.stevew.lan]/root: sysctl -d net.inet6.ip6.rfc6204w3 net.inet6.ip6.rfc6204w3: Accept the default router list from ICMPv6 RA messages even when packet forwarding is enabled [2.8.0-RELEASE][admin@t70.stevew.lan]/root: sysctl net.inet6.ip6.rfc6204w3 net.inet6.ip6.rfc6204w3: 1It should be
1by default. You'll only see it in the tunables list if it's been added as a custom value. -
@stephenw10
Now I havenet.inet6.ip6.rfc6204w3=1Nothing has changed. Manually disconnecting and reconnecting can result in no IPv6 on WAN, or IPv6 being present on both WAN and LAN, and sometimes it initially appears on WAN but disappears from WAN later.
I am not sure it pfSense, it can be my ISP. I see nothing helpful in the logs currently.
BTW, sometimes the uptime is also missing, and clients have no internet access — they cannot ping external sites by name or IP, also directly can not ping from pfSense. However, I can resolve names using DNS lookup on the pfSense, so Unbound is somehow working. But when I check the routes, it looks like the default route is missing — there is no 0.0.0.0 route at all.
This is happening often when playing manual disconnect and connect after.
-
Ok well that seem unrealted to IPv6 or Unbound so it should probably be in a different thread.
However I would check the output of
pppcfg pppoe0when that happens. It looks like it's not connecting at all. -
@stephenw10 said in DNS resolver exiting when loading pfblocker 25.03.b.20250409.2208:
It looks like it's not connecting at all.
I don't think so. You can see gateway status on the screenshot and pppoe0 is in routes list, but not default.
@stephenw10 said in DNS resolver exiting when loading pfblocker 25.03.b.20250409.2208:
Ok well that seem unrealted to IPv6 or Unbound so it should probably be in a different thread.
Sure. I think I will do further tests on weekend or when it's possible and post back in another thread.
-
Hmm, but it shows no IP address against the pppoe gateway and the RTT at 0.5ms seems too low to be real.
If you're using if_pppoe it will show an uptime if it's really connected.
-
@stephenw10 said in DNS resolver exiting when loading pfblocker 25.03.b.20250409.2208:
Nice. More fixes are incoming for various things.
The latest IPv6 RA patch has had no adverse consequences on my test setup.
Relative trivia but a very easy thing to fix with the 'various things':
2025-06-18 08:34:03.000000+01:00 nginx - 2025/06/18 08:34:03 [error] 333#100367: *9037 open() "/usr/local/www/apple-touch-icon.png" failed (2: No such file or directory), client: 2a02:xxx:xxxx:1:xxxx:xxxx:xxxx:b6bd, server: , request: "GET /apple-touch-icon.png HTTP/2.0", host: "router-7.xxxxxxx.me:8443" 2025-06-18 08:34:03.000000+01:00 nginx - 2025/06/18 08:34:03 [error] 333#100367: *9037 open() "/usr/local/www/apple-touch-icon-precomposed.png" failed (2: No such file or directory), client: 2a02:xxx:xxxx:1:xxxx:xxxx:xxxx:b6bd, server: , request: "GET /apple-touch-icon-precomposed.png HTTP/2.0", host: "router-7.xxxxxxx.me:8443"️ -
What are you accessing from to generate those?
-
-
@stephenw10 said in DNS resolver exiting when loading pfblocker 25.03.b.20250409.2208:
What are you accessing from to generate those?
Just from a Mac.
The files exist on pfSense but are down a level in a sub-directory, rather than the usual location.
️ -
I don't see those specifically only:
[2.8.0-RELEASE][root@m370.stevew.lan]/root: ls -ls /usr/local/www/apple-touch/ total 26 5 -rw-r--r-- 1 root wheel 3669 May 20 15:25 apple-touch-icon-ipad-76x76-precomposed.png 9 -rw-r--r-- 1 root wheel 7260 May 20 15:25 apple-touch-icon-ipad-retina-152x152-precomposed.png 5 -rw-r--r-- 1 root wheel 2965 May 20 15:25 apple-touch-icon-iphone-60x60-precomposed.png 9 -rw-r--r-- 1 root wheel 5640 May 20 15:25 apple-touch-icon-iphone-retina-120x120-precomposed.pngSo those requests are from Safari in MacOS?
-
It expects to find the png files in this directory:
/root: ls /usr/local/www/ 404.html services_checkip_edit.php 50x.html services_dhcp.php android-chrome-192x192.png services_dhcp_edit.php android-chrome-512x512.png services_dhcp_relay.php apple-touch services_dhcp_settings.php [/snip]The Android/Chrome pngs are there but the Apple equivalents
apple-touch-icon.pngandapple-touch-icon-precomposed.pngare not, so it triggers the error in the logs. As you note, the iPhone and iPad pngs are in theapple-touchsub-directory.️ -
Right so seems like something missing that's (relatively) new. I asked internally since I don't run MacOS.
-
You are seeing this specifically when using Safari? We can't replicate that here so far. Everything we've tested just uses the correct path specified in the meta data.
-
OK we manage to replicate it. Weird that most things don't hit it. Digging....
-
@stephenw10 said in DNS resolver exiting when loading pfblocker 25.03.b.20250409.2208:
OK we manage to replicate it. Weird that most things don't hit it. Digging....
Good effort and yes, noticed the issue with Safari.
️
