Port Forwarding stopped working after upgrading to 2.8.0

[comet424]

@stephenw10
sorry i ment to get back to you yesterday

so.. if you mean if cloudflare is doing that woth home depot where it shows something wrong thats been going on for a year so i figured it was a vpn issue but when i transfered from nordvpn to pia vpn i still had that issue.. also if i search in google and goto home depot webpage it will load part of the page but it wont display like the prices or anything like that.. also have the same issue with Canadian Tire and some other sites.. i figured it was like a double nat thing or something..

2nd.. my pfsense locked me out again i added another log file to the link when i got back in 10 min after it locked me out well froze me out i wasnt able to ping 192.168.0.1 from the desktop couldnt ssh ... but i got the log file and saved it

but i could ssh in Unraid and i could ssh into pfsense no problem i tried the restart the php-frm that didnt do anything and i couldnt ping google.ca from the shell command but i could ping 1.1.1.1 but weird thing is i couldnt access from my desktop on the 192.168.0.49 ip yet my unraid is on 192.168.0.3 and i could ssh in.. so its like it buggers up the windows dns or whatever wierd but i forgot to test my vm ubuntu on the dmz 192.168.40.x

and i did get a chance to test it on the 8 core cpu gaming motherboard i had stuff to do and didnt get to test it to see if the comp is too slow

but to address your dns stuff

for 192.168.0.x i use 192.168.0.1 as dns
for my IOT 192.168.20.x dns 192.168.20.1
my camera network 192.168.10.x dns 192.168.10.1
my management ip network 192.168.30.x dns 192.168.30.1
my dmz network 192.168.40.x 192.168.40.1

now the management port network i disable the internet as i was having issue of files and internet working through it and not the 192.168.0.1 i use the management port network to be able to WAke on Lan as you cant wake on lan Fiber which some of my comps are 10g fiber network

so ya i ended up having to reboot pfsense just to get it working it seems if it stalls or kills php or so its basiclly useless it doesnt come back to working vpn or not vpn clients trying to reconnect my openvpn connections dont wanna re connect and if they do you cant ping crap.. but when you do a reboot its working again..

so i not sure if you can see anything from the logs but its getting frustrating tommorow for sure i going to run pfsense on my gaming comp to see if its crapping out on there too.. cuz its getting stupid like i dunno why DMZ network can access internet fine like home depot displays fine but LAN doesnt

and with the laptop if i connect to the LAN homedepot will give that error something wrong everytime or wont load pages right.. but you connect to the dmz side and it has no issues. as i was figuring it was just the desktop pc issues but no happens same way on 2 comps.. but basiclly my lan and DMZ use the same in the rules you see nothing special... unless the bypass routing is causing issues or of the pf blockNG and if it has to go after the routing bypass policy as i read that has to be first when splitting wan an vpn to go different routes..

sorry if i confusing too i have dyslexia so it sounds right in my head but may confuse people at times.. so bear with me too...

oh ya also i wasnt able to access 192.168.0.1 through firefox as a docker on unraid it locked out the gui but i was still able to ssh from unraid... but once i rebooted and such i could also gui pfsense from the firefox on the unraid.. its weird how i could ssh from unraid gui but not from windows cmd shell when it froze up or so.. like its a windows hater lol

[comet424]

i also figure maybe cuz of my 3mb/s internet connection where i supposed to get 5mbit on dsl when it maxes out and bad phone line i get that it stalls out and messes up pfsense and it just craps out pfsense

so that fiber 1gb cant come soon enough sometime between now and the end of the year as maybe it wont crash with the 1gb but that cant solve the home depot example i did thats gotta be something miss configured i got

[stephenw10]

@comet424 said in Port Forwarding stopped working after upgrading to 2.8.0:

so.. if you mean if cloudflare is doing that woth home depot where it shows something wrong

No I meant if you are testing connectivity against 1.1.1.1/1.0.0.1 that might have returned false failures yesterday because Cloudflare was having issues. But it could also have applied to cloudflare proxied sites.

@comet424 said in Port Forwarding stopped working after upgrading to 2.8.0:

but i could ssh in Unraid and i could ssh into pfsense no problem

You couldn't ssh into pfSense directly but you could ssh into Unraid and then ssh into pfSense from there?
That sounds more like either pfSense blocking your IP or you have some routing error or IP conflict perhaps.

[comet424]

@stephenw10 ah ok learn something new everyday

ya so on the desktop
i couldnt ssh i couldnt ping i couldnt gui the pfsense.. and the log file you can see i happened about 10 min from the end of that log file

but ya i could ssh from the desktop into unraid.. and then unraid ssh into pfsense and thats when i did the php-frm restart but that did nothing

then i tried Firefox a docker app i have in unraid and i wasnt able to gui the page it was still locked out.. it took 10 min before desktop could gui pfsense and firefox app under unraid could also but for 10 min couldnt

is there any routing i can look for do the rules and nat look ok
i gave up trying to install pfsense on my gaming comp.. pfsense is not compatible with Asus Tuf X570 i spent all day trouble shooting bios and everything it will not boot properly off usb.. i even tried installing pfsense on a HD from unraid set it up and plugged it in.. oh no craps right out..

yet i tried your nemis's opnsense oh it has no issues installing on Asus x570 tuf gaming motherboard... i figured it was usb issues so i tried 3 different 32gb usbs no still craps out mid running on the usb.. opnsense likes asus and pfsense hates asus... i even tried disabling network card in bios and pulled out my hba card and my 10gigtek nic and still wasnt able to install pfsnese it boots partially and then just locks up and gives you a prompt for keyboard panic mode

so i couldnt test out if a better processor would help..

in the 80s i struggled with token ring and dip switchs and coaxal networking and slow butt 1200 baud modem.. today i struggle OS doesnt install on a gaming

comp lol time sure flies

is the pfblockng ok to be before or after the routing policy does any of the rules look wrong.

here some cell phone screen caps cell sucks.. but i spent all day and just got fed up trying.. to try a different comp asus tuf x570 gaming 32 gig ram and i think its a 5600G cpu

[stephenw10]

That's a known issue with the upstream firmware API. See: https://redmine.pfsense.org/issues/16237

Pretty easy workaround shown there until it's fixed.

[comet424]

@stephenw10
ah ok i read that link i not sure how you disable what in the bios

ill give it a try tommorow
create a file
/boot/loader.conf.local

and place in it
hint.iwm.0.disabled="1"

and thats all i need to do ?
not sure how you interupt the boot proccess
and then you type
set hint.iwm.0.disabled="1"
boot

right now it locks up the comp when it boots so i ended up saying i had enough of it today and had a drink lol...

so is it a freebsd issue or is it a pfsense issue?

and i never got the routing to not stop crapping out desktop was locked out again. makes you wanna drink too lol

and is there a time frame when they fix it.. i guess the next release of pfsense 6 months down the road? but like 2.8.1 probablly

[stephenw10]

@comet424 said in Port Forwarding stopped working after upgrading to 2.8.0:

create a file
/boot/loader.conf.local

and place in it
hint.iwm.0.disabled="1"

and thats all i need to do ?

Yes. Do that in 2.7.2 before upgrading.

@comet424 said in Port Forwarding stopped working after upgrading to 2.8.0:

not sure how you interupt the boot proccess

When you see the loader menu with the 3 second countdown press ESC to reach the loader prompt:

    _ __  / _|___  ___ _ __  ___  ___      _                
   | '_ \| |_/ __|/ _ \ '_ \/ __|/ _ \   _| |_              
   | |_) |  _\__ \  __/ | | \__ \  __/  |_   _|             
   | .__/|_| |___/\___|_| |_|___/\___|    |_|               
   |_|                                                      
                                                            
                                                                              
 ╔════ Welcome to Netgate pfSense Plus ════╗      __________________________  
 ║                                         ║     /                       ___\ 
 ║  1. Boot Multi user [Enter]             ║    |                      /`     
 ║  2. Boot Single user                    ║    |                     /    :-|
 ║  3. Escape to loader prompt             ║    |      _________  ___/    /_ |
 ║  4. Reboot                              ║    |    /` ____   / /__    ___/ |
 ║  5. Cons: Serial                        ║    |   /  /   /  /    /   /     |
 ║                                         ║    |  /  /___/  /    /   /      |
 ║  Options:                               ║    | /   ______/    /   /  _    |
 ║  6. Kernel: default/kernel (1 of 1)     ║    |/   /          /   / _| |_  |
 ║  7. Boot Options                        ║        /          /___/ |_   _| |
 ║  8. Boot Environments                   ║       /                   |_|   |
 ║                                         ║      /_________________________/ 
 ║                                         ║                                  /
 ╚═════════════════════════════════════════╝
                                                                               
Exiting menu!


Type '?' for a list of commands, 'help' for more detailed help.
OK 

[comet424]

@stephenw10 i wish they explained it better like you did.. they so criptied like engineer writtings

so i having issues installing pfsense i setup the dhcp and it then checkjing for netgate servers but in the end it fails it cant detect any netgate servers to install pfsense

is netgate servers down to install pfsense... i wish you could just install it and not need to download it .. like a usb installer with pfsense 2.7.2 already on the usb or the 2.8.

i even tried shutting off my dsl modem.. for 20 min and also set in pfsense installer dns to 1.1.1.1 but it will not get past the netgate servers cant be fetched..
do you know if they down or so

i did find a iso of 2.7.2 so i got that installed on the gaming comp but i cant import the 2.8.0 configuration file into 2.7.2 so i guess ill have to wait till comp can update to 2.8.0 as there is no iso of 2.8.0 which sucks as it would help right now to get things back up and running

[comet424]

@stephenw10 so i got it installed and got the config file installed.. got 2.8.0 finally on the gaming comp with the hint file code

so i going to test if it locks up too
currently cpu says current 1700 max 3800mhz
16 cores but really 8 cores 8 hyperthreading
32 gig ram
realtek onboard card, and 10gtek network card.. i know realtek not supported but not like i can change onboard..

so going to test if i get the same lock outs of the php but im sure the routing issues like for canadian tire home depot where you only get those websites partial working is a routing issue.. is there anything i should be also looking for that the 192.168.40.x works but then 192.168.0.0 doesnt

and i appreciate your help so far

[stephenw10]

Cool. Yup there was a backend issue last night. It should be fixed now.

[comet424]

@stephenw10

so i been running pfsense on that gaming hardware and updated to 2.8.1 twice now.. i havent dared to try a usb installer to test if i still gotta do that set hint.iwm.0.disable="1" but i did do it from the updates ..

so running on the 8core 8 hyper threads but says 2 hardware threads, 32 gig ram .. at speed i dunno as it doesnt display the processor speed other comp says 1700 and max 3800 this is the ryzen 5700g

but so far testing the php stall or kill you mentioned that has seemed to be gone.. i currently running at a 0 to 2% cpu usage.. and with the serveral openvpns and the setup you see that seems to solved that .. i guess maybe that cpu 4 cores is just not powerful enough to handle 2.8 now 2.7 didnt seem to have that issue

ok the 2nd issue which i guess now my first issue lol.. but its that like going to home depot i site i get that smething went wrong... yet if i test on my dmz on a ubuntu works.. if i stick a windows 11 on the dmz it works and soemtimes doesnt work... if i plug the comp directly to the pppoe modem windows 11 can do the searchs fine on the windows 11
i been testing several days different ways

so
pppoe modem ---> dhcp ---> computer, home depot and like canadian tire search pages work
ppope modem ---> pppoe --->pfsense ---> lan behind or not behind vpn both home depot canadian tire search fails with the something went wrong
ppope modem ---> pppoe --->pfsense ---> dmz ubuntu works for both homedepot and canadian tire
ppope modem ---> pppoe --->pfsense ---> dmz windows 11 works for both homedepot and canadian tire but also fails to work

ppope modem ---> dhcp --->pfsense ---> same results above

so is this something like double natting issues that it works and doesnt work.. the modem has a dmz option i set it for pfsense but it still fails

can i do a comparable tests of ubuntu ip and windows 11 ip and see where its failing with the states or the routes..

as i even tried shutting off the modem for 30 min and rebooting pfsense and let it come back but i still run into that issue of its not processing the requests right... is there something wrong with my NAT settings ..

next test i going to do is just a factory reset of pfsense and just test the lan like factory setting of n o vlans no touching the nat just the default setup just to see if its something going wrong in my current setup that i cant find

and is there a bug in the traffic graph page.. if i choose hostname or Description it will display some names but mostly IP address even if the ip has a static ip set with a description
like
my unraid server is
hostname : Tardis
Description: Tardis - Unraid - Main Server
IP: 192.168.0.3

but when you set the display Hostname or Description it always shows 192.168.0.3 so wonder if there is a bug or something i need to set to fix it

[stephenw10]

Do you see the same dependency between Unbuntu and Windows if they are on LAN?

That sort of difference points to IPv6 often. One OS will default to trying to use it if it exists at all. pfSense may be advertising it if the ISP is passing IPv6.

The other thing I would check is packet sizes. An MTU/MSS issue can present like that. As a test try setting MSS on the LAN to something low like 1300. See if that allows the sites to load.

[comet424]

@stephenw10 not sure how to test for all those

and for the LAN Ubuntu and Windows depenency on the LAN.. i havent tested that just on the DMZ

but i also noticed something else.. so when my modem boggs down for a while i cant use my desktop via vpn or just lan doesnt use vpn

but dmz side works.. even though some of the LAN ips dont use vpn goes out the WAN like the DMZ so thats messed.. and usually i turn off the modem for 15 min and fixs itself but now it doesnt fix itself i seen this a few times

when i ping from pfsense ping and ping 1.1.1.1 or google.ca it doesnt work resetting states or rebooting the pfsense doesnt fix it.. so your not able to ping 1.1.1.1 through pfsense default is WAN for pfsense.. but i can go to like amazon.ca or ebay. on the ubuntu browswers on the DMZ...

so i then figured changing from pppoe to dhcp would solve this no doesnt... when i do a restore from last configuration... the openvpns work again the desktop works for internet.. pfsense can ping 1.1.1.1 or google.ca

is this also ip6 or is it something miss configured... or is it due to my modem is being maxed out like a highway fully conjested as its only like 3 megabit and its fully used... i know you might not seen this as everyone has faster internet then me.. but maybe you might know what this is...

and the MSS on the LAN i set to 1300 shoud i set it to the WAN connection too?

and should you disable IPv6 everywhere or is it something you want enabled? as i know when you do the vpns they always turn that off..

i also notice after a restore the internet works for a bit then 10 min in the pinging stops working in pfsense

so i know i got some weird issues... and ill do that factory test of 0 configurations as i think either its the modem how it works or massive gremlins...

[stephenw10]

Is that WAN 3Mbps both ways? That could certainly be getting filled entirely causing problems. If it is though you should see it in the traffic graphs.

You only need to set MSS at one place in the path so just on LAN should do it if it is an MTU issue.

[comet424]

@stephenw10
ok something glitched..

so ok,. my internet is 3megbit down and like 500kilobyte upload.. its like hooking up a dial up modem connection to pfsense

now currently whats messed up is every time i delete the nordvpn dns servers from the general settings... and pfsense cant ping except the monitor ip .. DMZ works no problem... the LAN IPs that use the WAN or the ppope that dont use vpn cant ping or anything vpn goes down...

now i did 2 tests... i Saved the configuration file with the 2 nordvpn dnss deleted and then i restored the configuration file after 10 min i let it sit the pfsense couldnt ping couldnt connect to PIA vpn but dmz worked fine..

so then i decided to restore the previous config i saved where it has the 2 extra dns nord vpns and boom internet works PIA connects.. but still cant use the home depot

ok reply here wont let me upload all my pics.. ugh tells me some rate limit error

so there is a log file
2 folders one with the nordvpn dns servers that works.. but if i restore without those 2 servers.. nothing works thats in the not working folder

now youll see i got 2 LAN rules one for * and other wan_ppoe i was trying 2 different ways to get internet to work.. but didnt help

youll probably say start from scratch.. i also going to test turning off 1 vpn as it looks like PIA doesnt offer fail over since i get the same ip address.. but going to test more..

but ya its frustrating with a slow internet connection... but here is the link

link text

in the mean time i going to try removing the 2nd PIA VPN just disable the interface.. save config file then restore with the nordvpns removed... as i cant tell what the heck is wrong... and in end probably need to restore 1 section at a time.. and or start from scratch

[comet424]

@stephenw10

so update i got fed up cuz i couldnt reconnect internet

so i did a factory reset.. and things didnt default right.. internet defaulted to LAN as a LANGW
whatever a langgw is...

but i set up the WAN to pppoe lan to 192.168.0.1 disabled the IP6

i got internet to work on the desktop and i got the home depot website to search properly.. thats at the default settings... so i guessing that has to be a NAT issue maybe but i guess ill try restoring 1 section at a time to see if i can narrow the problem from the config file.. and then re do the PIA VPN or so..

but ill get back to you... so least its not the computer that was disabling home depot website to work ... factory reset to LAN * that seems to be working

so ill update later also going to trial and error some stuff

[comet424]

i notice i cant import everything slowly from the backup and restore...

why isnt the user certs for the users and openvpn restored... only seems to restore from a ALL option same with static routes giving me error for not the right tag.. yet i importing each section 1 section at a time nad testing..

[stephenw10]

Restoring the full config is always the recommended way because only one section contains the config version.

With a 512Kbps upload it's going to be very easy to fill the available bandwidth creating latency and, potentially, packet loss.

I would guess the issues you're seeing are either due to the VPNs and associated routing or DNS. Or a combination since you' seems to be using VPN providers DNS servers.

What are you passing to DMZ clients for DNS? Is it different to LAN?

[comet424]

@stephenw10
ah ok ya i was hoping to import parts of the config like the gateway groups,, the authority certs and certs...

ya you can see my internet pretty slow...

so with the factory reset home depot works.. on tha LAN but i wasnt able to import certain ones. i think i narrowed it down to NAT page maybe one of those screen shots i sent tells you ive done it wrong.. like what is the 1::128 and such

but ok so for the DMZ i use 192.168.40.1 as the gateway and dns as the Vlan for is 40 so i do 192.168.40.x
and LAN uses 192.168.0.1 as DNS and Gateway
192.168.10.0 uses 192.168.10.1 for DNS and Gateway
and so on for 20 30 40 50 60 and i block the 30 gateway as i wanted my own impt i think it is port for management to be able to access network if the other network interface fails...

now the rules is the DMZ subbnets * * * *

im sure one of the NATS is probably causing the conflicts
so what i have in the NATS is one i have it set as Manual due to when setting up pia or nord in the past..

i did the openvpn be able to access the site to site network.. i had to add it as i was having issues with remote access to remote home assistant
then i did vpn ips use one of the 2 PIA interfaces
then i did rest of the lan use WAN interfaces
and then i did all my other vpns the IP private networks vlan 10 20 30 40 50 60 to use WAN interface
and i added the 192.168.0.0/24 to the WAN interface too as i was trying things
and i added the 127.0.0.0/8 and 1:128 and the 172.168.0.0/24 for the remote access to pfsense for openvpn and a few more WAN connections .. but i havent changed nothing from the nat screen shots from prior i posted...
so i figured i configure things correctly.. but im sure one of those is causing the issue..

i sure learning alot of different ways to import and configure...

[comet424]

at least i think its NAt unless its something else thats causing issues as when i factory reset the computer can search home depot but go back to previous config and i reboot the comp i cant search again... as if i dont do a reboot.. i guess it keeps the routes and that allows it to work... so i got some gremlin in here