Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login
    Introducing Netgate Nexus: Multi-Instance Management at Your Fingertips.

    pfsense reports zero IPv4 packets passed outbound on WAN interface (Status > Traffic Graph / pfctl -s info) - loginterface stuck on LAN, not WAN - healthy traffic

    Scheduled Pinned Locked Moved webGUI
    2 Posts 1 Posters 1.2k Views 1 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T Offline
      therealmaxidude
      last edited by therealmaxidude

      Title:
      pfSense Version: 2.8.1-RELEASE (CE)

      Platform: Virtualized under Proxmox VE, virtio NICs (vtnet0 = WAN, vtnet1 = LAN), WAN and LAN on separate OVS bridges (different physical port per bridge)

      Summary:
      pfctl -s info only shows vtnet1 and the Status > Traffic Graph dashboard widget consistently show 0 WAN packets passed outbound, while real outbound traffic is flowing normally (general LAN browsing/downloads/uploads, all perform at full expected throughput).

      Details:
      pfctl -s info always reports "Interface Stats for vtnet1" (my LAN interface), regardless of whether -i vtnet0 is passed — -i appears to have no effect on which interface's summary stats are shown.
      grep loginterface /tmp/rules.debug shows set loginterface vtnet1, even though:

      Interfaces > Assignments correctly shows vtnet0 = WAN, vtnet1 = LAN.
      System > Routing > Gateways has defaultgw4/defaultgw6 correctly set to the WAN-side gateways (WAN_DHCP / WAN_DHCP6, both interface: wan in config.xml).
      The Status > Traffic Graph widget config (<traffic_graphs><if>wan</if>) is correctly set to WAN.
      Dashboard widget traffic_graphs filter is unrelated (filtered to opt1/opt2 VLANs only).

      A full Diagnostics > Filter Reload ("Reload Filter") was performed — set loginterface vtnet1 persists afterward.
      A full reboot of both the pfSense VM and the Proxmox host was performed — issue persists.
      LAN interface IPv4 "Packets Out Passed" stays at exactly 0 indefinitely (verified across multiple uptime windows from 15 minutes to 38+ days), while "Packets Out Blocked" climbs normally (background WAN noise / scans hitting default-deny). IPv4 "Packets In Passed" increments normally.
      Real throughput, confirmed via general LAN up/download, is fully healthy with no observed bottleneck.

      Expected behavior: loginterface should resolve to the WAN interface (vtnet0) per the configured default gateway / WAN assignment, matching documented pf behavior, so that pfctl -s info and the Traffic Graph widget reflect WAN throughput as intended.
      Actual behavior: loginterface is pinned to the LAN interface (vtnet1), causing the Traffic Graph widget and pfctl -s info summary stats to misreport, despite no config pointing to LAN for this purpose.

      Impact:
      Cosmetic/reporting only — confirmed no impact on actual data path performance via iperf3 and standard usage testing.

      Steps to reproduce: Not yet isolated to a specific trigger; Happy to provide full pfctl -vvsr ruleset dump or sanitized config.xml on request.

      Any help greatly appreciated.

      1 Reply Last reply Reply Quote 0
      • T Offline
        therealmaxidude
        last edited by

        nevermind, seems to be caused by snort/suricata active on the WAN interface with inline IPS mode

        1 Reply Last reply Reply Quote 0
        • First post
          Last post
        Copyright 2026 Rubicon Communications LLC (Netgate). All rights reserved.