pfsense network problem
-
Hello—on pfSense, whenever the internet connection drops, the connection on the LAN side drops as well. In other words, we would like to be able to access our applications via the local network even if there is no internet connectivity, but the system isn't allowing this. Where exactly are we going wrong?
In principle, the local network should remain functional even in the absence of an internet connection.
-
@firelord61 what pfSense version are you using? You are right that LAN should work even when WAN is not accessible, that is odd.
What does "the connection on the LAN side drops as well" mean for you? Can you still ping another running computer or server? Or can describe what you want to do on the LAN that does not work when the WAN is down?
Do you use IPv6? And if yes is the LAN interface set to tracking the WAN interface?
-
When the internet goes down on the WAN side, the LAN also stops working, meaning we can't access the file server running locally, the accounting program doesn't work, the computers can't get IP addresses, and they can't ping anyone.
We are not using IPv6.
-
@firelord61 mmhh, very unusual. What device is pfSense running on (and again: what version?), hardware or a virtual machine? How is WAN configured (DHCP, PPPoE, VLAN)? And can you post a screenshot 'Status / Interfaces' but blur out the public IPs of the WAN interface (WAN IP and Gateway).
-
Thank you for your help.
The WAN configuration is set to a static IPv4 address and is running on a standard physical firewall device. We are using version 2.7.2-RELEASE (amd64).
We have two internet connections; we are using the one labeled “FIBER.”
Could we be making a mistake in the DNS configuration?
-
@firelord61 said in pfsense network problem:
and they can't ping anyone
You mean on another vlan that pfsense routes? Do you have a bridge setup in pfsense. Pfsense has zero to do with devices talking to each other on the same network.
Is it that your clients don't have an IP any longer to why they can not ping? Are you trying to ping via fqdn vs IP?
Even if dhcp stopped working - clients would still keep their IP for the lease, worse case scenario clients should keep their lease for at least 50% of the lease length, since that is your typical renewal period.. So at worse a client just about to renew, and dhcp went down would still keep its lease.
Now if pfsense was routing between networks/vlans and yeah an interface went down - its not going to be able to route traffic that interface is needed for.
Your lan side interface(s) should not be going down just because the wan is down.
-
We don't use VLANs; there's only one LAN connection, and users get regular IP addresses from DHCP. When the internet goes down, it seems like users stop getting IP addresses from DHCP. If they could, they would be able to ping each other, but since their IP addresses revert to 169..., we suddenly become unable to do anything.
-
@firelord61 as @johnpoz mentioned, devices on the same network (e.g LAN) don't pass through pfSense, they can directly access each other (by IP). Accessing other computers on the same network by name does require a working DNS service of course.
In your DNS settings, is only LAN selected for 'Network Interfaces' or additionally also 'Localhost'? And you mentioned that you use FIBER as WAN interface but for DNS 'WAN' is selected. That should not prevent DNS or DHCP on you LAN, just mention it, that DNS resolution will not go out via FIBER but WAN.
-
@firelord61 said in pfsense network problem:
but since their IP addresses revert to 169..
what is your lease time? Believe the default is 2 hours, so worse case clients should maintain their iP for an hour, some might be good for full 2 hours if they had just renewed their lease before dhcp went down.
Bump your lease time up - really only need for short lease times is when your over subscribed - or you have tendency to update info via dhcp quite often.. Like different dns or something, and you want to make sure your clients get it.
I have like a 8 day lease on some of my networks. I think 4 on others.
But yeah if dhcp is not working your going to have problems when leases expire.
then again just because interface X is down, this should have anything to do with other interfaces - unless the interface that is down is the physical for a vlan.
-
DNS details are as follows: 1. We are using FIBER as our internet connection; we need to select that, right?
@johnpoz I had reduced the rental period, leaving it blank and setting it to 7200 seconds.
-
@firelord61 said in pfsense network problem:
We are using version 2.7.2-RELEASE (amd64).
That build is now 2.5 years old and has been replaced by 2.8.0 then 2.8.1. One of my top mottos in IT is never waste time debugging an older version unless you absolutely have no other choice. Keeping your firewall updated is kind of important.
-
@firelord61 said in pfsense network problem:
DNS details are as follows: 1. We are using FIBER as our internet connection; we need to select that, right?
You selected WAN as outgoing interface, for DNS therefore it will not use FIBER but WAN. Is that what you want?
But all that does not explain why DHCP and access to local resources don't work.
-
thanks, Sometimes, version updates make the device inaccessible, so our philosophy is: "If it works, don't touch it" :)
@patient0 I set both sides to ALL, and I'm going to test it.
-
@firelord61 said in pfsense network problem:
"If it works, don't touch it" :)
Might be fine on some internal switch firmware that not exposed to anything. But your external firewall - best to keep that updated.
You also run into the problem if you ever do actually need vendor support - sorry that is no longer supported, update to current supported version. Let us know after if still having issues.
Also with just community support - nobody wants to work on issue with old versions. Said issue might have already been worked out in newer version, maybe issue is related to something that is now done completely different way, etc. As the version gets older and older - most of the community is prob no longer even able to try and help because they no longer have that version in operation.
That being said - interface X failing/down should have no relation to interface Y. But you run into things like well devices on Y network can no longer talk to each other - not because X is down, but because dhcp is down and they lost their IPs. If you give yourself an IP your lan - can you access pfsense gui on lan? What do the logs say, why is dhcp down, Why is dns down? etc. But dhcp and dns shouldn't go down just because X is down. Something is not quite right if that is happening. Sure not able to resolve www.publicdomain.tld sure - but you should still be able to resolve internal resources by their fqdn.
Would love to help - but I have never seen such an issue on my network, or even work networks when worked at my old company and we used pfsense in some locations. And I sure don't have a version 2.7 running where I could try and duplicate the problem. I do have 2.8.1 and 26.03.1 running my lab I could try and break, etc. But I have lost internet many times, and have on purpose broken my vms wan, etc. and have never seen this sort of issue. Wan being down is just that - all other local networks still working, dhcp still working local dns still working, etc.
So there is a piece of the puzzle we are missing. But you are correct wan going down should not effect your local network(s).
-
I'm reiterating the issue with a few changes I've made. I'll follow up and keep you updated here. Thanks to everyone for their support.
-
@firelord61 What John said. Edge security isn't an appliance you can set & forget -- it's a philosophy. Upgrade and test again. Make sure you have an XML backup so you can easily & quickly revert back to 2.7.2 if required.
-
@firelord61 said in pfsense network problem:
they can't ping anyone.
Mmm, is that by IP address directly? Or by hostname?
What does pfSense log when the WAN goes down? Does it show dhcpd stopping?
-
"When the internet goes down on the WAN side, the LAN also stops working, meaning we can't access the file server running locally, the accounting program doesn't work, the computers can't get IP addresses, and they can't ping anyone."
Let's pick these issues apart a little to try and get to the root cause.....
"When the internet goes down on the WAN side, the LAN also stops working"
That sounds very strange
"meaning we can't access the file server running locally"
How are you accessing this file server? Hostname? IP Address? Shared Network Drive? etc.
"the accounting program doesn't work"
What specifically doesn't work? You can/can't access it? Via hostname? Via IP address? The accounting software also cannot access the file server?
"the computers can't get IP addresses"
Where is your DHCP managed? On pfSense? Externally?
Try running the following command to see the IP Address of the DHCP Server, is this your pfSense firewall?
ipconfig /all"they can't ping anyone"
Assuming you mean here anyone else on the LAN?
Can they ping people successfully when the WAN is Up?
Sometimes local firewall rules on the end device computers can block pings - See here an example at the bottom of this post re. Norton getting in the way - https://www.contradodigital.com/2022/07/25/how-to-troubleshoot-ping-icmp-not-working/
Privacy Policy · Cookie Policy