Web UI crash every 5 minutes or so

[tim.mcmanus]

It seems very odd that neither lighttpd or php are generating any errors.  And the only thing you're having an issue with is the webUI.  The rest of the installation works okay?

[Synack 0]

This is very strange, indeed. As long as I know, everything is working great apart from the web GUI (I don't think I'm using 100% of pfSense's functionnalities, but I haven't noticed any other problem).

My PPTP VPN is OK, my firewall rules run as expected, routing is working great…

I'm experiencing this problem on ONE COMPUTER ONLY.
I always run pfSense as a VM on top of ESXi 5.1. There's only ONE HOST doing this. I tried removing the VM and starting a new one from scratch, with a fine ISO (checked checksum). It does exactly the same thing. Could hardware be the problem ?

[tim.mcmanus]

Are you running snort?

It's seems strange that port 80 works and then becomes inaccessible.  If the webUI were unaccessible, I would assume something would be generating an error log.  It could be hardware, it could be ESXi, and it could be something running on the pfSense installation.  I've had snort block me out of my own LAN before and other configuration issues that I created on my own.

One last thing, check the firewall logs on the pfSense box and see if your IP is getting blocked on port 80 for some reason.

[Synack 0]

I tried to eliminate every "custom" thing that could fail.
Basically, it's just my computer and the pfSense VM. Nothing between us, no firewall rule blocking or rejecting traffic.
The web gui comes back for a few minutes when I reboot the pfSense VM.

[Synack 0]

It's strange I don't have a lighttpd.error.log.

All the logs are stored in /var/log right ?

Is there anything else I could check to try to find the error ? For the moment, I don't have a single clue and I bet it's even harder for you trying to diagnosticate the problem.

Thanks a lot.

Edit : All my VMWare ESXi interfaces are "flexible". I added one more interface with the "E1000" type and put it on the same network as my web UI interface.
I've been able to access the web ui with this second interface, although it was crashed (again) on the first one.
So could this possibly be a problem linked to the type of interface within ESXi ?
I'll wait and see if this second interface crashes too…

[wallabybob]

Have you checked the firewall log:
@tim.mcmanus:

One last thing, check the firewall logs on the pfSense box and see if your IP is getting blocked on port 80 for some reason.

Do you get a different results if you use IP address in the URL instead of hostname? (Perhaps DNS is playing tricks.)

Do you have multiple systems with the same IP address as the address on which you access the pfSense GUI? (Perhaps another VM that starts up from time to time.)

What is the output of pfSense shell command```
sockstat

When you have a browser session that appears to have stalled I suggest you start a packet capture on the VMWARE physical interface by which you access the pfSense GUI and then attempt access in another browser. (Perhaps start with Firefox then switch to Chromium or Opera) Does the access attempt appear in the packet capture?

[Klaws]

@S(y)nack:

All my VMWare ESXi interfaces are "flexible". I added one more interface with the "E1000" type and put it on the same network as my web UI interface.
I've been able to access the web ui with this second interface, although it was crashed (again) on the first one.
So could this possibly be a problem linked to the type of interface within ESXi ?
I'll wait and see if this second interface crashes too…

Interesting. I remember having serious issues with the e1000 interface; a change to flexible solved my problems. However, this was with FreeBSD 6.4 under VMWare Server 2.0. Maybe it's the other way around with the FreeBSD 8.1 and ESXi 5.1?