Need help!



  • Sorry abour my english first  :) I am gonna try to tell you my problem. We have 70 computer using the pfsense internet. And we got 3 modem so 3 internet connection. Pfsense works fine when there are not many computer is open. But when the open computers come about 35 pfsense gets broken. The internet connections keep falling one by one.

    We got.. 3 piece of  8mbps Adsl Connection

    and Pfsense is the last version
    and Pfsense Server Machine is      hp DC7800P e 6500 CPU 160 gb Sata hdd 2 gb ddr2 ram

    The Ethernet Cards

    DC7800 OnBoard (1000Mbps)
    DN-10130  Digitus 10/100/1000 Mbps Gigabit PCI Express Ethernet Card
    DN-10110 Digitus 10/100/1000 Mbps Gigabit PCI Ethernet Card, 32-bit, Realtek RTL8169SC chip

    Server is connected to a    Tplink TP-SG1024D  Switch

    I wonder is there anyone have experienced this problem? And do you have any idea what might be problem?
    I know there is not enough info but if you ask me anymore info I will send you more.
    Thank you :) Have a nice day…



  • @Paaghi:

    But when the open computers come about 35 pfsense gets broken. The internet connections keep falling one by one.

    What is reported in the system log at that time? (See Status -> System Logs)



  • Mar 24 11:15:26 ipfw-classifyd: Loaded Protocol: httpvideo (rule dnpipe)
    Mar 24 11:15:27 apinger: alarm canceled: WAN1_ZXELL(192.168.2.2) *** loss ***
    Mar 24 11:15:33 apinger: ALARM: WAN3_SMILE(195.175.39.39) *** WAN3_SMILEdown ***
    Mar 24 11:15:34 apinger: alarm canceled: WAN3_SMILE(195.175.39.39) *** WAN3_SMILEdown ***
    Mar 24 11:15:37 check_reload_status: Reloading filter
    Mar 24 11:15:39 php: : MONITOR: WAN2_TPLINK has high latency, removing from routing group
    Mar 24 11:15:39 php: : MONITOR: WAN2_TPLINK has high latency, removing from routing group
    Mar 24 11:15:39 php: : MONITOR: WAN2_TPLINK has high latency, removing from routing group
    Mar 24 11:15:39 php: : MONITOR: WAN2_TPLINK has high latency, removing from routing group
    Mar 24 11:15:39 php: : Sending HUP signal to 26331
    Mar 24 11:15:39 kernel: Bump sched buckets to 64 (was 0)
    Mar 24 11:15:39 kernel: Bump sched buckets to 64 (was 0)
    Mar 24 11:15:39 kernel: Bump flowset buckets to 64 (was 0)
    Mar 24 11:15:39 kernel: Bump flowset buckets to 64 (was 0)
    Mar 24 11:15:48 kernel: arp: 192.168.1.13 moved from 00:0b:6b:01:14:fd to 00:04:61:4b:7a:1f on em0
    Mar 24 11:15:48 kernel: arp: 192.168.1.13 moved from 00:04:61:4b:7a:1f to 00:0b:6b:01:14:fd on em0
    Mar 24 11:15:51 apinger: alarm canceled: WAN2_TPLINK(195.175.39.40) *** delay ***
    Mar 24 11:15:56 apinger: ALARM: WAN2_TPLINK(195.175.39.40) *** loss ***
    Mar 24 11:15:56 ipfw-classifyd: Reloading config…
    Mar 24 11:15:56 ipfw-classifyd: Loaded Protocol: httpvideo (rule dnpipe)
    Mar 24 11:16:00 apinger: ALARM: WAN3_SMILE(195.175.39.39) *** WAN3_SMILEdown ***
    Mar 24 11:16:00 apinger: alarm canceled: WAN3_SMILE(195.175.39.39) *** WAN3_SMILEdown ***
    Mar 24 11:16:01 check_reload_status: Reloading filter
    Mar 24 11:16:03 php: : MONITOR: WAN2_TPLINK has packet loss, removing from routing group
    Mar 24 11:16:03 php: : MONITOR: WAN2_TPLINK has packet loss, removing from routing group
    Mar 24 11:16:03 php: : MONITOR: WAN2_TPLINK has packet loss, removing from routing group
    Mar 24 11:16:03 php: : MONITOR: WAN2_TPLINK has packet loss, removing from routing group
    Mar 24 11:16:03 php: : Sending HUP signal to 26331
    Mar 24 11:16:03 kernel: Bump sched buckets to 64 (was 0)
    Mar 24 11:16:03 kernel: Bump sched buckets to 64 (was 0)
    Mar 24 11:16:03 kernel: Bump flowset buckets to 64 (was 0)
    Mar 24 11:16:03 kernel: Bump flowset buckets to 64 (was 0)
    Mar 24 11:16:13 kernel: arp: 192.168.1.14 moved from 00:13:d4:e0:ce:3e to 00:04:61:4b:7a:1f on em0
    Mar 24 11:16:13 kernel: arp: 192.168.1.14 moved from 00:04:61:4b:7a:1f to 00:13:d4:e0:ce:3e on em0
    Mar 24 11:16:13 kernel: arp: 192.168.1.14 moved from 00:13:d4:e0:ce:3e to 00:04:61:4b:7a:1f on em0
    Mar 24 11:16:13 kernel: arp: 192.168.1.14 moved from 00:04:61:4b:7a:1f to 00:13:d4:e0:ce:3e on em0
    Mar 24 11:16:26 ipfw-classifyd: Reloading config...
    Mar 24 11:16:26 ipfw-classifyd: Loaded Protocol: httpvideo (rule dnpipe)
    Mar 24 11:16:29 apinger: alarm canceled: WAN2_TPLINK(195.175.39.40) *** loss ***
    Mar 24 11:16:39 check_reload_status: Reloading filter
    Mar 24 11:16:41 kernel: Bump sched buckets to 64 (was 0)
    Mar 24 11:16:41 kernel: Bump sched buckets to 64 (was 0)
    Mar 24 11:16:41 kernel: Bump flowset buckets to 64 (was 0)
    Mar 24 11:16:41 kernel: Bump flowset buckets to 64 (was 0)
    Mar 24 11:16:41 php: : Sending HUP signal to 26331
    Mar 24 11:16:57 ipfw-classifyd: Reloading config...
    Mar 24 11:16:57 ipfw-classifyd: Loaded Protocol: httpvideo (rule dnpipe)
    Mar 24 11:17:01 apinger: ALARM: WAN3_SMILE(195.175.39.39) *** WAN3_SMILEdown ***
    Mar 24 11:17:01 apinger: alarm canceled: WAN3_SMILE(195.175.39.39) *** WAN3_SMILEdown ***

    It goes like this. Lines dying every minute.

    If anybody want to take a look at the interface. I got teamviewer.



  • In System -> Routing, Gateways tab, click on the e button to the right of the relevant gateway. What are you using as the monitor IP? How many hops to that system?

    I don't think this is related, but why is this IP address moving back and forth from different interfaces?

    Mar 24 11:15:48    kernel: arp: 192.168.1.13 moved from 00:0b:6b:01:14:fd to 00:04:61:4b:7a:1f on em0
    Mar 24 11:15:48    kernel: arp: 192.168.1.13 moved from 00:04:61:4b:7a:1f to 00:0b:6b:01:14:fd on em0



  • @wallabybob:

    I don't think this is related, but why is this IP address moving back and forth from different interfaces?

    Mar 24 11:15:48    kernel: arp: 192.168.1.13 moved from 00:0b:6b:01:14:fd to 00:04:61:4b:7a:1f on em0
    Mar 24 11:15:48    kernel: arp: 192.168.1.13 moved from 00:04:61:4b:7a:1f to 00:0b:6b:01:14:fd on em0

    I have those kinds of log entries too.  They come from an Apple Airport Express wireless AP.  It's in bridged mode and pfSense thinks the MAC address changes from the wireless device to the Airport's MAC address.  It's weird but I think it might have more to do with how the Apple AP does whatever it does.  I have an Airport Extreme which does not exhibit this behavior.  Both are on the latest firmware releases.



  • Those MACs aren't Apple, so it isn't the weird behavior of Apple's Bonjour sleep proxy (which, by design, changes IPs to the Airport's or another device's MAC). It's an IP conflict between those two MACs.

    The original problem sounds like the usual symptoms of running out of states.



  • I have those kinds of log entries too.  They come from an Apple Airport Express wireless AP.  It's in bridged mode and pfSense thinks the MAC address changes from the wireless device to the Airport's MAC address.  It's weird but I think it might have more to do with how the Apple AP does whatever it does.  I have an Airport Extreme which does not exhibit this behavior.  Both are on the latest firmware releases.

    We have a customer with 2 devices also on Apple Airport Express units that do this also.  I can confirm its the same device with a statically assigned address. Does it to them as each device roams through the building.

    Other (third device) Apple desktop does this when the Apple tech insists on turning the wireless back on while still connected to the hardwired port.

    kernel: arp: 192.168.10.22 moved from 00:23:df:ad:41:e2 to 28:37:37:3f:26:8b on igb0
    kernel: arp: 192.168.10.22 moved from 28:37:37:3f:26:8b to 00:23:df:ad:41:e2 on igb0

    41:e2 is the desktop-
    26:8b is the airport express.

    Im pretty sure its the AP causing this log.


Locked