Firewall states not being deleted



  • 2.2-BETA (amd64)
    built on Wed Nov 26 15:27:11 CST 2014
    FreeBSD 10.1-RELEASE

    I'm getting the same problems which exist in the release/gold version 2.1.x, which is the fw states are not being deleted when the ISP resets the broadband connection. Going into diagnostics, show states, and removing them gets the affected net services working again.



  • That's been pretty thoroughly tested in 2.2, works well in every circumstance I've seen. What type of WAN? What states are you seeing remaining? What's in the system log when the reconnection happens?



  • Wan is just a variable ip address adsl connection, the states I had to kill were for my sip server.

    There doesnt seem to be anything untoward in the systemlog, basically the sip server was working after the upgrade I did last night, woke up this morning and the sip server wasnt communicating with the outside world, resetting the states fixed the problem.

    System log attached from last night.

    Side note: Should the mac id be changing for network cards as hilighted in bold? That seems a bit odd.

    Nov 27 08:48:30 php-fpm[64260]: /index.php: Successful login for user 'admin' from: 192.168.10.3
    Nov 27 08:48:30 php-fpm[64260]: /index.php: Successful login for user 'admin' from: 192.168.10.3
    Nov 27 06:08:15 kernel: arp: 192.168.10.10 moved from 00:21:6a:55:41:6a to 00:0c:29:3c:7d:dc on em0
    Nov 27 06:05:20 check_reload_status: Syncing firewall
    Nov 27 06:05:20 php: snort_check_for_rule_updates.php: [Snort] The Rules update has finished.
    Nov 27 06:05:20 php: snort_check_for_rule_updates.php: [Snort] Emerging Threats Open rules are up to date…
    Nov 27 06:05:04 php: snort_check_for_rule_updates.php: [Snort] Snort GPLv2 Community Rules are up to date…
    Nov 27 06:05:04 php: snort_check_for_rule_updates.php: [Snort] Server returned error code 422…
    Nov 27 06:05:04 php: snort_check_for_rule_updates.php: [Snort] Snort VRT rules md5 download failed…
    Nov 27 05:54:20 kernel: arp: 192.168.10.10 moved from 00:0c:29:3c:7d:dc to 00:21:6a:55:41:6a on em0
    Nov 27 05:39:54 php-fpm[32027]: /index.php: Successful login for user 'admin' from: 192.168.10.30
    Nov 27 05:39:54 php-fpm[32027]: /index.php: Successful login for user 'admin' from: 192.168.10.30
    Nov 27 04:48:03 php-fpm[43996]: /index.php: Successful login for user 'admin' from: 192.168.10.3
    Nov 27 04:48:03 php-fpm[43996]: /index.php: Successful login for user 'admin' from: 192.168.10.3
    Nov 27 01:01:09 php: rc.dyndns.update: phpDynDNS (domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 01:01:08 php: rc.dyndns.update: phpDynDNS (domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 01:01:07 php: rc.dyndns.update: phpDynDNS (domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 01:01:06 php: rc.dyndns.update: phpDynDNS (domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 01:01:05 php: rc.dyndns.update: phpDynDNS (domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 01:01:04 php: rc.dyndns.update: phpDynDNS (domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 01:01:03 php: rc.dyndns.update: phpDynDNS (domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 01:01:02 php: rc.dyndns.update: phpDynDNS: (Success) IP Address Updated Successfully!
    Nov 27 01:01:02 php: rc.dyndns.update: phpDynDNS: updating cache file /conf/dyndns_wancustom'domain'1.cache: 92.24.183.59
    Nov 27 01:01:00 php: rc.dyndns.update: phpDynDNS: (Success) IP Address Updated Successfully!
    Nov 27 01:01:00 php: rc.dyndns.update: phpDynDNS: updating cache file /conf/dyndns_wancustom'domain'0.cache: 92.24.183.59
    Nov 27 00:58:44 kernel: em0: promiscuous mode enabled
    Nov 27 00:58:19 SnortStartup[98484]: Snort START for LAN(22803_em0)…
    Nov 27 00:57:56 sshlockout[78979]: sshlockout/webConfigurator v3.0 starting up
    Nov 27 00:57:56 login: login on ttyv0 as root
    Nov 27 00:57:54 kernel: done.
    Nov 27 00:57:54 php-fpm[43996]: /rc.start_packages: Restarting/Starting all packages.
    Nov 27 00:57:54 kernel: Starting syslog…done.
    Nov 27 00:57:54 php: rc.bootup: Finished reinstalling all packages.
    Nov 27 00:57:54 php: rc.bootup: Finished installing package nmap
    Nov 27 00:57:54 php: rc.bootup: Successfully installed package: nmap.
    Nov 27 00:57:54 check_reload_status: Syncing firewall
    Nov 27 00:57:49 kernel:  100%
    Nov 27 00:57:48 kernel:  90%
    Nov 27 00:57:47 kernel:  80%
    Nov 27 00:57:46 kernel:  70%
    Nov 27 00:57:45 kernel:  60%
    Nov 27 00:57:45 kernel:  50%
    Nov 27 00:57:44 kernel:  40%
    Nov 27 00:57:43 kernel:  30%
    Nov 27 00:57:42 kernel:  20%
    Nov 27 00:57:41 kernel:  9% 10%
    Nov 27 00:57:41 kernel:  7% 8%
    Nov 27 00:57:41 kernel:  5% 6%
    Nov 27 00:57:40 kernel:  4%
    Nov 27 00:57:40 kernel:  2% 3%
    Nov 27 00:57:40 kernel:  1%
    Nov 27 00:57:40 kernel: 0%
    Nov 27 00:57:38 kernel:
    Nov 27 00:57:38 check_reload_status: Syncing firewall
    Nov 27 00:57:37 php: rc.bootup: Beginning package installation for nmap .
    Nov 27 00:57:36 php: rc.bootup: Reinstalling package nmap
    Nov 27 00:57:36 php: rc.bootup: Finished uninstalling package nmap
    Nov 27 00:57:36 check_reload_status: Syncing firewall
    Nov 27 00:57:36 check_reload_status: Syncing firewall
    Nov 27 00:57:30 php: rc.bootup: Uninstalling package nmap
    Nov 27 00:57:30 php: rc.bootup: Finished installing package snort
    Nov 27 00:57:30 php: rc.bootup: Successfully installed package: snort.
    Nov 27 00:57:30 php: rc.bootup: [Snort] Package post-installation tasks completed…
    Nov 27 00:57:30 php: rc.bootup: [Snort] Finished rebuilding installation from saved settings…
    Nov 27 00:57:30 check_reload_status: Syncing firewall
    Nov 27 00:57:30 check_reload_status: Syncing firewall
    Nov 27 00:57:28 php: rc.bootup: [Snort] Building new sig-msg.map file for LAN…
    Nov 27 00:57:27 php: rc.bootup: [Snort] Enabling any flowbit-required rules for: LAN…
    Nov 27 00:57:24 php: rc.bootup: [Snort] Updating rules configuration for: LAN …
    Nov 27 00:57:22 php: rc.bootup: [Snort] Building new sig-msg.map file for WAN…
    Nov 27 00:57:22 php: rc.bootup: [Snort] Enabling any flowbit-required rules for: WAN…
    Nov 27 00:57:18 kernel: Generating snort.conf configuration file from saved settings...
    Nov 27 00:57:18 php: rc.bootup: [Snort] Updating rules configuration for: WAN …
    Nov 27 00:57:18 check_reload_status: Syncing firewall
    Nov 27 00:57:18 php: rc.bootup: [Snort] The Rules update has finished.
    Nov 27 00:57:18 php: rc.bootup: [Snort] Emerging Threats Open rules file update downloaded successfully
    Nov 27 00:57:15 php: rc.bootup: [Snort] There is a new set of Emerging Threats Open rules posted. Downloading emerging.rules.tar.gz…
    Nov 27 00:57:15 php: rc.bootup: [Snort] Snort GPLv2 Community Rules file update downloaded successfully
    Nov 27 00:57:14 php: rc.bootup: [Snort] There is a new set of Snort GPLv2 Community Rules posted. Downloading community-rules.tar.gz…
    Nov 27 00:57:13 php: rc.bootup: [Snort] Server returned error code 422…
    Nov 27 00:57:13 php: rc.bootup: [Snort] Snort VRT rules md5 download failed…
    Nov 27 00:57:12 php: rc.bootup: [Snort] Downloading and updating configured rule types…
    Nov 27 00:57:12 php: rc.bootup: [Snort] Configuration version is current…
    Nov 27 00:57:12 php: rc.bootup: [Snort] Checking configuration settings version…
    Nov 27 00:57:12 kernel: Saved settings detected...
    Nov 27 00:57:12 php: rc.bootup: [Snort] Saved settings detected… rebuilding installation with saved settings...
    Nov 27 00:57:09 kernel: 100%
    Nov 27 00:57:08 kernel: 100%
    Nov 27 00:57:07 kernel: 100%
    Nov 27 00:57:04 kernel: 100%
    Nov 27 00:57:01 kernel: 100%
    Nov 27 00:57:01 kernel: 100%
    Nov 27 00:57:00 kernel: 100%
    Nov 27 00:56:59 kernel: 100%
    Nov 27 00:56:58 kernel: 100%
    Nov 27 00:56:53 kernel: 50% 100%
    Nov 27 00:56:52 kernel: 100%
    Nov 27 00:56:50 kernel: 100%
    Nov 27 00:56:49 kernel: 100%
    Nov 27 00:56:49 kernel: 100%
    Nov 27 00:56:48 kernel: 100%
    Nov 27 00:56:47 kernel: 100%
    Nov 27 00:56:44 kernel: 90% 100%
    Nov 27 00:56:43 kernel: 100%
    Nov 27 00:56:41 kernel: 100%
    Nov 27 00:56:39 kernel:  100%
    Nov 27 00:56:38 kernel: 10%
    Nov 27 00:56:33 kernel:  100%
    Nov 27 00:56:32 kernel:  90%
    Nov 27 00:56:31 kernel:  80%
    Nov 27 00:56:31 kernel:  70%
    Nov 27 00:56:30 kernel:  60%
    Nov 27 00:56:29 kernel:  50%
    Nov 27 00:56:28 kernel:  40%
    Nov 27 00:56:27 kernel:  30%
    Nov 27 00:56:26 kernel:  20%
    Nov 27 00:56:25 kernel:  10%
    Nov 27 00:56:25 kernel:  8% 9%
    Nov 27 00:56:25 kernel:  6% 7%
    Nov 27 00:56:25 kernel:  4% 5%
    Nov 27 00:56:25 kernel:  3%
    Nov 27 00:56:24 kernel:  1% 2%
    Nov 27 00:56:24 kernel: 0%
    Nov 27 00:56:23 kernel:
    Nov 27 00:56:23 check_reload_status: Syncing firewall
    Nov 27 00:56:21 php: rc.bootup: Beginning package installation for snort .
    Nov 27 00:56:21 kernel:
    Nov 27 00:56:21 php: rc.bootup: Reinstalling package snort
    Nov 27 00:56:21 php: rc.bootup: Finished uninstalling package snort
    Nov 27 00:56:20 php: rc.bootup: [Snort] Package deletion requested… removing all files...
    Nov 27 00:56:20 check_reload_status: Syncing firewall
    Nov 27 00:56:20 check_reload_status: Syncing firewall
    Nov 27 00:56:11 php: rc.bootup: [Snort] Snort package uninstall in progress…
    Nov 27 00:56:11 check_reload_status: Syncing firewall
    Nov 27 00:56:03 php: rc.bootup: Uninstalling package snort
    Nov 27 00:56:03 php: rc.bootup: Finished installing package Cron
    Nov 27 00:56:03 php: rc.bootup: Successfully installed package: Cron.
    Nov 27 00:56:03 check_reload_status: Syncing firewall
    Nov 27 00:56:03 php-fpm[254]: /rc.dyndns.update: phpDynDNS: (Success) IP Address Updated Successfully!
    Nov 27 00:56:03 php-fpm[254]: /rc.dyndns.update: phpDynDNS: updating cache file /conf/dyndns_wancustom'domain'8.cache: 92.24.183.59
    Nov 27 00:56:01 php-fpm[254]: /rc.dyndns.update: phpDynDNS: (Success) IP Address Updated Successfully!
    Nov 27 00:56:01 php-fpm[254]: /rc.dyndns.update: phpDynDNS: updating cache file /conf/dyndns_wancustom'domain'7.cache: 92.24.183.59
    Nov 27 00:56:00 php-fpm[254]: /rc.dyndns.update: phpDynDNS: (Success) IP Address Updated Successfully!
    Nov 27 00:56:00 php-fpm[254]: /rc.dyndns.update: phpDynDNS: updating cache file /conf/dyndns_wancustom'domain'6.cache: 92.24.183.59
    Nov 27 00:55:59 kernel: 100%
    Nov 27 00:55:59 check_reload_status: Syncing firewall
    Nov 27 00:55:58 php-fpm[254]: /rc.dyndns.update: phpDynDNS: (Success) IP Address Updated Successfully!
    Nov 27 00:55:58 php-fpm[254]: /rc.dyndns.update: phpDynDNS: updating cache file /conf/dyndns_wancustom'domain'5.cache: 92.24.183.59
    Nov 27 00:55:58 php: rc.bootup: Beginning package installation for Cron .
    Nov 27 00:55:57 php: rc.bootup: Reinstalling package Cron
    Nov 27 00:55:57 php: rc.bootup: Finished uninstalling package Cron
    Nov 27 00:55:57 check_reload_status: Syncing firewall
    Nov 27 00:55:57 php-fpm[254]: /rc.dyndns.update: phpDynDNS: (Success) IP Address Updated Successfully!
    Nov 27 00:55:57 php-fpm[254]: /rc.dyndns.update: phpDynDNS: updating cache file /conf/dyndns_wancustom'domain'4.cache: 92.24.183.59
    Nov 27 00:55:57 check_reload_status: Syncing firewall
    Nov 27 00:55:57 php: rc.bootup: The command '/usr/local/etc/rc.d/cron.sh stop' returned exit code '1', the output was ''
    Nov 27 00:55:57 php: rc.bootup: Uninstalling package Cron
    Nov 27 00:55:57 kernel: Done.
    Nov 27 00:55:57 php: rc.bootup: List of packages to reinstall: Cron, snort, nmap
    Nov 27 00:55:56 php-fpm[254]: /rc.dyndns.update: phpDynDNS: (Success) IP Address Updated Successfully!
    Nov 27 00:55:56 php-fpm[254]: /rc.dyndns.update: phpDynDNS: updating cache file /conf/dyndns_wancustom'domain'3.cache: 92.24.183.59
    Nov 27 00:55:55 kernel: done.
    Nov 27 00:55:55 php: rc.bootup: Attempting to reinstall all packages
    Nov 27 00:55:55 php: rc.bootup: Creating rrd update script
    Nov 27 00:55:54 php-fpm[254]: /rc.dyndns.update: phpDynDNS: (Success) IP Address Updated Successfully!
    Nov 27 00:55:54 php-fpm[254]: /rc.dyndns.update: phpDynDNS: updating cache file /conf/dyndns_wancustom'domain'2.cache: 92.24.183.59
    Nov 27 00:55:53 check_reload_status: Rewriting resolv.conf
    Nov 27 00:55:51 kernel: …done.
    Nov 27 00:55:51 php: rc.bootup: Could not find IPv4 gateway for interface (wan).
    Nov 27 00:55:51 php: rc.bootup: Could not find IPv4 gateway for interface (wan).
    Nov 27 00:55:51 kernel: .
    Nov 27 00:55:51 php: rc.bootup: Could not find IPv6 gateway for interface(wan).
    Nov 27 00:55:51 kernel: done.
    Nov 27 00:55:51 check_reload_status: Updating all dyndns
    Nov 27 00:55:51 kernel: done.
    Nov 27 00:55:50 kernel: done.
    Nov 27 00:55:49 check_reload_status: Linkup starting ue0
    Nov 27 00:55:49 devd: Executing '/usr/local/sbin/pfSctl -c 'interface linkup start ue0''
    Nov 27 00:55:49 kernel: ue0: link state changed to UP
    Nov 27 00:55:48 check_reload_status: Linkup starting em0
    Nov 27 00:55:48 devd: Executing '/usr/local/sbin/pfSctl -c 'interface linkup start em0''
    Nov 27 00:55:48 kernel: em0: link state changed to UP
    Nov 27 00:55:48 kernel:
    Nov 27 00:55:47 kernel: ...done.
    Nov 27 00:55:47 php: rc.bootup: Could not find IPv4 gateway for interface (wan).
    Nov 27 00:55:47 php: rc.bootup: Could not find IPv4 gateway for interface (wan).
    Nov 27 00:55:47 php: rc.bootup: Could not find IPv6 gateway for interface(wan).
    Nov 27 00:55:47 check_reload_status: rc.newwanip starting ovpns1
    Nov 27 00:55:47 kernel: ovpns1: link state changed to UP
    Nov 27 00:55:47 kernel: pflog0: promiscuous mode enabled
    Nov 27 00:55:47 kernel:
    Nov 27 00:55:47 kernel: tun3: changing name to 'ovpnc3'
    Nov 27 00:55:47 kernel: tun2: changing name to 'ovpnc2'
    Nov 27 00:55:47 kernel: tun1: changing name to 'ovpns1'
    Nov 27 00:55:47 kernel:
    Nov 27 00:55:47 kernel: done.
    Nov 27 00:55:47 php: rc.bootup: Resyncing OpenVPN instances.
    Nov 27 00:55:47 php: rc.bootup: Starting 3gstats.php on device '' for interface 'wan'
    Nov 27 00:55:47 check_reload_status: Linkup starting ue0
    Nov 27 00:55:47 devd: Executing '/usr/local/sbin/pfSctl -c 'interface linkup stop ue0''
    Nov 27 00:55:47 kernel: ue0: link state changed to DOWN
    Nov 27 00:55:47 kernel:
    Nov 27 00:55:46 kernel: coretemp1: <cpu on-die="" thermal="" sensors="">on cpu1
    Nov 27 00:55:46 kernel: coretemp0: <cpu on-die="" thermal="" sensors="">on cpu0
    Nov 27 00:55:46 kernel: Trying to mount root from ufs:/dev/ad4s1a [rw]…
    Nov 27 00:55:46 kernel: Timecounter "TSC" frequency 1098602680 Hz quality 1000
    Nov 27 00:55:46 kernel: SMP: AP CPU #1 Launched!
    Nov 27 00:55:46 kernel: ada0: Previously was known as ad4
    Nov 27 00:55:46 kernel: ada0: 122104MB (250069680 512 byte sectors: 16H 63S/T 16383C)
    Nov 27 00:55:46 kernel: ada0: Command Queueing enabled
    Nov 27 00:55:46 kernel: ada0: 600.000MB/s transfers (SATA 3.x, UDMA6, PIO 8192bytes)
    Nov 27 00:55:46 kernel: ada0: Serial Number [serial number]
    Nov 27 00:55:46 kernel: ada0: <ts2-e63 128g="" 2.54="">ATA-8 SATA 3.x device
    Nov 27 00:55:46 kernel: ada0 at ahcich0 bus 0 scbus0 target 0 lun 0
    Nov 27 00:55:46 kernel: ses0: SEMB SES Device</ts2-e63></cpu></cpu>



  • Been doing some simple tests by pulling the phone socket out of the wall, as well as switching off the router that is currently bridging to pfsense thats doing pppoe.

    So far the states have changed when the firewall has spotted the connection has gone done, but pf is not spotting when the net connection has gone down, ie I can pull the phone cable to the wall socket out and pf doesnt spot this, but does spot when the cable from the bridged router to pfsense has been pulled.

    I'll keep an eye on this to see if I can spot any other patterns which might be causing this problem.



  • what's the monitoring ip for the dsl interface? (system->routing->gateways)

    try setting it to a pingable public ip on the internet (if not allready). pfsense should detect that if pings start to drop



  • Its set to the default gateway which is dynamic and I'm not using anything in the monitor IP.

    Funnily enough it just happened again. Firewall was saying it was all connected etc, clicked a couple web pages, one started to load then stopped, and all the other web pages I was trying to load on other tabs timed out as well.

    Waited for connectivity to resume for 5 mins by clicking retry in the web browser, tried loading some other bookmarks, nothing happened yet it still showed the wan was connected, so did a wan,save, apply, got net connection back with new ip as expected, then web pages started loading, but the sip server was no longer communicating, so had to kill the states.

    I'll see how it goes with the monitor ip field containing a fixed ip instead of monitoring the dynamic ip address assigned by the isp. I'm using the IP address from the domain name provider I use for my dynamic dns domain names.

    system log

    Nov 27 11:27:38 php-fpm[3846]: /rc.filter_configure_sync: Could not find IPv6 gateway for interface(wan).
    Nov 27 11:27:36 php-fpm[3846]: /system_gateways.php: Removing static route for monitor 194.245.148.200 and adding a new route through 2.97.208.1
    Nov 27 11:27:36 check_reload_status: Reloading filter
    Nov 27 11:27:36 php-fpm[3846]: /system_gateways.php: ROUTING: setting default route to 2.97.208.1
    Nov 27 11:27:34 check_reload_status: Syncing firewall
    Nov 27 11:17:04 php-fpm[55211]: /rc.dyndns.update: phpDynDNS (smtp.domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 11:17:03 php-fpm[55211]: /rc.dyndns.update: phpDynDNS (sip.domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 11:17:02 php-fpm[55211]: /rc.dyndns.update: phpDynDNS (sip.domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 11:17:01 php-fpm[55211]: /rc.dyndns.update: phpDynDNS (mail.domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 11:17:00 php-fpm[55211]: /rc.dyndns.update: phpDynDNS (domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 11:16:59 php-fpm[72818]: /rc.start_packages: Restarting/Starting all packages.
    Nov 27 11:16:59 php-fpm[72818]: /rc.filter_configure_sync: Could not find IPv6 gateway for interface(wan).
    Nov 27 11:16:59 php-fpm[55211]: /rc.dyndns.update: phpDynDNS (domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 11:16:58 php-fpm[55211]: /rc.dyndns.update: phpDynDNS (domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 11:16:58 check_reload_status: Starting packages
    Nov 27 11:16:58 php-fpm[66588]: /rc.newwanip: pfSense package system has detected an IP change or dynamic WAN reconnection - -> 192.168.5.1 - Restarting packages.
    Nov 27 11:16:58 check_reload_status: Reloading filter
    Nov 27 11:16:58 php-fpm[66588]: /rc.newwanip: rc.newwanip: on (IP address: 192.168.5.1) (interface: []) (real interface: ovpns1).
    Nov 27 11:16:58 php-fpm[66588]: /rc.newwanip: rc.newwanip: Info: starting on ovpns1.
    Nov 27 11:16:58 php-fpm[72818]: /rc.filter_configure_sync: Could not find IPv6 gateway for interface(wan).
    Nov 27 11:16:57 php-fpm[66588]: /rc.filter_configure_sync: Could not find IPv6 gateway for interface(wan).
    Nov 27 11:16:57 php-fpm[66588]: /rc.openvpn: OpenVPN: Resync client3 HTC Hero VPN
    Nov 27 11:16:57 php-fpm[55211]: /rc.dyndns.update: phpDynDNS (domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 11:16:57 check_reload_status: rc.newwanip starting ovpns1
    Nov 27 11:16:57 kernel: ovpns1: link state changed to UP
    Nov 27 11:16:57 php-fpm[66588]: /rc.openvpn: OpenVPN: Resync client2 Laptop OpenVPN client connection
    Nov 27 11:16:56 check_reload_status: Reloading filter
    Nov 27 11:16:56 kernel: ovpns1: link state changed to DOWN
    Nov 27 11:16:56 php-fpm[66588]: /rc.openvpn: OpenVPN: Resync server1 Wan OpenVPN
    Nov 27 11:16:56 php-fpm[66588]: /rc.openvpn: OpenVPN: One or more OpenVPN tunnel endpoints may have changed its IP. Reloading endpoints that may use WAN_PPPOE.
    Nov 27 11:16:56 php-fpm[55211]: /rc.dyndns.update: phpDynDNS (www.domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 11:16:55 check_reload_status: Reloading filter
    Nov 27 11:16:55 check_reload_status: Restarting OpenVPN tunnels/interfaces
    Nov 27 11:16:55 check_reload_status: Restarting ipsec tunnels
    Nov 27 11:16:55 check_reload_status: updating dyndns WAN_PPPOE
    Nov 27 11:16:30 php-fpm[85785]: /rc.dyndns.update: phpDynDNS (smtp.domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 11:16:29 php-fpm[85785]: /rc.dyndns.update: phpDynDNS (sip.domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 11:16:28 php-fpm[85785]: /rc.dyndns.update: phpDynDNS (sip.domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 11:16:27 php-fpm[85785]: /rc.dyndns.update: phpDynDNS (mail.domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 11:16:26 php-fpm[85785]: /rc.dyndns.update: phpDynDNS (domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 11:16:25 php-fpm[85785]: /rc.dyndns.update: phpDynDNS (domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 11:16:25 php-fpm[641]: /rc.start_packages: Restarting/Starting all packages.
    Nov 27 11:16:25 php-fpm[641]: /rc.filter_configure_sync: Could not find IPv6 gateway for interface(wan).
    Nov 27 11:16:24 php-fpm[85785]: /rc.dyndns.update: phpDynDNS (domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 11:16:24 check_reload_status: Starting packages
    Nov 27 11:16:24 php-fpm[93545]: /rc.newwanip: pfSense package system has detected an IP change or dynamic WAN reconnection - -> 192.168.5.1 - Restarting packages.
    Nov 27 11:16:24 check_reload_status: Reloading filter
    Nov 27 11:16:24 php-fpm[93545]: /rc.newwanip: rc.newwanip: on (IP address: 192.168.5.1) (interface: []) (real interface: ovpns1).
    Nov 27 11:16:24 php-fpm[93545]: /rc.newwanip: rc.newwanip: Info: starting on ovpns1.
    Nov 27 11:16:23 php-fpm[641]: /rc.filter_configure_sync: Could not find IPv6 gateway for interface(wan).
    Nov 27 11:16:23 php-fpm[93545]: /rc.filter_configure_sync: Could not find IPv6 gateway for interface(wan).
    Nov 27 11:16:23 php-fpm[85785]: /rc.dyndns.update: phpDynDNS (domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 11:16:23 php-fpm[93545]: /rc.openvpn: OpenVPN: Resync client3 HTC Hero VPN
    Nov 27 11:16:23 check_reload_status: rc.newwanip starting ovpns1
    Nov 27 11:16:23 kernel: ovpns1: link state changed to UP
    Nov 27 11:16:22 php-fpm[93545]: /rc.openvpn: OpenVPN: Resync client2 Laptop OpenVPN client connection
    Nov 27 11:16:22 check_reload_status: Reloading filter
    Nov 27 11:16:22 kernel: ovpns1: link state changed to DOWN
    Nov 27 11:16:22 php-fpm[93545]: /rc.openvpn: OpenVPN: Resync server1 Wan OpenVPN
    Nov 27 11:16:22 php-fpm[93545]: /rc.openvpn: OpenVPN: One or more OpenVPN tunnel endpoints may have changed its IP. Reloading endpoints that may use WAN_PPPOE.
    Nov 27 11:16:22 php-fpm[85785]: /rc.dyndns.update: phpDynDNS (www.domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 11:16:21 check_reload_status: Reloading filter
    Nov 27 11:16:21 check_reload_status: Restarting OpenVPN tunnels/interfaces
    Nov 27 11:16:21 check_reload_status: Restarting ipsec tunnels
    Nov 27 11:16:21 check_reload_status: updating dyndns WAN_PPPOE
    Nov 27 11:14:50 php-fpm[14539]: /rc.filter_configure_sync: Could not find IPv6 gateway for interface(wan).
    Nov 27 11:14:50 SnortStartup[88273]: Ignoring additional START command since Snort is already starting…
    Nov 27 11:14:50 php-fpm[14539]: /rc.start_packages: Restarting/Starting all packages.
    Nov 27 11:14:49 php-fpm[53075]: /rc.filter_configure_sync: Could not find IPv6 gateway for interface(wan).
    Nov 27 11:14:49 php-fpm[14539]: /rc.start_packages: Restarting/Starting all packages.
    Nov 27 11:14:49 check_reload_status: Reloading filter
    Nov 27 11:14:49 check_reload_status: Starting packages
    Nov 27 11:14:49 php-fpm[53075]: /rc.newwanip: pfSense package system has detected an IP change or dynamic WAN reconnection - 92.29.127.217 -> 2.97.215.131 - Restarting packages.
    Nov 27 11:14:48 check_reload_status: Starting packages
    Nov 27 11:14:48 php-fpm[14539]: /rc.newwanip: pfSense package system has detected an IP change or dynamic WAN reconnection - -> 192.168.5.1 - Restarting packages.
    Nov 27 11:14:48 check_reload_status: Reloading filter
    Nov 27 11:14:48 php-fpm[14539]: /rc.newwanip: rc.newwanip: on (IP address: 192.168.5.1) (interface: []) (real interface: ovpns1).
    Nov 27 11:14:48 php-fpm[14539]: /rc.newwanip: rc.newwanip: Info: starting on ovpns1.
    Nov 27 11:14:48 php-fpm[14539]: /rc.filter_configure_sync: Could not find IPv6 gateway for interface(wan).
    Nov 27 11:14:48 php-fpm[14539]: /rc.filter_configure_sync: Could not find IPv6 gateway for interface(wan).
    Nov 27 11:14:47 check_reload_status: rc.newwanip starting ovpns1
    Nov 27 11:14:47 kernel: ovpns1: link state changed to UP
    Nov 27 11:14:47 php-fpm[53075]: /rc.newwanip: Creating rrd update script
    Nov 27 11:14:47 check_reload_status: Reloading filter
    Nov 27 11:14:47 check_reload_status: Reloading filter
    Nov 27 11:14:47 kernel: ovpns1: link state changed to DOWN
    Nov 27 11:14:47 php-fpm[53075]: /rc.newwanip: Resyncing OpenVPN instances for interface WAN.
    Nov 27 11:14:46 php-fpm[89283]: /rc.dyndns.update: phpDynDNS (smtp.domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 11:14:46 php-fpm[53075]: /rc.newwanip: phpDynDNS: (Success) IP Address Updated Successfully!
    Nov 27 11:14:46 php-fpm[53075]: /rc.newwanip: phpDynDNS: updating cache file /conf/dyndns_wancustom'smtp.domain'8.cache: 2.97.215.131
    Nov 27 11:14:44 php-fpm[89283]: /rc.dyndns.update: phpDynDNS (sip.domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 11:14:44 php-fpm[53075]: /rc.newwanip: phpDynDNS: (Success) IP Address Updated Successfully!
    Nov 27 11:14:44 php-fpm[53075]: /rc.newwanip: phpDynDNS: updating cache file /conf/dyndns_wancustom'sip.domain'7.cache: 2.97.215.131
    Nov 27 11:14:43 php-fpm[89283]: /rc.dyndns.update: phpDynDNS (sip.domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 11:14:43 php-fpm[53075]: /rc.newwanip: phpDynDNS: (Success) IP Address Updated Successfully!
    Nov 27 11:14:43 php-fpm[53075]: /rc.newwanip: phpDynDNS: updating cache file /conf/dyndns_wancustom'sip.domain'6.cache: 2.97.215.131
    Nov 27 11:14:41 php-fpm[89283]: /rc.dyndns.update: phpDynDNS (mail.domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 11:14:41 php-fpm[53075]: /rc.newwanip: phpDynDNS: (Success) IP Address Updated Successfully!
    Nov 27 11:14:41 php-fpm[53075]: /rc.newwanip: phpDynDNS: updating cache file /conf/dyndns_wancustom'mail.domain'5.cache: 2.97.215.131
    Nov 27 11:14:40 php-fpm[89283]: /rc.dyndns.update: phpDynDNS (domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 11:14:40 php-fpm[53075]: /rc.newwanip: phpDynDNS: (Success) IP Address Updated Successfully!
    Nov 27 11:14:40 php-fpm[53075]: /rc.newwanip: phpDynDNS: updating cache file /conf/dyndns_wancustom'domain'4.cache: 2.97.215.131
    Nov 27 11:14:39 php-fpm[89283]: /rc.dyndns.update: phpDynDNS (domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 11:14:39 php-fpm[53075]: /rc.newwanip: phpDynDNS: (Success) IP Address Updated Successfully!
    Nov 27 11:14:39 php-fpm[53075]: /rc.newwanip: phpDynDNS: updating cache file /conf/dyndns_wancustom'domain'3.cache: 2.97.215.131
    Nov 27 11:14:38 php-fpm[90787]: /rc.filter_configure_sync: Could not find IPv6 gateway for interface(wan).
    Nov 27 11:14:38 php-fpm[89283]: /rc.dyndns.update: phpDynDNS (domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 11:14:37 php-fpm[53075]: /rc.newwanip: phpDynDNS: (Success) IP Address Updated Successfully!
    Nov 27 11:14:37 php-fpm[53075]: /rc.newwanip: phpDynDNS: updating cache file /conf/dyndns_wancustom'domain'2.cache: 2.97.215.131
    Nov 27 11:14:37 php-fpm[64511]: /interfaces.php: Creating rrd update script
    Nov 27 11:14:37 check_reload_status: Reloading filter
    Nov 27 11:14:37 php-fpm[89283]: /rc.dyndns.update: phpDynDNS (domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 11:14:36 php-fpm[53075]: /rc.newwanip: phpDynDNS: (Success) IP Address Updated Successfully!
    Nov 27 11:14:36 php-fpm[53075]: /rc.newwanip: phpDynDNS: updating cache file /conf/dyndns_wancustom'domain'1.cache: 2.97.215.131
    Nov 27 11:14:36 kernel: arp: 192.168.10.2 moved from 00:1d:73:a3:7b:d5 to 34:6b:d3:52:0b:8f on em0
    Nov 27 11:14:36 php-fpm[89283]: /rc.dyndns.update: phpDynDNS (www.domain): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 27 11:14:35 php-fpm[53075]: /rc.newwanip: phpDynDNS: (Success) IP Address Updated Successfully!
    Nov 27 11:14:35 php-fpm[53075]: /rc.newwanip: phpDynDNS: updating cache file /conf/dyndns_wancustom'www.domain'0.cache: 2.97.215.131
    Nov 27 11:14:35 check_reload_status: updating dyndns wan
    Nov 27 11:14:34 php-fpm[53075]: /rc.newwanip: ROUTING: setting default route to 2.97.208.1
    Nov 27 11:14:34 php-fpm[53075]: /rc.newwanip: IP has changed, killing states on former IP 92.29.127.217.
    Nov 27 11:14:32 check_reload_status: Rewriting resolv.conf
    Nov 27 11:14:30 php-fpm[64511]: /interfaces.php: Starting 3gstats.php on device '' for interface 'wan'
    Nov 27 11:14:29 check_reload_status: Rewriting resolv.conf
    Nov 27 11:14:29 php: rc.kill_states: rc.kill_states: Removing states for IP 92.29.127.217/32
    Nov 27 11:14:26 check_reload_status: Syncing firewall
    Nov 27 11:11:53 check_reload_status: Syncing firewall
    Nov 27 11:11:52 php-fpm[77375]: /index.php: webConfigurator authentication error for 'admin' from 192.168.10.3
    Nov 27 11:11:52 php-fpm[77375]: /index.php: webConfigurator authentication error for 'admin' from 192.168.10.3
    Nov 27 11:11:42 php-fpm[53636]: /index.php: Successful login for user 'admin' from: 192.168.10.3
    Nov 27 11:11:42 php-fpm[53636]: /index.php: Successful login for user 'admin' from: 192.168.10.3
    Nov 27 11:11:38 php-fpm[53636]: /index.php: webConfigurator authentication error for 'admin' from 192.168.10.3
    Nov 27 11:11:38 php-fpm[53636]: /index.php: webConfigurator authentication error for 'admin' from 192.168.10.3


    Net access was lost sometime between these two entries, so I logged in to see what was going on. pf was still reporting connection was all ok.


    Nov 27 10:29:17 kernel: arp: 192.168.10.2 moved from 00:1d:73:a3:7b:d5 to 34:6b:d3:52:0b:8f on em0
    Nov 27 10:28:26 kernel: arp: 192.168.10.2 moved from 00:1d:73:a3:7b:d5 to 34:6b:d3:52:0b:8f on em0
    Nov 27 10:27:21 kernel: arp: 192.168.10.2 moved from 34:6b:d3:52:0b:8f to 00:1d:73:a3:7b:d5 on em0
    Nov 27 10:26:29 SnortStartup[3764]: Ignoring additional START command since Snort is already starting…
    Nov 27 10:26:29 php-fpm[48535]: /rc.filter_configure_sync: Could not find IPv6 gateway for interface(wan).
    Nov 27 10:26:29 php-fpm[10916]: /rc.start_packages: Restarting/Starting all packages.
    Nov 27 10:26:28 check_reload_status: Reloading filter
    Nov 27 10:26:28 check_reload_status: Starting packages
    Nov 27 10:26:28 php-fpm[10916]: /rc.newwanip: pfSense package system has detected an IP change or dynamic WAN reconnection - 92.17.178.23 -> 92.29.127.217 - Restarting packages.



  • You have at least two IP conflicts there. One on 192.168.10.10, between something in VMware and some Intel NIC. Also on 192.168.10.2, between a Buffalo device and a Huawei device. Depending on what those IPs are, it's likely that's contributing to the issue if not causing it. I don't see any indications there that any state deletion is needed that isn't happening.



  • There is no ip address conflict, pfsense is picking up me switching my laptop wifi on before unplugging the laptop lan cable and vice versa through out the day.

    Each device has been assigned its own unique ip address so theres no conflict going on, but as I have a VM guest running on my laptop at the moment sometimes two or three, the guest(s) only have one nic which are bridged, but the guests never detects the physical wifi/lan change over going on, just the laptop OS and pfsense.

    The Buffalo HD & Huawei are not conflicting either, they each have their own ip address so I'll see if the laptop wifi/lan change over is affecting them. I'm not accessing either from the laptop and the buffalo software for windows needed to access it has not been installed yet and with windows discovery off, there shouldnt really be any reason for the buffalo to be affected. Huwei is a tv set top box which cant be accessed other from a tv, although it still does it basic networking checks to see whats around and so on.

    I dont know if this would be possible, but where we have the Device manufacturer details below the mac id's in the status_dhcp_leases.php page, could those manufacturer names appear in the system log as well. even if only limited to the first x chars to preserve width?

    Edit: Just been trying to see why only the laptop wifi was switching with the vm guest in the kernel arps, the laptops lan nic is static mapped, where as the wifi is dhcp assigned, hence the change over appearing for the vm in the system log.



  • Now that both the lan & wifi are static mapped, I'll have to see how it affects the states as the sip server is on the vm guest so that could explain why my states have needed to be reset.

    I'll have a little play around with this over the next few days and see whats what as I also need to test a few other things still.



  • Just to confirm - this works on my configuration.

    pfSense 2.2-BETA (amd64) built on Thu Nov 27 09:03:10 CST 2014

    Run on PC Engines APU

    This refers to my SIP server - when losing the gateway connection, and once re-established, the State Table appears to get reset and cleared out - resulting in the SIP server (PIAF, Asterisk) re-connecting.

    I tested this rather simply by pulling the WAN cable from the back of the pfSense box. Waiting for the Dashboard to indicate lack of connection. Testing that the connection is lost via a test phone call. Then plugging the WAN plug back in, and making a test phone call.

    This works.



  • In all the tests I have done by pulling out the wan cable, the state tables have refreshed as would be expected, but when the wan connection goes down because of the ISP doing something, my wan connection would go down and not come up again until I did the save wan and apply.

    The pppoe for the wan was using the default gateway to test if the wan had gone down or not, I've since changed that yesterday to a different ip address and so far nearly 24hrs the wan connection has yet to go down, so I'm still waiting for that event to see how the pppoe and wan behave.

    When that happens I can see how the state tables behave, but I have not had to reset the state tables every time I've done the wan save apply, only some of the time and I have yet to establish the pattern/events that dont reset the state table.

    I'm just going to have to wait until the wan gets dropped by the isp and see what happens the next few times it occurs.

    However since making the wifi a static ip last night, pfsense still picks up when I move from wifi to cable and back again. Whether this has something to do with the state tables not resetting as its running on the laptop as a vm guest I dont know. But this VM guest setup of mine might also be the difference with your setup.



  • 2.2-BETA (amd64)
    built on Wed Nov 26 15:27:11 CST 2014
    FreeBSD 10.1-RELEASE

    Still not working properly.

    Wan dropped and not come back up. Did the wan, save & apply, got back online, checked I could access the web, then tried contacting my sip server, no response, so I deleted the states and got connected to the sip automatically.

    I see in the PPP log, its being reported '/var/etc/mpd_wan.conf does not exist, I've just checked and its still there. This has been happening across a few beta versions recently.

    Also noticed this entry.
    Nov 30 18:07:58 php-fpm[63861]: /rc.newwanip: pfSense package system has detected an IP change or dynamic WAN reconnection - -> 192.168.5.1 - Restarting packages.

    I'm not using the 192.168.5.x range for anything here, dont know where pfsense is getting this from at all.

    Anything else I can check before I upgrade to the latest version and lose the logs?

    Status log.

    Nov 30 18:08:24 snort[30363]: FATAL ERROR: Can't start DAQ (-1) - BIOCSETIF failed: Device not configured!
    Nov 30 18:08:23 lighttpd[32042]: (connections.c.1692) SSL (error): 5 -1 1 Operation not permitted
    Nov 30 18:08:16 kernel: pid 28743 (ntpd), uid 0: exited on signal 11 (core dumped)
    Nov 30 18:07:59 php-fpm[63861]: /rc.start_packages: Restarting/Starting all packages.
    Nov 30 18:07:58 check_reload_status: Starting packages
    Nov 30 18:07:58 php-fpm[63861]: /rc.newwanip: pfSense package system has detected an IP change or dynamic WAN reconnection - -> 192.168.5.1 - Restarting packages.
    Nov 30 18:07:58 check_reload_status: Reloading filter
    Nov 30 18:07:58 php-fpm[63861]: /rc.newwanip: rc.newwanip: on (IP address: 192.168.5.1) (interface: []) (real interface: ovpns1).
    Nov 30 18:07:58 php-fpm[63861]: /rc.newwanip: rc.newwanip: Info: starting on ovpns1.
    Nov 30 18:07:57 lighttpd[32042]: (connections.c.1692) SSL (error): 5 -1 1 Operation not permitted
    Nov 30 18:07:57 lighttpd[32042]: (connections.c.619) connection closed: write failed on fd 17
    Nov 30 18:07:57 lighttpd[32042]: (network_openssl.c.118) SSL: 5 -1 1 Operation not permitted
    Nov 30 18:07:57 lighttpd[32042]: (connections.c.1692) SSL (error): 5 -1 1 Operation not permitted
    Nov 30 18:07:57 lighttpd[32042]: (connections.c.619) connection closed: write failed on fd 19
    Nov 30 18:07:57 lighttpd[32042]: (network_openssl.c.118) SSL: 5 -1 1 Operation not permitted
    Nov 30 18:07:57 check_reload_status: rc.newwanip starting ovpns1
    Nov 30 18:07:57 kernel: ovpns1: link state changed to UP
    Nov 30 18:07:57 php-fpm[63861]: /rc.openvpn: OpenVPN: Resync client3 HTC Hero VPN
    Nov 30 18:07:56 php-fpm[63861]: /rc.openvpn: OpenVPN: Resync client2 Laptop OpenVPN client connection
    Nov 30 18:07:56 check_reload_status: Reloading filter
    Nov 30 18:07:56 kernel: ovpns1: link state changed to DOWN
    Nov 30 18:07:56 php-fpm[63861]: /rc.openvpn: OpenVPN: Resync server1 Wan OpenVPN
    Nov 30 18:07:56 php-fpm[63861]: /rc.openvpn: OpenVPN: One or more OpenVPN tunnel endpoints may have changed its IP. Reloading endpoints that may use WAN_PPPOE.
    Nov 30 18:07:55 check_reload_status: Reloading filter
    Nov 30 18:07:55 check_reload_status: Restarting OpenVPN tunnels/interfaces
    Nov 30 18:07:55 check_reload_status: Restarting ipsec tunnels
    Nov 30 18:07:55 check_reload_status: updating dyndns WAN_PPPOE
    Nov 30 18:07:39 check_reload_status: updating dyndns wan
    Nov 30 18:07:35 php-fpm[24445]: /rc.linkup: Starting 3gstats.php on device '' for interface 'wan'
    Nov 30 18:07:35 php-fpm[24445]: /rc.linkup: HOTPLUG: Configuring interface wan
    Nov 30 18:07:35 php-fpm[24445]: /rc.linkup: DEVD Ethernet attached event for wan
    Nov 30 18:07:35 check_reload_status: Rewriting resolv.conf
    Nov 30 18:07:34 php: rc.kill_states: rc.kill_states: Removing states for IP 2.97.215.131/32
    Nov 30 18:07:34 php-fpm[10072]: /rc.linkup: DEVD Ethernet detached event for wan
    Nov 30 18:07:33 check_reload_status: Linkup starting ue0
    Nov 30 18:07:33 devd: Executing '/usr/local/sbin/pfSctl -c 'interface linkup start ue0''
    Nov 30 18:07:33 check_reload_status: Linkup starting ue0
    Nov 30 18:07:33 devd: Executing '/usr/local/sbin/pfSctl -c 'interface linkup stop ue0''
    Nov 30 18:07:33 kernel: ue0: link state changed to UP
    Nov 30 18:07:33 kernel: ue0: link state changed to DOWN
    Nov 30 18:05:02 check_reload_status: Syncing firewall
    Nov 30 18:05:02 php: snort_check_for_rule_updates.php: [Snort] The Rules update has finished.
    Nov 30 18:05:02 php: snort_check_for_rule_updates.php: [Snort] Emerging Threats Open rules are up to date…
    Nov 30 18:05:02 php: snort_check_for_rule_updates.php: [Snort] Snort GPLv2 Community Rules are up to date…
    Nov 30 18:05:01 php: snort_check_for_rule_updates.php: [Snort] Server returned error code 422…
    Nov 30 18:05:01 php: snort_check_for_rule_updates.php: [Snort] Snort VRT rules md5 download failed…
    Nov 30 17:43:55 php-fpm[78338]: /rc.dyndns.update: phpDynDNS (smtp.domain.com): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 30 17:43:54 php-fpm[78338]: /rc.dyndns.update: phpDynDNS (sip.domain.co.uk): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 30 17:43:53 php-fpm[78338]: /rc.dyndns.update: phpDynDNS (sip.domain.com): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 30 17:43:52 php-fpm[78338]: /rc.dyndns.update: phpDynDNS (mail.domain.co.uk): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 30 17:43:51 php-fpm[78338]: /rc.dyndns.update: phpDynDNS (www.domain.co.uk): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 30 17:43:50 php-fpm[94487]: /rc.start_packages: Restarting/Starting all packages.
    Nov 30 17:43:50 php-fpm[94487]: /rc.filter_configure_sync: Could not find IPv6 gateway for interface(wan).
    Nov 30 17:43:50 php-fpm[78338]: /rc.dyndns.update: phpDynDNS (domain.co.uk): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 30 17:43:49 check_reload_status: Starting packages
    Nov 30 17:43:49 php-fpm[87976]: /rc.newwanip: pfSense package system has detected an IP change or dynamic WAN reconnection - -> 192.168.5.1 - Restarting packages.
    Nov 30 17:43:49 check_reload_status: Reloading filter
    Nov 30 17:43:49 php-fpm[87976]: /rc.newwanip: rc.newwanip: on (IP address: 192.168.5.1) (interface: []) (real interface: ovpns1).
    Nov 30 17:43:49 php-fpm[87976]: /rc.newwanip: rc.newwanip: Info: starting on ovpns1.
    Nov 30 17:43:49 php-fpm[78338]: /rc.dyndns.update: phpDynDNS (mail.domain.com): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 30 17:43:49 php-fpm[94487]: /rc.filter_configure_sync: Could not find IPv6 gateway for interface(wan).
    Nov 30 17:43:49 php-fpm[87976]: /rc.filter_configure_sync: Could not find IPv6 gateway for interface(wan).
    Nov 30 17:43:48 php-fpm[87976]: /rc.openvpn: OpenVPN: Resync client3 HTC Hero VPN
    Nov 30 17:43:48 check_reload_status: rc.newwanip starting ovpns1
    Nov 30 17:43:48 kernel: ovpns1: link state changed to UP
    Nov 30 17:43:48 php-fpm[78338]: /rc.dyndns.update: phpDynDNS (domain.com): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 30 17:43:48 php-fpm[87976]: /rc.openvpn: OpenVPN: Resync client2 Laptop OpenVPN client connection
    Nov 30 17:43:48 check_reload_status: Reloading filter
    Nov 30 17:43:48 kernel: ovpns1: link state changed to DOWN
    Nov 30 17:43:48 php-fpm[87976]: /rc.openvpn: OpenVPN: Resync server1 Wan OpenVPN
    Nov 30 17:43:48 php-fpm[87976]: /rc.openvpn: OpenVPN: One or more OpenVPN tunnel endpoints may have changed its IP. Reloading endpoints that may use WAN_PPPOE.
    Nov 30 17:43:47 php-fpm[78338]: /rc.dyndns.update: phpDynDNS (www.domain.com): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 30 17:43:46 check_reload_status: Reloading filter
    Nov 30 17:43:46 check_reload_status: Restarting OpenVPN tunnels/interfaces
    Nov 30 17:43:46 check_reload_status: Restarting ipsec tunnels
    Nov 30 17:43:46 check_reload_status: updating dyndns WAN_PPPOE
    Nov 30 17:43:39 php-fpm[36934]: /rc.dyndns.update: phpDynDNS (smtp.domain.com): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 30 17:43:38 php-fpm[36934]: /rc.dyndns.update: phpDynDNS (sip.domain.co.uk): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 30 17:43:37 php-fpm[36934]: /rc.dyndns.update: phpDynDNS (sip.domain.com): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 30 17:43:36 php-fpm[36934]: /rc.dyndns.update: phpDynDNS (mail.domain.co.uk): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 30 17:43:35 php-fpm[36934]: /rc.dyndns.update: phpDynDNS (www.domain.co.uk): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 30 17:43:34 php-fpm[54094]: /rc.start_packages: Restarting/Starting all packages.
    Nov 30 17:43:34 php-fpm[54094]: /rc.filter_configure_sync: Could not find IPv6 gateway for interface(wan).
    Nov 30 17:43:34 php-fpm[36934]: /rc.dyndns.update: phpDynDNS (domain.co.uk): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 30 17:43:33 check_reload_status: Starting packages
    Nov 30 17:43:33 php-fpm[46295]: /rc.newwanip: pfSense package system has detected an IP change or dynamic WAN reconnection - -> 192.168.5.1 - Restarting packages.
    Nov 30 17:43:33 check_reload_status: Reloading filter
    Nov 30 17:43:33 php-fpm[46295]: /rc.newwanip: rc.newwanip: on (IP address: 192.168.5.1) (interface: []) (real interface: ovpns1).
    Nov 30 17:43:33 php-fpm[46295]: /rc.newwanip: rc.newwanip: Info: starting on ovpns1.
    Nov 30 17:43:33 php-fpm[36934]: /rc.dyndns.update: phpDynDNS (mail.domain.com): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 30 17:43:33 php-fpm[54094]: /rc.filter_configure_sync: Could not find IPv6 gateway for interface(wan).
    Nov 30 17:43:33 php-fpm[46295]: /rc.filter_configure_sync: Could not find IPv6 gateway for interface(wan).
    Nov 30 17:43:32 php-fpm[46295]: /rc.openvpn: OpenVPN: Resync client3 HTC Hero VPN
    Nov 30 17:43:32 check_reload_status: rc.newwanip starting ovpns1
    Nov 30 17:43:32 kernel: ovpns1: link state changed to UP
    Nov 30 17:43:32 php-fpm[46295]: /rc.openvpn: OpenVPN: Resync client2 Laptop OpenVPN client connection
    Nov 30 17:43:32 php-fpm[36934]: /rc.dyndns.update: phpDynDNS (domain.com): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 30 17:43:32 check_reload_status: Reloading filter
    Nov 30 17:43:32 kernel: ovpns1: link state changed to DOWN
    Nov 30 17:43:32 php-fpm[46295]: /rc.openvpn: OpenVPN: Resync server1 Wan OpenVPN
    Nov 30 17:43:32 php-fpm[46295]: /rc.openvpn: OpenVPN: One or more OpenVPN tunnel endpoints may have changed its IP. Reloading endpoints that may use WAN_PPPOE.
    Nov 30 17:43:31 php-fpm[36934]: /rc.dyndns.update: phpDynDNS (www.domain.com): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
    Nov 30 17:43:30 check_reload_status: Reloading filter
    Nov 30 17:43:30 check_reload_status: Restarting OpenVPN tunnels/interfaces
    Nov 30 17:43:30 check_reload_status: Restarting ipsec tunnels
    Nov 30 17:43:30 check_reload_status: updating dyndns WAN_PPPOE
    Nov 30 17:42:57 kernel: arp: 192.168.10.30 moved from 00:21:6a:55:41:6a to 00:0c:29:01:89:be on em0
    Nov 30 17:42:49 kernel: arp: 192.168.10.10 moved from 00:21:6a:55:41:6a to 00:0c:29:3c:7d:dc on em0
    Nov 30 17:41:38 php-fpm[82911]: /index.php: Successful login for user 'admin' from: 192.168.10.3
    Nov 30 17:41:38 php-fpm[82911]: /index.php: Successful login for user 'admin' from: 192.168.10.3
    Nov 30 16:14:10 php-fpm[87545]: /index.php: Successful login for user 'admin' from: 192.168.10.3
    Nov 30 16:14:10 php-fpm[87545]: /index.php: Successful login for user 'admin' from: 192.168.10.3
    Nov 30 14:58:28 php-fpm[874]: /index.php: Successful login for user 'admin' from: 192.168.10.4
    Nov 30 14:58:28 php-fpm[874]: /index.php: Successful login for user 'admin' from: 192.168.10.4
    Nov 30 14:42:23 php-fpm[80351]: /index.php: Successful login for user 'admin' from: 192.168.10.3
    Nov 30 14:42:23 php-fpm[80351]: /index.php: Successful login for user 'admin' from: 192.168.10.3

    PPP Log.
    Nov 30 18:14:17 ppp: [wan] IFACE: Rename interface ng0 to pppoe0
    Nov 30 18:14:17 ppp: [wan] IFACE: Up event
    Nov 30 18:14:16 ppp: [wan] 92.29.126.192 -> 92.29.112.1
    Nov 30 18:14:16 ppp: [wan] IPCP: LayerUp
    Nov 30 18:14:16 ppp: [wan] IPCP: state change Ack-Sent –> Opened
    Nov 30 18:14:16 ppp: [wan] SECDNS 78.151.235.132
    Nov 30 18:14:16 ppp: [wan] PRIDNS 78.151.235.3
    Nov 30 18:14:16 ppp: [wan] IPADDR 92.29.126.192
    Nov 30 18:14:16 ppp: [wan] IPCP: rec'd Configure Ack #3 (Ack-Sent)
    Nov 30 18:14:16 ppp: [wan] SECDNS 78.151.235.132
    Nov 30 18:14:16 ppp: [wan] PRIDNS 78.151.235.3
    Nov 30 18:14:16 ppp: [wan] IPADDR 92.29.126.192
    Nov 30 18:14:16 ppp: [wan] IPCP: SendConfigReq #3
    Nov 30 18:14:16 ppp: [wan] SECDNS 78.151.235.132
    Nov 30 18:14:16 ppp: [wan] PRIDNS 78.151.235.3
    Nov 30 18:14:16 ppp: [wan] 92.29.126.192 is OK
    Nov 30 18:14:16 ppp: [wan] IPADDR 92.29.126.192
    Nov 30 18:14:16 ppp: [wan] IPCP: rec'd Configure Nak #2 (Ack-Sent)
    Nov 30 18:14:16 ppp: [wan] IPV6CP: LayerFinish
    Nov 30 18:14:16 ppp: [wan] IPV6CP: state change Req-Sent –> Stopped
    Nov 30 18:14:16 ppp: [wan] IPV6CP: protocol was rejected by peer
    Nov 30 18:14:16 ppp: [wan_link0] LCP: protocol IPV6CP was rejected
    Nov 30 18:14:16 ppp: [wan_link0] LCP: rec'd Protocol Reject #225 (Opened)
    Nov 30 18:14:16 ppp: [wan] SECDNS 0.0.0.0
    Nov 30 18:14:16 ppp: [wan] PRIDNS 0.0.0.0
    Nov 30 18:14:16 ppp: [wan] IPADDR 0.0.0.0
    Nov 30 18:14:16 ppp: [wan] IPCP: SendConfigReq #2
    Nov 30 18:14:16 ppp: [wan] COMPPROTO VJCOMP, 16 comp. channels, no comp-cid
    Nov 30 18:14:16 ppp: [wan] IPCP: rec'd Configure Reject #1 (Ack-Sent)
    Nov 30 18:14:16 ppp: [wan] IPCP: state change Req-Sent –> Ack-Sent
    Nov 30 18:14:16 ppp: [wan] IPADDR 92.29.112.1
    Nov 30 18:14:16 ppp: [wan] IPCP: SendConfigAck #245
    Nov 30 18:14:16 ppp: [wan] 92.29.112.1 is OK
    Nov 30 18:14:16 ppp: [wan] IPADDR 92.29.112.1
    Nov 30 18:14:16 ppp: [wan] IPCP: rec'd Configure Request #245 (Req-Sent)
    Nov 30 18:14:16 ppp: [wan] IPV6CP: SendConfigReq #1
    Nov 30 18:14:16 ppp: [wan] IPV6CP: state change Starting –> Req-Sent
    Nov 30 18:14:16 ppp: [wan] IPV6CP: Up event
    Nov 30 18:14:16 ppp: [wan] SECDNS 0.0.0.0
    Nov 30 18:14:16 ppp: [wan] PRIDNS 0.0.0.0
    Nov 30 18:14:16 ppp: [wan] COMPPROTO VJCOMP, 16 comp. channels, no comp-cid
    Nov 30 18:14:16 ppp: [wan] IPADDR 0.0.0.0
    Nov 30 18:14:16 ppp: [wan] IPCP: SendConfigReq #1
    Nov 30 18:14:16 ppp: [wan] IPCP: state change Starting –> Req-Sent
    Nov 30 18:14:16 ppp: [wan] IPCP: Up event
    Nov 30 18:14:16 ppp: [wan] IPV6CP: LayerStart
    Nov 30 18:14:16 ppp: [wan] IPV6CP: state change Initial –> Starting
    Nov 30 18:14:16 ppp: [wan] IPV6CP: Open event
    Nov 30 18:14:16 ppp: [wan] IPCP: LayerStart
    Nov 30 18:14:16 ppp: [wan] IPCP: state change Initial –> Starting
    Nov 30 18:14:16 ppp: [wan] IPCP: Open event
    Nov 30 18:14:16 ppp: [wan] Bundle: Status update: up 1 link, total bandwidth 64000 bps
    Nov 30 18:14:16 ppp: [wan_link0] Link: Join bundle "wan"
    Nov 30 18:14:16 ppp: [wan_link0] Link: Matched action 'bundle "wan" ""'
    Nov 30 18:14:16 ppp: [wan_link0] LCP: authorization successful
    Nov 30 18:14:16 ppp: [wan_link0] MESG: CHAP authentication success, unit 8594
    Nov 30 18:14:16 ppp: [wan_link0] CHAP: rec'd SUCCESS #1 len: 42
    Nov 30 18:14:16 ppp: [wan_link0] CHAP: sending RESPONSE #1 len: 45
    Nov 30 18:14:16 ppp: [wan_link0] CHAP: Using authname "username"
    Nov 30 18:14:16 ppp: [wan_link0] Name: "npe001.ips"
    Nov 30 18:14:16 ppp: [wan_link0] CHAP: rec'd CHALLENGE #1 len: 31
    Nov 30 18:14:16 ppp: [wan_link0] LCP: LayerUp
    Nov 30 18:14:16 ppp: [wan_link0] LCP: auth: peer wants CHAP, I want nothing
    Nov 30 18:14:16 ppp: [wan_link0] LCP: state change Ack-Sent –> Opened
    Nov 30 18:14:16 ppp: [wan_link0] MAGICNUM 21a71bf8
    Nov 30 18:14:16 ppp: [wan_link0] MRU 1492
    Nov 30 18:14:16 ppp: [wan_link0] LCP: rec'd Configure Ack #2 (Ack-Sent)
    Nov 30 18:14:16 ppp: [wan_link0] MAGICNUM 21a71bf8
    Nov 30 18:14:16 ppp: [wan_link0] MRU 1492
    Nov 30 18:14:16 ppp: [wan_link0] LCP: SendConfigReq #2
    Nov 30 18:14:16 ppp: [wan_link0] PROTOCOMP
    Nov 30 18:14:16 ppp: [wan_link0] LCP: rec'd Configure Reject #1 (Ack-Sent)
    Nov 30 18:14:16 ppp: [wan_link0] LCP: state change Req-Sent –> Ack-Sent
    Nov 30 18:14:16 ppp: [wan_link0] MAGICNUM 4ac66ec3
    Nov 30 18:14:16 ppp: [wan_link0] AUTHPROTO CHAP MD5
    Nov 30 18:14:16 ppp: [wan_link0] MRU 1492
    Nov 30 18:14:16 ppp: [wan_link0] LCP: SendConfigAck #224
    Nov 30 18:14:16 ppp: [wan_link0] MAGICNUM 4ac66ec3
    Nov 30 18:14:16 ppp: [wan_link0] AUTHPROTO CHAP MD5
    Nov 30 18:14:16 ppp: [wan_link0] MRU 1492
    Nov 30 18:14:16 ppp: [wan_link0] LCP: rec'd Configure Request #224 (Req-Sent)
    Nov 30 18:14:16 ppp: [wan_link0] MAGICNUM 21a71bf8
    Nov 30 18:14:16 ppp: [wan_link0] MRU 1492
    Nov 30 18:14:16 ppp: [wan_link0] PROTOCOMP
    Nov 30 18:14:16 ppp: [wan_link0] LCP: SendConfigReq #1
    Nov 30 18:14:16 ppp: [wan_link0] LCP: state change Starting –> Req-Sent
    Nov 30 18:14:16 ppp: [wan_link0] LCP: Up event
    Nov 30 18:14:16 ppp: [wan_link0] Link: UP event
    Nov 30 18:14:16 ppp: [wan_link0] PPPoE: connection successful
    Nov 30 18:14:16 ppp: PPPoE: rec'd ACNAME "npe001.ips-B22"
    Nov 30 18:14:16 ppp: [wan_link0] PPPoE: Connecting to ''
    Nov 30 18:14:16 ppp: [wan_link0] LCP: LayerStart
    Nov 30 18:14:16 ppp: [wan_link0] LCP: state change Initial –> Starting
    Nov 30 18:14:16 ppp: [wan_link0] LCP: Open event
    Nov 30 18:14:16 ppp: [wan_link0] Link: OPEN event
    Nov 30 18:14:16 ppp: [wan] Bundle: Interface ng0 created
    Nov 30 18:14:16 ppp: web: web is not running
    Nov 30 18:14:16 ppp: process 83714 started, version 5.7 (root@pfsense-22-amd64-builder 12:58 18-Nov-2014)
    Nov 30 18:14:16 ppp:
    Nov 30 18:14:16 ppp: Multi-link PPP daemon for FreeBSD
    Nov 30 18:07:37 ppp: process 25371 terminated
    Nov 30 18:07:37 ppp: can't read configuration for "pppoeclient"
    Nov 30 18:07:37 ppp: OpenConfFile: Can't open file '/var/etc/mpd_wan.conf': No such file or directory
    Nov 30 18:07:37 ppp: OpenConfFile: Can't open file '/var/etc/mpd_wan.conf': No such file or directory
    Nov 30 18:07:37 ppp: process 76355 terminated
    Nov 30 18:07:37 ppp: [wan_link0] Link: Shutdown
    Nov 30 18:07:37 ppp: [wan] Bundle: Shutdown
    Nov 30 18:07:36 ppp: [wan_link0] LCP: state change Closing –> Initial
    Nov 30 18:07:36 ppp: [wan_link0] LCP: LayerFinish
    Nov 30 18:07:36 ppp: [wan_link0] LCP: Down event
    Nov 30 18:07:36 ppp: [wan_link0] Link: DOWN event
    Nov 30 18:07:36 ppp: [wan_link0] PPPoE: connection closed
    Nov 30 18:07:36 ppp: waiting for process 76355 to die…
    Nov 30 18:07:35 ppp: waiting for process 76355 to die...
    Nov 30 18:07:35 ppp: process 25371 started, version 5.7 (root@pfsense-22-amd64-builder 12:58 18-Nov-2014)
    Nov 30 18:07:35 ppp:
    Nov 30 18:07:35 ppp: Multi-link PPP daemon for FreeBSD
    Nov 30 18:07:35 ppp: [wan_link0] LCP: state change Stopping –> Closing
    Nov 30 18:07:35 ppp: [wan_link0] LCP: Close event
    Nov 30 18:07:35 ppp: [wan_link0] Link: CLOSE event
    Nov 30 18:07:35 ppp: [wan_link0] LCP: LayerDown
    Nov 30 18:07:35 ppp: [wan_link0] LCP: SendTerminateAck #3
    Nov 30 18:07:35 ppp: [wan] IPV6CP: state change Closed –> Initial
    Nov 30 18:07:35 ppp: [wan] IPV6CP: Down event
    Nov 30 18:07:35 ppp: [wan] IPCP: state change Closed –> Initial
    Nov 30 18:07:35 ppp: [wan] IPCP: Down event
    Nov 30 18:07:35 ppp: [wan] IPV6CP: Close event
    Nov 30 18:07:35 ppp: [wan] IPCP: Close event
    Nov 30 18:07:35 ppp: [wan] Bundle: Status update: up 0 links, total bandwidth 9600 bps
    Nov 30 18:07:35 ppp: [wan_link0] Link: Leave bundle "wan"
    Nov 30 18:07:35 ppp: [wan_link0] LCP: state change Opened –> Stopping
    Nov 30 18:07:35 ppp: [wan_link0] LCP: rec'd Terminate Request #163 (Opened)
    Nov 30 18:07:35 ppp: [wan] Bundle: closing link "wan_link0"…
    Nov 30 18:07:35 ppp: [wan] Bundle: No NCPs left. Closing links…
    Nov 30 18:07:35 ppp: [wan] IPCP: LayerFinish
    Nov 30 18:07:35 ppp: [wan] IPCP: state change Closing –> Closed
    Nov 30 18:07:35 ppp: [wan] IPCP: rec'd Terminate Ack #4 (Closing)
    Nov 30 18:07:35 ppp: [wan] IPV6CP: state change Stopped –> Closed
    Nov 30 18:07:35 ppp: [wan] IPV6CP: Close event
    Nov 30 18:07:35 ppp: [wan] IFACE: Rename interface pppoe0 to pppoe0
    Nov 30 18:07:35 ppp: [wan] IFACE: Down event
    Nov 30 18:07:35 ppp: [wan] IFACE: Delete route 0.0.0.0/0 2.97.208.1 failed: No such process
    Nov 30 18:07:34 ppp: [wan] IPCP: LayerDown
    Nov 30 18:07:34 ppp: [wan] IPCP: SendTerminateReq #4
    Nov 30 18:07:34 ppp: [wan] IPCP: state change Opened –> Closing
    Nov 30 18:07:34 ppp: [wan] IPCP: Close event
    Nov 30 18:07:34 ppp: [wan] IFACE: Close event
    Nov 30 18:07:34 ppp: caught fatal signal TERM
    Nov 27 11:14:33 ppp: [wan] IFACE: Rename interface ng0 to pppoe0
    Nov 27 11:14:33 ppp: [wan] IFACE: Up event
    Nov 27 11:14:32 ppp: [wan] 2.97.215.131 -> 2.97.208.1
    Nov 27 11:14:32 ppp: [wan] IPCP: LayerUp
    Nov 27 11:14:32 ppp: [wan] IPCP: state change Ack-Sent –> Opened
    Nov 27 11:14:32 ppp: [wan] SECDNS 78.151.235.132
    Nov 27 11:14:32 ppp: [wan] PRIDNS 78.151.235.3
    Nov 27 11:14:32 ppp: [wan] IPADDR 2.97.215.131
    Nov 27 11:14:32 ppp: [wan] IPCP: rec'd Configure Ack #3 (Ack-Sent)
    Nov 27 11:14:32 ppp: [wan] SECDNS 78.151.235.132
    Nov 27 11:14:32 ppp: [wan] PRIDNS 78.151.235.3
    Nov 27 11:14:32 ppp: [wan] IPADDR 2.97.215.131
    Nov 27 11:14:32 ppp: [wan] IPCP: SendConfigReq #3
    Nov 27 11:14:32 ppp: [wan] SECDNS 78.151.235.132
    Nov 27 11:14:32 ppp: [wan] PRIDNS 78.151.235.3
    Nov 27 11:14:32 ppp: [wan] 2.97.215.131 is OK
    Nov 27 11:14:32 ppp: [wan] IPADDR 2.97.215.131