Loosing internet connection random

[Killertjuh]

Dear,

I have a problem with my internet connection. Its random down for a few minuts.
Ill have made a script that pings 8.8.8.8 and when this down ill generate some logs. Can someone help me with this problem?

Here you have the script:

#!/bin/sh

host=$1
log=/root/troubleshoot.log

if [ -z $host ]; then
    echo "Usage: `basename $0` [HOST]"
    exit 1
fi

while :; do
    result=`ping -c 1 $host | grep 'bytes from '`
    if [ $? -gt 0 ]; then
        echo -e "`date +'%Y/%m/%d %H:%M:%S'` - host $host is \033[0;31mdown\033[0m"
          netstat -r >> $log
          ifconfig >> $log
          tail -n 20 /var/log/system.log >> $log
          traceroute 8.8.8.8 >> $log
          arp -an >> $log
       echo ------ >> $log
       echo -e ---------------- `date +'%Y/%m/%d %H:%M:%S'` ----------------- >> $log
         sleep 30 #avoid logging
        else
         echo -e "`date +'%Y/%m/%d %H:%M:%S'` - host $host is \033[0;32mok\033[0m -`echo $result | cut -d ':' -f 2`"
        sleep 30 # avoid ping rain
    fi
done
[/code]

Here you have the logging. Its strange that i`ll get something like ^@^@^@^@
[code]---------------- 2015/10/18 21:57:51 -----------------
Routing tables

Internet:
Destination        Gateway            Flags      Netif Expire
default            192.168.178.1      UGS         em0
localhost          link#5             UH          lo0
192.168.1.0        link#2             U           em1
pfSense            link#2             UHS         lo0
192.168.178.0      link#1             U           em0
192.168.178.3      link#1             UHS         lo0

Internet6:
Destination        Gateway            Flags      Netif Expire
localhost          link#5             UH          lo0
fe80::%em0         link#1             U           em0
fe80::20c:29ff:fe8 link#1             UHS         lo0
fe80::%em1         link#2             U           em1
fe80::20c:29ff:fe8 link#2             UHS         lo0
fe80::%lo0         link#5             U           lo0
fe80::1%lo0        link#5             UHS         lo0
ff01::%em0         fe80::20c:29ff:fe8 U           em0
ff01::%em1         fe80::20c:29ff:fe8 U           em1
ff01::%lo0         localhost          U           lo0
ff02::%em0         fe80::20c:29ff:fe8 U           em0
ff02::%em1         fe80::20c:29ff:fe8 U           em1
ff02::%lo0         localhost          U           lo0
em0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
        options=9b <rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum>ether 00:0c:29:8b:3c:b6
        inet6 fe80::20c:29ff:fe8b:3cb6%em0 prefixlen 64 scopeid 0x1
@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^
@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^
@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^
@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^
@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^
@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^
@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^
@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^
@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^
@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^
@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@CLOG^@^@^@^@;\x94^@^@\xec\xcd^G^@^@^@^@^@ 1  * * *
 2  * * *
 3  * * *
 4  * * *
 5  * * *
 6  * * *
 7  * * *
 8  * * *
 9  * * *
10  * * *
11  * * *
12  * * *
13  * * *
14  * * *
15  * * *
16  * * *
17  * * *
18  * * *
19  * * *
20  * * *
21  * * *
22  * * *
23  * * *
24  * * *
25  * * *
26  * * *
27  * * *
28  * * *
29  * * *
30  * * *
31  * * *
32  * * *
33  * * *
34  * * *
35  * * *
36  * * *
37  * * *
38  * * *
39  * * *
40  * * *
41  * * *
42  * * *
43  * * *
44  * * *
45  * * *
46  * * *
47  * * *
48  * * *
49  * * *
50  * * *
51  * * *
52  * * *
53  * * *
54  * * *
55  * * *
56  * * *
57  * * *
58  * * *
59  * * *
60  * * *
61  * * *
62  * * *
63  * * *
64  * * *
? (192.168.1.201) at 00:0c:29:5e:0f:2a on em1 expires in 1193 seconds [ethernet]
? (192.168.1.9) at e8:fc:af:e4:d3:8e on em1 expires in 1173 seconds [ethernet]
? (192.168.1.168) at 00:05:cd:2b:66:a4 on em1 expires in 1046 seconds [ethernet]
? (192.168.1.11) at 00:0c:29:cf:2d:3c on em1 expires in 1146 seconds [ethernet]
? (192.168.1.237) at 00:0c:29:39:28:62 on em1 expires in 177 seconds [ethernet]
? (192.168.1.206) at 00:0c:29:ab:33:2c on em1 expires in 185 seconds [ethernet]
? (192.168.1.1) at 00:0c:29:8b:3c:c0 on em1 permanent [ethernet]
? (192.168.1.101) at 80:d2:1d:15:97:da on em1 expires in 1139 seconds [ethernet]
? (192.168.1.5) at 00:0c:29:0a:39:53 on em1 expires in 1160 seconds [ethernet]
? (192.168.1.7) at 00:0c:29:97:31:f8 on em1 expires in 1156 seconds [ethernet]
? (192.168.1.167) at 00:0c:29:53:a9:0f on em1 expires in 1124 seconds [ethernet]
? (192.168.1.6) at 00:0c:29:9d:41:37 on em1 expires in 1088 seconds [ethernet]
? (192.168.1.218) at 00:0c:29:34:55:31 on em1 expires in 1159 seconds [ethernet]
? (192.168.178.1) at 90:6e:bb:c0:ce:33 on em1 expires in 1152 seconds [ethernet]
? (192.168.178.3) at 00:0c:29:8b:3c:b6 on em0 permanent [ethernet]
? (192.168.178.1) at 90:6e:bb:c0:ce:33 on em0 expires in 1152 seconds [ethernet]
------
------
------
------
------
------
------
------
[/code]</rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum></up,broadcast,running,simplex,multicast>

[muswellhillbilly]

With so little information, all I can suggest is you contact your ISP.

[Killertjuh]

@muswellhillbilly:

With so little information, all I can suggest is you contact your ISP.

Nope when ill change my ip so that my computer can direct to modem everything is fine. what for logging you need ore can ill look into ? The gateway dosnt show anything. Because the WAN interface ip= 192.168.178.3 and internet modem = 192.168.178.1

This is the system

Oct 18 20:51:14 pfSense php-fpm[84093]: /index.php: Session timed out for user 'admin' from: 192.168.1.7
Oct 18 21:17:56 pfSense check_reload_status: updating dyndns WANGW
Oct 18 21:17:56 pfSense check_reload_status: Restarting ipsec tunnels
Oct 18 21:17:56 pfSense check_reload_status: Restarting OpenVPN tunnels/interfaces
Oct 18 21:17:56 pfSense check_reload_status: Reloading filter
Oct 18 21:17:56 pfSense check_reload_status: updating dyndns WANGW
Oct 18 21:17:56 pfSense check_reload_status: Restarting ipsec tunnels
Oct 18 21:17:56 pfSense check_reload_status: Restarting OpenVPN tunnels/interfaces
Oct 18 21:17:56 pfSense check_reload_status: Reloading filter
Oct 18 22:37:57 pfSense check_reload_status: updating dyndns WANGW
Oct 18 22:37:57 pfSense check_reload_status: Restarting ipsec tunnels
Oct 18 22:37:57 pfSense check_reload_status: Restarting OpenVPN tunnels/interfaces
Oct 18 22:37:57 pfSense check_reload_status: Reloading filter
Oct 18 22:37:57 pfSense check_reload_status: updating dyndns WANGW
Oct 18 22:37:57 pfSense check_reload_status: Restarting ipsec tunnels
Oct 18 22:37:57 pfSense check_reload_status: Restarting OpenVPN tunnels/interfaces
Oct 18 22:37:57 pfSense check_reload_status: Reloading filter
Oct 20 10:46:05 pfSense sshd[25108]: error: PAM: authentication error for root from 192.168.1.7

Strange i dont have any ipsec / Openvpn but i found vk1 so i`ll remove this one.

[MaxHeadroom]

Hi

check  System Logs : Gateways

Maybe apinger think your Gateway is down and remove the default GW setting.

You can disable this by
System: Gateways: Edit gateway
check Disable Gateway Monitoring

[Killertjuh]

@MaxHeadroom:

Hi

check  System Logs : Gateways

Maybe apinger think your Gateway is down and remove the default GW setting.

You can disable this by
System: Gateways: Edit gateway
check Disable Gateway Monitoring

Ill disable this function. ill monitor the connection from now. You heard from me.

[Killertjuh]

Is there any why to get debug logs about routing/firewall ? When i look at the attachement it seems that he blocks my connection. But not everything is showing.


[Killertjuh]

bump

Is there something ill can try ? When ill wait for 10min ore reboot the machine everythings is okey.


[killmasta93]

what version of pfSense are you running?

[doktornotor]

@Killertjuh:

Is there any why to get debug logs about routing/firewall ?

Before wasting time with debugging non-issues, you might want to read this:

https://doc.pfsense.org/index.php/Why_do_my_logs_show_"blocked"_for_traffic_from_a_legitimate_connection

[firewalluser]

@Killertjuh

A little tip if you didnt already know which you might find useful for interpreting firewall logs, in Status, System Logs, Settings tab, there is a drop down option called Filter Descriptions.

If you change it to Display as Column, you can see which rule blocked the packet which can make things easier to workout what rules might be in the wrong order or not correct in some way.

fwiw.

Edit. I also increase the GUI Log Entries to Display on the same tab to 2000 which is handy for seeing more info and I see you already have your logs set to display in reverse order. The increase is necessary when you have lots of traffic and/or interfaces and theres nothing stopping you from right mouse clicking on the Firewall, Normal View tab so you get a new browser tab opened up showing the latest firewall log, if you need to see more than say 2000 entries from the gui.