[pfSense Support] LAN / WAN Disconnections continue in 1.2-RC1, Intel Pro/1000GT NICs with 370M RAM
>>Buy hardware that's not faulty. pfsense is *way* more robust than what it >>seems to be for you. what network interfaces do you >>have? if other than broadcom or Intel, switch to Intel. In frustration I have purchased 2 new Intel Pro/1000GT NIC's. They have lasted almost 48 hours before the internal disconnection between the LAN and WAN recurred yet again. The state table is reported as having showed 56 entries on index.php. Fixed by rebooting. Nothing else. (Cheaper cards have lasted longer!) Surely we can now conclusively say this is not a NIC or hardware issue? This happens for me on completely different machines with >= 256M RAM. I have most recently been running 1.2-RC1, pretty much since it was released. it teased me by running fine for 2 weeks, before reproducing the same problems. One of my colleagues has now abandoned pfSense, as it has proven to be unreliable for him. I do not want to, however the current reliability is also unsustainable for me. Is there any way I can assist to fix this problem? Kind regards David Hingston - Original Message - From: "Tortise" <[EMAIL PROTECTED]> To: Sent: Saturday, July 21, 2007 10:23 AM Subject: Re: [pfSense Support] Programming pfSense to Reboot and Dump LAN / WAN traffic Thank you Vivek >> connect both systems to a hub and run tcpdump on the other machine logging >> all traffic some place. Yes they are already on a LAN with a switch. I didn't realise TCPDump could be run from another machine other than the one being dumped from. From what you suggest it can. I'll study it up and see if I can get it to! (Unless someone here knows the syntax for this well and can just roll it off?) >>Buy hardware that's not faulty. pfsense is *way* more robust than what it >>seems to be for you. what network interfaces do you >>have? if other than broadcom or intel, switch to intel. We (3 of us) believe this is not a hardware issue. 3 of us are on the same ISP here in NZ, and experiencing the same issues for many months. The ISP uses much the same Motorola Cable modem to interface into our static IP's. The same fault occurs using completely different hardware here also. I have another pfSense box running at alternative premises connected to quite a different ISP and that box just goes, in line with what we believe we should be expecting. Swapping the boxes also suggests it is not a hardware problem as they all work at the alternative ISP / venue. I find running Monowall also has the same experience here, - the same Monowall box is stable for months off site. I have been tempted to post to the monowall list also, cross posts are considered bad etiquette and I presume the monowall folks are also on both lists, I have refrained. (Is this correct?) It suggests to me there is something about our ISP which is a problem, perhaps their hardware or perhaps something about their traffic. Clearly this should not be the case, but the onus falls on us (rightly or wrongly) to prove this. It also suggests to me there is a vulnerability in FreeBSD as the problem occurs in both Monowall and pfSense with this cable ISP. I'd prefer my firewall not need random rebooting. We'd all like to help within our power and ability to move this forwards as FreeBSD and its children (pfSense and Monowall) are largely fantastic! Kind regards David Hingston - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
Re: [pfSense Support] 3DES accelerator cards?
> The officeconnect routers that I've seen at least are OLD devices, if > yours are similar to the ones I've come across, I would be willing to > bet they're your bottleneck. Correct. I just can't find a decent device that will do Blowfish or AES or 3DES, plus LAN routing and URL filtering for around the same price ($50) > > On a separate note, given our bandwidth requirements--why shouldn't we > > get two SDSL lines instead of a T1 plus SDSL for redundancy? The SLAs > > are very similar and SDSL is less expensive. > > Well, depends on the specifics of the provider(s), but the T1 and SDSL > going out simultaneously is almost certainly far less likely than two > SDSL connections going down simultaneously. Depends on your company's > tolerance for failure vs. the cost differential. I would feel more > comfortable with two different types of connections to two different > providers. But, both of those are likely to come into your facility over > the same maybe 200 pair copper (or maybe fiber depending on where you > are), so a cable seeking back hoe will likely take out both (I've seen > it on more than one occasion, it's not pretty). You may want to consider > a cable modem in addition if back hoe failure avoidance is important, > because the cable is most likely going to take a completely different > path. Based on experience, I would be most comfortable with either T1 or > DSL plus cable. Wouldn't you know T1+cable was my plan, but apparently Comcast can't service our corp office (although I've had no trouble with our stores all across the country). It's in a heavy industrial area with no residences nearby, probably why... So I am stuck with Telco technology--SDSL from Covad resold by AT&T and a Sprint T1. I can't wait for them to be installed... Thanks again, Gabe
RE: [pfSense Support] LAN / WAN Disconnections continue in 1.2-RC1, Intel Pro/1000GT NICs with 370M
is it an actual disconnect between the LAN and WAN interface or is it that the WAN interface becomes unresponsive? if its an internal disconnect you should still be able to ping an outside source from the firewall even if systems on the LAN cant. if its the WAN interface itself, nothing would respond. are you sure you are running the correct MTU settings on the interface? I can def see why you would want to run TCPDump on the box now. > Date: Thu, 16 Aug 2007 19:32:25 +1200> From: [EMAIL PROTECTED]> To: > support@pfsense.com> Subject: [pfSense Support] LAN / WAN Disconnections > continue in 1.2-RC1, Intel Pro/1000GT NICs with 370M RAM> > >>Buy hardware > that's not faulty. pfsense is *way* more robust than what it seems to be for > you. what network interfaces do you> >>have? if other than broadcom or Intel, > switch to Intel.> > In frustration I have purchased 2 new Intel Pro/1000GT > NIC's. They have lasted almost 48 hours before the internal disconnection > > between the LAN and WAN recurred yet again. The state table is reported > as having showed 56 entries on index.php. Fixed by > rebooting. Nothing else. > (Cheaper cards have lasted longer!)> > Surely we can now conclusively say > this is not a NIC or hardware issue? This happens for me on completely > different machines with > >= 256M RAM.> > I have most recently been running > 1.2-RC1, pretty much since it was released. it teased me by running fine for > 2 weeks, before > reproducing the same problems.> > One of my colleagues has > now abandoned pfSense, as it has proven to be unreliable for him.> > I do not > want to, however the current reliability is also unsustainable for me.> > Is > there any way I can assist to fix this problem?> > Kind regards> David > Hingston> > > > > - Original Message - > From: "Tortise" <[EMAIL > PROTECTED]>> To: > Sent: Saturday, July 21, 2007 10:23 > AM> Subject: Re: [pfSense Support] Programming pfSense to Reboot and Dump LAN > / WAN traffic> > > Thank you Vivek> > >> connect both systems to a hub and > run tcpdump on the other machine logging all traffic some place.> > Yes they > are already on a LAN with a switch. I didn't realise TCPDump could be run > from another machine other than the one being> dumped from. From what you > suggest it can. I'll study it up and see if I can get it to! (Unless someone > here knows the syntax for> this well and can just roll it off?)> > >>Buy > hardware that's not faulty. pfsense is *way* more robust than what it seems > to be for you. what network interfaces do you> >>have? if other than broadcom > or intel, switch to intel.> > We (3 of us) believe this is not a hardware > issue. 3 of us are on the same ISP here in NZ, and experiencing the same > issues for> many months. The ISP uses much the same Motorola Cable modem to > interface into our static IP's. The same fault occurs using> completely > different hardware here also. I have another pfSense box running at > alternative premises connected to quite a different> ISP and that box just > goes, in line with what we believe we should be expecting. Swapping the boxes > also suggests it is not a> hardware problem as they all work at the > alternative ISP / venue.> > I find running Monowall also has the same > experience here, - the same Monowall box is stable for months off site. I > have been> tempted to post to the monowall list also, cross posts are > considered bad etiquette and I presume the monowall folks are also on> both > lists, I have refrained. (Is this correct?)> > It suggests to me there is > something about our ISP which is a problem, perhaps their hardware or perhaps > something about their> traffic. Clearly this should not be the case, but the > onus falls on us (rightly or wrongly) to prove this.> > It also suggests to > me there is a vulnerability in FreeBSD as the problem occurs in both Monowall > and pfSense with this cable ISP.> > I'd prefer my firewall not need random > rebooting. We'd all like to help within our power and ability to move this > forwards as> FreeBSD and its children (pfSense and Monowall) are largely > fantastic!> > Kind regards> David Hingston> > > > > > -> To > unsubscribe, e-mail: [EMAIL PROTECTED]> For additional commands, e-mail: > [EMAIL PROTECTED]> > > > > -> To > unsubscribe, e-mail: [EMAIL PROTECTED]> For additional commands, e-mail: > [EMAIL PROTECTED]> _ Recharge--play some free games. Win cool prizes too! http://club.live.com/home.aspx?icid=CLUB_wlmailtextlink
Re: [pfSense Support] LAN / WAN Disconnections continue in 1.2-RC1, Intel Pro/1000GT NICs with 370M
is it an actual disconnect between the LAN and WAN interface or is it that the WAN interface becomes unresponsive? if its an internal disconnect you should still be able to ping an outside source from the firewall even if systems on the LAN cant. if its the WAN interface itself, nothing would respond. >From memory I can ping the cable modem from the LAN and still view its page, >but that is as far as it will go. I'll check these again next time it happens >sometime in the next two weeks! Pretty sure I can no longer ping the WAN's >static IP from the Net (Having created an allow ping rule) and the pfSense >ping page does not get responses from anything on the net beyond the cable >modem.Is that internal? are you sure you are running the correct MTU settings on the interface? Using default setting here. Not aware they are not standard, but will check with the ISP. I suspect the ISP is doing something funny, but even if so pfSense should remain immune to it? I can def see why you would want to run TCPDump on the box now. Thanks Sean! Kind regards David Hingston - Original Message - From: Sean Cavanaugh To: support@pfsense.com Sent: Thursday, August 16, 2007 11:32 PM Subject: RE: [pfSense Support] LAN / WAN Disconnections continue in 1.2-RC1, Intel Pro/1000GT NICs with 370M is it an actual disconnect between the LAN and WAN interface or is it that the WAN interface becomes unresponsive? if its an internal disconnect you should still be able to ping an outside source from the firewall even if systems on the LAN cant. if its the WAN interface itself, nothing would respond. are you sure you are running the correct MTU settings on the interface? I can def see why you would want to run TCPDump on the box now. -- > Date: Thu, 16 Aug 2007 19:32:25 +1200 > From: [EMAIL PROTECTED] > To: support@pfsense.com > Subject: [pfSense Support] LAN / WAN Disconnections continue in 1.2-RC1, Intel Pro/1000GT NICs with 370M RAM > > >>Buy hardware that's not faulty. pfsense is *way* more robust than what it seems to be for you. what network interfaces do you > >>have? if other than broadcom or Intel, switch to Intel. > > In frustration I have purchased 2 new Intel Pro/1000GT NIC's. They have lasted almost 48 hours before the internal disconnection > between the LAN and WAN recurred yet again. The state table is reported as having showed 56 entries on index.php. Fixed by > rebooting. Nothing else. (Cheaper cards have lasted longer!) > > Surely we can now conclusively say this is not a NIC or hardware issue? This happens for me on completely different machines with > >= 256M RAM. > > I have most recently been running 1.2-RC1, pretty much since it was released. it teased me by running fine for 2 weeks, before > reproducing the same problems. > > One of my colleagues has now abandoned pfSense, as it has proven to be unreliable for him. > > I do not want to, however the current reliability is also unsustainable for me. > > Is there any way I can assist to fix this problem? > > Kind regards > David Hingston > > > > > - Original Message - > From: "Tortise" <[EMAIL PROTECTED]> > To: > Sent: Saturday, July 21, 2007 10:23 AM > Subject: Re: [pfSense Support] Programming pfSense to Reboot and Dump LAN / WAN traffic > > > Thank you Vivek > > >> connect both systems to a hub and run tcpdump on the other machine logging all traffic some place. > > Yes they are already on a LAN with a switch. I didn't realise TCPDump could be run from another machine other than the one being > dumped from. From what you suggest it can. I'll study it up and see if I can get it to! (Unless someone here knows the syntax for > this well and can just roll it off?) > > >>Buy hardware that's not faulty. pfsense is *way* more robust than what it seems to be for you. what network interfaces do you > >>have? if other than broadcom or intel, switch to intel. > > We (3 of us) believe this is not a hardware issue. 3 of us are on the same ISP here in NZ, and experiencing the same issues for > many months. The ISP uses much the same Motorola Cable modem to interface into our static IP's. The same fault occurs using > completely different hardware here also. I have another pfSense box running at alternative premises connected to quite a different > ISP and that box just goes, in line with what we believe we should be expecting. Swapping the boxes also suggests it is not a > hardware problem as they all work at the alternative ISP / venue. > > I find running Monowall also has the same experience here, - the same Monowall box is stable for months off site. I have been > tempted to post to the monowall list also, cross posts are considered bad etiquette and I presume the monowall fo
RE: [pfSense Support] LAN / WAN Disconnections continue in 1.2-RC1, Intel Pro/1000GT NICs with 370M
if you can get to the cable modem and no farther, that sounds like its a problem with the modem and not the pfsense box. i know my first cable modem started locking up where i had to power cycle it every few days to get it to work again but it gave a visual indication with its status lights that there was a problem. you might want to see about getting that replaced with a new modem and maybe having a tech come out to verify that the signal level is where it should be. too low and it will cut out, too high and it will fry the modem. -Sean Date: Thu, 16 Aug 2007 23:59:31 +1200From: [EMAIL PROTECTED]: [EMAIL PROTECTED]: Re: [pfSense Support] LAN / WAN Disconnections continue in 1.2-RC1, Intel Pro/1000GT NICs with 370M is it an actual disconnect between the LAN and WAN interface or is it that the WAN interface becomes unresponsive? if its an internal disconnect you should still be able to ping an outside source from the firewall even if systems on the LAN cant. if its the WAN interface itself, nothing would respond. >From memory I can ping the cable modem from the LAN and still view its page, >but that is as far as it will go. I'll check these again next time it happens >sometime in the next two weeks! Pretty sure I can no longer ping the WAN's >static IP from the Net (Having created an allow ping rule) and the pfSense >ping page does not get responses from anything on the net beyond the cable >modem.Is that internal? are you sure you are running the correct MTU settings on the interface? Using default setting here. Not aware they are not standard, but will check with the ISP. I suspect the ISP is doing something funny, but even if so pfSense should remain immune to it? I can def see why you would want to run TCPDump on the box now. Thanks Sean!Kind regardsDavid Hingston - Original Message - From: Sean Cavanaugh To: support@pfsense.com Sent: Thursday, August 16, 2007 11:32 PM Subject: RE: [pfSense Support] LAN / WAN Disconnections continue in 1.2-RC1, Intel Pro/1000GT NICs with 370M is it an actual disconnect between the LAN and WAN interface or is it that the WAN interface becomes unresponsive? if its an internal disconnect you should still be able to ping an outside source from the firewall even if systems on the LAN cant. if its the WAN interface itself, nothing would respond. are you sure you are running the correct MTU settings on the interface? I can def see why you would want to run TCPDump on the box now. > Date: Thu, 16 Aug 2007 19:32:25 +1200> From: [EMAIL PROTECTED]> To: > support@pfsense.com> Subject: [pfSense Support] LAN / WAN Disconnections > continue in 1.2-RC1, Intel Pro/1000GT NICs with 370M RAM> > >>Buy hardware > that's not faulty. pfsense is *way* more robust than what it seems to be for > you. what network interfaces do you> >>have? if other than broadcom or Intel, > switch to Intel.> > In frustration I have purchased 2 new Intel Pro/1000GT > NIC's. They have lasted almost 48 hours before the internal disconnection > > between the LAN and WAN recurred yet again. The state table is reported > as having showed 56 entries on index.php. Fixed by > rebooting. Nothing else. > (Cheaper cards have lasted longer!)> > Surely we can now conclusively say > this is not a NIC or hardware issue? This happens for me on completely > different machines with > >= 256M RAM.> > I have most recently been running > 1.2-RC1, pretty much since it was released. it teased me by running fine for > 2 weeks, before > reproducing the same problems.> > One of my colleagues has > now abandoned pfSense, as it has proven to be unreliable for him.> > I do not > want to, however the current reliability is also unsustainable for me.> > Is > there any way I can assist to fix this problem?> > Kind regards> David > Hingston> > > > > - Original Message - > From: "Tortise" <[EMAIL > PROTECTED]>> To: > Sent: Saturday, July 21, 2007 10:23 > AM> Subject: Re: [pfSense Support] Programming pfSense to Reboot and Dump LAN > / WAN traffic> > > Thank you Vivek> > >> connect both systems to a hub and > run tcpdump on the other machine logging all traffic some place.> > Yes they > are already on a LAN with a switch. I didn't realise TCPDump could be run > from another machine other than the one being> dumped from. From what you > suggest it can. I'll study it up and see if I can get it to! (Unless someone > here knows the syntax for> this well and can just roll it off?)> > >>Buy > hardware that's not faulty. pfsense is *way* more robust than what it seems > to be for you. what network interfaces do you> >>have? if other than broadcom > or intel, switch to intel.> > We (3 of us) believe this is not a hardware > issue. 3 of us are on the same ISP here in NZ, and experiencing the same > issues for> many months. The ISP uses much the same Motorola Cable modem to > interface into our static IP's. The same fault occurs using> completely > diffe
Re: [pfSense Support] Client devices was re: [pfSense Support] 3DES accelerator cards?
On Wed, Aug 15, 2007 at 04:19:32PM -0700, Gabriel Green wrote: >Definately sounds reasonable. I ran top all day and the pfsense box >is NOT my bottleneck. >Here's a question for all of you. These OfficeConnect devices are >-cheap- ($52) -- anyone have any recommendations for something else, >no more than $75 and -maybe- $100? I've seen the Draytek devices and >they look awesome but they are outside of my budget. I had a 60 sec HTTP timeout bug with a Draytek firmware once at which was acknowledged, but wasn't fixed in over a year. Since that was a showstopper (web developers, ahem), I moved to OpenWRT on Linksys WRT54G, then m0n0wall on WRAP, and then pfSense, first on WRAP and then on SunFire X2100 M2. I run pfSense on WRAP at home. -- Eugen* Leitl http://leitl.org";>leitl http://leitl.org __ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
Re: [pfSense Support] LAN / WAN Disconnections continue in 1.2-RC1, Intel Pro/1000GT NICs with 370M
>> if you can get to the cable modem and no farther, that sounds like its a >> problem with the modem and not the pfsense box. Yes, that was initially suspected and has been investigated to the max. >> i know my first cable modem started locking up where i had to power cycle it >> every few days to get it to work again but it gave a visual indication with >> its status lights that there was a problem. you might want to see about >> getting that replaced with a new modem and maybe having a tech come out to >> verify that the signal level is where it should be. too low and it will cut >> out, too high and it will fry the modem. All this has been done, signal verified, we have a signal attenuator that makes for the perfect signal level, this can and is be checked from the modem web interface. To be sure the modem was also replaced. Power cycling the modem makes no difference. A notebook can be connected and browse the web from the modem during these occasions. The ISP can see the modem during these occasions and verifies it is fine. As three users of the same ISP are having problems user hardware is largely eliminated as the problem. (ISP hardware isn't though) Rebooting pfsense re-establishes LAN - WAN connectivity. This is repeatedly proven to restore connectivity - when nothing else has been done. The pfsense hardware has all been completely swapped out. The modem and pfsense run on a quality UPS. The only remaining possible explanations is some peculiar web traffic and/or pfsense software vulnerability. (MTU to be confirmed, I doubt this to be the issue, if it were I think it would be much more of a problem?) How does one track this down? Kind regards David Hingston - Original Message - From: Sean Cavanaugh To: support@pfsense.com Sent: Friday, August 17, 2007 12:54 AM Subject: RE: [pfSense Support] LAN / WAN Disconnections continue in 1.2-RC1, Intel Pro/1000GT NICs with 370M if you can get to the cable modem and no farther, that sounds like its a problem with the modem and not the pfsense box. i know my first cable modem started locking up where i had to power cycle it every few days to get it to work again but it gave a visual indication with its status lights that there was a problem. you might want to see about getting that replaced with a new modem and maybe having a tech come out to verify that the signal level is where it should be. too low and it will cut out, too high and it will fry the modem. -Sean Date: Thu, 16 Aug 2007 23:59:31 +1200 From: [EMAIL PROTECTED] To: support@pfsense.com Subject: Re: [pfSense Support] LAN / WAN Disconnections continue in 1.2-RC1, Intel Pro/1000GT NICs with 370M is it an actual disconnect between the LAN and WAN interface or is it that the WAN interface becomes unresponsive? if its an internal disconnect you should still be able to ping an outside source from the firewall even if systems on the LAN cant. if its the WAN interface itself, nothing would respond. From memory I can ping the cable modem from the LAN and still view its page, but that is as far as it will go. I'll check these again next time it happens sometime in the next two weeks! Pretty sure I can no longer ping the WAN's static IP from the Net (Having created an allow ping rule) and the pfSense ping page does not get responses from anything on the net beyond the cable modem.Is that internal? are you sure you are running the correct MTU settings on the interface? Using default setting here. Not aware they are not standard, but will check with the ISP. I suspect the ISP is doing something funny, but even if so pfSense should remain immune to it? I can def see why you would want to run TCPDump on the box now. Thanks Sean! Kind regards David Hingston - Original Message - From: Sean Cavanaugh To: support@pfsense.com Sent: Thursday, August 16, 2007 11:32 PM Subject: RE: [pfSense Support] LAN / WAN Disconnections continue in 1.2-RC1, Intel Pro/1000GT NICs with 370M is it an actual disconnect between the LAN and WAN interface or is it that the WAN interface becomes unresponsive? if its an internal disconnect you should still be able to ping an outside source from the firewall even if systems on the LAN cant. if its the WAN interface itself, nothing would respond. are you sure you are running the correct MTU settings on the interface? I can def see why you would want to run TCPDump on the box now. -- > Date: Thu, 16 Aug 2007 19:32:25 +1200 > From: [EMAIL PROTECTED] > To: support@pfsense.com > Subject: [pfSense Support] LAN / WAN Disconnections continue in 1.2-RC1, Intel Pro/1000GT NICs with 370M RAM > > >>Buy h
