pfSense Gold Subscription

Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Messages - PiBa

Pages: [1] 2 3 4 5 ... 49
1
The 'Use "forwardfor" option' in the frontend might help?

Otherwise use a 'action' to perform a "http-request header set" with name: X-Forwarded-Proto and fmt: https

2
Cache/Proxy / Re: HAProxy and acl files
« on: Today at 12:21:03 pm »
Depends a little bit what kind of file you would like to use.. It is possible to use "Source IP matches IP or Alias" as a acl.. for which you then can create a alias in pfSense with IP's and subnets to match against.. But if you want to specify a domain>certificate or domain>backend 'list' or some other option that needs loading from file (besides a few things like lua and errorfiles..). Then the webgui is the thing that doesn't really 'support' it..

Haproxy binary itself is should have most if no all features described in the manual..

3
2.4 Development Snapshots / Re: New 502 Bad Gateway
« on: Today at 07:25:05 am »
From what i 'think' happens TrafficTotals does not cause the problem. But might experience the same symptom as pfBlocker..

For those using TrafficTotals and experiencing the problem it would be nice to get some information in 'why' the vnstat process hangs during a set of actions mostly unrelated to what pfBlocker does as they might have the same root cause for 'hanging'.. So truss, lsof and possibly gdb output would be nice to see especially as its a easy separated process unlike pfBlocker/lighttpd/php chain thats harder to run separately. Also it would be good to see if vnstat still hangs when gathering stats for less and or different interfaces.. Both while there are already hanging vnstat processes, gather details, and after killing all those processes try if it still hangs. (without rebooting..)

Yes 'something' is broken. but only a +1 wont help fix it.. i think its already high on the attention list of BBcan177, and i'm interested in this topic as well and probably a few others that passively 'monitor' this thread, but i doubt it can be properly fixed without detailed information and a good understanding of why the problem happens.

Please gather information some about running vnstat processes (when more than 1 starts running.) for those that have TrafficTotals installed. Preferably on pfSense 2.4.2 though not sure if that would help for anything..

4
General Questions / Re: Crash report
« on: November 15, 2017, 01:48:04 pm »
Havn't heard of that happening.. might be gateway is detecting some up/down event on the gateway and resetting states? But i would expect that to happen only for gateway/route related changes being applied..

Is it checked?: System/Advanced/Miscellaneous "State Killing on Gateway Failure"

5
Cache/Proxy / Re: HAProxy and using SNI on backends
« on: November 15, 2017, 01:37:56 pm »
Haproxy 1.8rc3 should be able to use "check-sni". http://cbonte.github.io/haproxy-dconv/1.8/snapshot/configuration.html#5.2-check-sni but aint released yet. Maybe i can change the haproxy-devel to use it..

6
General Questions / Re: Strange traffic graph output
« on: November 14, 2017, 03:38:30 pm »
Try viewing some traffic "tcpdump -eni <nic>" on a ssh/console perhaps write it to file with a extra parameter "-w /tmp/ghosttraffic.pcap" for loading in wireshark and further analysis.?.

7
General Questions / Re: Haproxy Configuration - Local Network Access?
« on: November 14, 2017, 12:34:47 pm »
'PureNAT is enabled' - but haproxy is a proxy, it doesn't use natting :)

Also on the 'inside' you should be able to visit http://domain/ without issue if allowed by firewallrules. if not what happens? timeout / error? which error exactly?

Unless you are using 'transparent client ip' feature in the backend maybe? In which case there is a requirement for server and client to be on different subnets so reply traffic is guaranteed to pass back through haproxy.

8
2.4 Development Snapshots / Re: New 502 Bad Gateway
« on: November 12, 2017, 07:07:05 pm »
vnstat as used by TrafficTotals is normally started by a cron job every 5 minutes.. So somehow it doesn't finish within that time and another process is started..
I don't think its the cause of trouble by itself, but it might help find what is..

It could be interesting to know why vnstat is apparently 'hanging'.. perhaps output of truss when starting it manually, or lsof could help find that out.. The output files and results of these commands could help find a reason or direction to dig further, preferably combined with the other commands previously requested..:
Code: [Select]
lsof > /root/lsof_truss.log
truss -dfo /root/vnstat_truss.log vnstat -u

cat /root/lsof_truss.log | grep vnstat
That truss command may hang just like the other vnstat processes though.. Keep the log, then 'killall vnstat' and run the truss command again to a second logfile. Check if it hangs again, and maybe compare the last parts of both vnstat_truss.log files.. or upload em on the forum or perhaps a pm.?.

lsof might need to be installed.. 'pkg install lsof'
Also for those with TrafficTotals installed and active monitoring (and alerting?), please try and gather the info as soon as possible after there is >1 vnstat process running.

Sorry for asking again for 'more info', but without a reproduction, or this kind of trouble on my own machines, and afaik still unknown root cause it cannot be easily solved.. Just trying to help get to the root cause..  8)

p.s. i'm just a pfSense-user (and package developer though usually not of pfB)..

9
2.4 Development Snapshots / Re: New 502 Bad Gateway
« on: November 12, 2017, 03:19:29 pm »
Happened again late last night. This time got the logs requested
https://pastebin.com/GMZG8B6H

What strikes me as odd here (and maybe unrelated to pfBlocker) is the 182 running 'vnstat' processes.. A possible source would be from TrafficTotals package, can you confirm you have got that installed?

10
2.4 Development Snapshots / Re: Static Route - Aliases issue
« on: November 12, 2017, 08:46:53 am »
As I said earlier, the dropdown is irrelevant and it should stay that way. Just showing N/A might be nice but would be a visual effect only..

The question remains, do the subnets in your alias get added to the routing table or not? If they do it works properly..

11
2.4 Development Snapshots / Re: Static Route - Aliases issue
« on: November 11, 2017, 09:51:30 am »
Yea i suppose the gui could be made a little more pretty with a N/A option.

But changing routes to different than intended subnet sizes sounds like a bad idea. Like if youve got alias with subnets like: '192.168.50.128/23 , 192.168.51.0/24'  or '192.168.60.4/30 , 192.168.60.16/29'
Then using this alias in a static route, you configure it like what /24 or /23 and 'override' the original subnet's? Either way you will hit more/less hosts than originally defined by the alias.. seems like a strange thing to me..


But i do wonder, did you use nested aliases for the routes? And if not, do you still have trouble getting them to apply? (with the subnet size as defined in the alias.)

12
2.4 Development Snapshots / Re: Static Route - Aliases issue
« on: November 10, 2017, 05:23:43 pm »
As the alias could have different subnet sizes you cant really specify 1 for the alias.. It just defaults to /32 that by itself isn't a problem.

There is a problem with 'nested' aliases, which should get fixed by https://github.com/pfsense/pfsense/pull/3863 once its pulled. If not using those then it 'should' work afaik..

13
General Questions / Re: Fluactuating CPU USAGE
« on: November 08, 2017, 07:00:50 pm »
Maybe checkout what the status/monitor 'quality' graph will tell about this gateway (use the wrench top right to select quality for the opt2 gateway..) Maybe there is some 'patern' ? Also correlate it with traffic usage.. maybe windows is pulling in a update at that moment.?.

Also try and run tracert or mtr and see if indeed the problem lies between modem and isp.. try and replace cables or plug in a regular pc instead of pfSense and check if it has the same problems before rebooting the modem.

Is the modem a actual modem? Or is it a combination box thats also handing out IP addresses or is it perhaps bridged?

14
General Questions / Re: Fluactuating CPU USAGE
« on: November 08, 2017, 06:02:33 pm »
So ping times to the monitored address go above 1 second from time to time.. thats pretty bad.. and above the limits.. so would explain pfSense restarting services/using cpu..

So then the question, are you downloading some large files or windowsupdates or torrents or something at that time? Or is it happening even when little traffic is moving along and perhaps the ISP itself is having troubles and buffer bloat.?.

If your using all available bandwidth at that time and results in this effect, it might be a good idea to configure some traffic shaping or limiters to keep speeds a few percent below the maximum allowed by the isp, that would make sure the isp does not need to throttle your packets.. Though that can be complicated to configure correctly, and there are quite a few options to choose from in this subject..

15
General Questions / Re: Fluactuating CPU USAGE
« on: November 08, 2017, 05:35:37 pm »
Check logs.. and timestamps..

when connection is lost, pfSense will re-configure some things, adjust firewall-rules, restart services.. This could cause higher cpu usage after the connection is already lost.. but should settle after a little while.. then when connection comes back this will happen again..

Anyhow probably would check if any alarms are raised/cleared around the start of such issues in the Status/SystemLogs/System/Gateways log. And maybe raise the acceptable limits for the monitoring..

Pages: [1] 2 3 4 5 ... 49