pfSense bugtracker: Issueshttps://redmine.pfsense.org/https://redmine.pfsense.org/favicon.ico?16780521162024-03-28T14:41:25ZpfSense bugtracker
Redmine pfSense - Feature #15367 (New): pfSense throughput would probably seriously benefit from jumbo fr...https://redmine.pfsense.org/issues/153672024-03-28T14:41:25ZLouis B
<p>pfSense throughput would probably seriously benefit from jumbo frames. Please support that!</p>
<p>I described this in more detail in my thread <sup>Is pfSense handling jumbo frames correct !?</sup></p>
<p>I assume pfSense could greatly benefit from bigger packages. Especially in case of link speeds above 1G. Since even the slightest package delay is strongly limiting the throughput. Assuming that the package delay is <sup>independent</sup> of package size. The overall delay of using jumbo frames for file transfer would probably something like a factor 5. <br />So I did start change my NAS-systems and some network settings top test that. And of course pfSense should support it as well. And there is the problem. In the actual GUI, I can reduce the MTU-size (default 1500), but I cannot raise the size, not above the size of the physical interface.</p>
<p>And see there the problem, there is no way to change the MTU-size of interfaces used in favor of VLAN's or LAGG's</p> pfSense - Bug #15366 (New): Ethernet rules are not blocking the ARP inside the bridgehttps://redmine.pfsense.org/issues/153662024-03-28T09:25:13ZLev Prokofev
<p>Configuration:</p>
<p>1)IX2 and DMZ interfaces are bridged (192.168.168.0/24)<br />2)Filtering enabled on members of the bridge<br /> net.link.bridge.pfil_member=1 <br /> net.link.bridge.pfil_bridge=0<br />3)The ethernet rules are set to not pass the ARP from any to any, of the members of the bridge.<br /><img src="https://redmine.pfsense.org/attachments/download/5988/clipboard-202403281317-ukct1.png" alt="" /><br />Result:</p>
<p>PC1 (192.168.168.12) requested the ARP for PC2 (192.168.168.10) and received the reply, but didn't receive an ARP reply from the gateway, so the rules cut traffic from the interface of pfSense but not inside the bridge broadcast.</p>
<p><img src="https://redmine.pfsense.org/attachments/download/5989/clipboard-202403281323-c06p2.png" alt="" /></p>
<p>tested on</p>
<pre>
23.09.1-RELEASE (amd64)
built on Wed Dec 20 21:27:00 MSK 2023
FreeBSD 14.0-CURRENT
</pre> pfSense - Bug #15362 (New): Config upgrade error with empty gateway interval tags.https://redmine.pfsense.org/issues/153622024-03-26T19:12:31ZSteve Wheeler
<p>Upgrading an old config that has set but empty gateway interval tags throws a php error.<br />For example a config containing:<br /><pre>
<gateway_item>
<interface>wan</interface>
<gateway>1.2.3.4</gateway>
<name>wan_gateway</name>
<weight/>
<interval/>
<descr><![CDATA[gw1]]></descr>
<defaultgw/>
</gateway_item>
</pre></p>
<p>Will hit:<br /><pre>
Fatal error: Uncaught TypeError: Unsupported operand types: string * int in /etc/inc/upgrade_config.inc:4169
Stack trace:
#0 /etc/inc/config.lib.inc(519): upgrade_130_to_131()
#1 /etc/rc.bootup(140): convert_config()
#2 {main}
thrown in /etc/inc/upgrade_config.inc on line 4169
PHP ERROR: Type: 1, File: /etc/inc/upgrade_config.inc, Line: 4169, Message: Uncaught TypeError: Unsupported operand types: string * int in /etc/inc/upgrade_config.inc:4169
Stack trace:
#0 /etc/inc/config.lib.inc(519): upgrade_130_to_131()
#1 /etc/rc.bootup(140): convert_config()
#2 {main}
</pre></p> pfSense - Bug #15353 (New): Crashes Every ~8-12 Hours in New 2.7.2 Install with Unbound, Suricata...https://redmine.pfsense.org/issues/153532024-03-21T06:41:37ZDevin Dawson
<p>After reading some FreeBSD posts, it appears that this bug is potentially triggered by high CPU load. This occurs for me particularly during reloading or updating pfblockerNG, even though it's not consistently reproducible. I've attempted some mitigations such as disabling promiscuous mode in Suricata and restricting its use to the WAN interface, which seems to reduce the frequency of the issue but does not eliminate it entirely. Previously, running pfblockerNG in python mode alongside Suricata on both LAN and WAN interfaces resulted in the bug occurring more frequently.</p>
<p>The crash tends to happen approximately every 8 hours or so and appears to be related to two other FreeBSD issues:</p>
<pre><code>FreeBSD Commit "vm: Fix racy checks for swap objects" - <a class="external" href="https://cgit.freebsd.org/src/commit/?id=e123264e4dc394602f9fed2f0376204b5998d815">https://cgit.freebsd.org/src/commit/?id=e123264e4dc394602f9fed2f0376204b5998d815</a><br /> FreeBSD Bug Report "panic: vm_page_free_prep: freeing mapped page" - <a class="external" href="https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=261707">https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=261707</a>"</code></pre>
<p>Further investigation and possible collaboration with the FreeBSD community may be necessary to address this issue effectively.</p>
<pre><code class="shell syntaxhl">Intel<span class="o">(</span>R<span class="o">)</span> Pentium<span class="o">(</span>R<span class="o">)</span> CPU G3250 @ 3.20GHz
2 CPUs: 1 package<span class="o">(</span>s<span class="o">)</span> x 2 core<span class="o">(</span>s<span class="o">)</span>
AES-NI CPU Crypto: No
QAT Crypto: No
Kernel PTI Enabled
MDS Mitigation VERW
</code></pre>
<pre><code class="shell syntaxhl">amd64
14.0-CURRENT
FreeBSD 14.0-CURRENT amd64 1400094 <span class="c">#1 RELENG_2_7_2-n255948-8d2b56da39c: Wed Dec 6 20:45:47 UTC 2023 root@freebsd:/var/jenkins/workspace/pfSense-CE-snapshots-2_7_2-main/obj/amd64/StdASW5b/var/jenkins/workspace/pfSense-CE-snapshots-2_7_2-main/sources/F</span>
Filename: /var/crash/textdump.tar.0
ddb.txt
db:0:kdb.enter.default> show registers
cs 0x20
ds 0x3b
es 0x3b
fs 0x13
gs 0x1b
ss 0
rax 0x12
rcx 0xffffffff81451bc8
rdx 0xffffffff844195ff
rbx 0x100
rsp 0xfffffe00f5272780
rbp 0xfffffe00f5272780
rsi 0xfffffe00f52721f0
rdi 0xffffffff82d3f3d8 vt_conswindow+0x10
r8 0x10
r9 0x10
r10 0xf
r11 0x10
r12 0
r13 0x2
r14 0xffffffff813d55bb
r15 0xfffffe00f54e6e40
rip 0xffffffff80d32342 kdb_enter+0x32
rflags 0x82
kdb_enter+0x32: movq <span class="nv">$0</span>,0x234a4c3<span class="o">(</span>%rip<span class="o">)</span>
db:0:kdb.enter.default> run lockinfo
db:1:lockinfo> show locks
No such <span class="nb">command</span><span class="p">;</span> use <span class="s2">"help"</span> to list available commands
db:1:lockinfo> show alllocks
No such <span class="nb">command</span><span class="p">;</span> use <span class="s2">"help"</span> to list available commands
db:1:lockinfo> show lockedvnods
Locked vnodes
db:0:kdb.enter.default> show pcpu
cpuid <span class="o">=</span> 1
dynamic pcpu <span class="o">=</span> 0xfffffe009af25f80
curthread <span class="o">=</span> 0xfffffe00f54e6e40: pid 27610 tid 100715 critnest 1 <span class="s2">"unbound-control"</span>
curpcb <span class="o">=</span> 0xfffffe00f54e7360
fpcurthread <span class="o">=</span> 0xfffffe00f54e6e40: pid 27610 <span class="s2">"unbound-control"</span>
idlethread <span class="o">=</span> 0xfffffe001de1ec80: tid 100004 <span class="s2">"idle: cpu1"</span>
self <span class="o">=</span> 0xffffffff84011000
curpmap <span class="o">=</span> 0xfffff803a5a05ad0
tssp <span class="o">=</span> 0xffffffff84011384
rsp0 <span class="o">=</span> 0xfffffe00f5273000
kcr3 <span class="o">=</span> 0x800000008aefd67f
ucr3 <span class="o">=</span> 0x8000000271748e7f
scr3 <span class="o">=</span> 0x271748e7f
gs32p <span class="o">=</span> 0xffffffff84011404
ldt <span class="o">=</span> 0xffffffff84011444
tss <span class="o">=</span> 0xffffffff84011434
curvnet <span class="o">=</span> 0
db:0:kdb.enter.default> bt
Tracing pid 27610 tid 100715 td 0xfffffe00f54e6e40
kdb_enter<span class="o">()</span> at kdb_enter+0x32/frame 0xfffffe00f5272780
vpanic<span class="o">()</span> at vpanic+0x163/frame 0xfffffe00f52728b0
panic<span class="o">()</span> at panic+0x43/frame 0xfffffe00f5272910
trap_fatal<span class="o">()</span> at trap_fatal+0x40c/frame 0xfffffe00f5272970
trap_pfault<span class="o">()</span> at trap_pfault+0x4f/frame 0xfffffe00f52729d0
calltrap<span class="o">()</span> at calltrap+0x8/frame 0xfffffe00f52729d0
<span class="nt">---</span> <span class="nb">trap </span>0xc, rip <span class="o">=</span> 0xffffffff8127ee47, rsp <span class="o">=</span> 0xfffffe00f5272aa0, rbp <span class="o">=</span> 0xfffffe00f5272ac0 <span class="nt">---</span>
free_pv_entry<span class="o">()</span> at free_pv_entry+0x47/frame 0xfffffe00f5272ac0
pmap_pv_promote_pde<span class="o">()</span> at pmap_pv_promote_pde+0x14e/frame 0xfffffe00f5272b00
pmap_promote_pde<span class="o">()</span> at pmap_promote_pde+0x2fa/frame 0xfffffe00f5272b80
pmap_enter<span class="o">()</span> at pmap_enter+0xe8f/frame 0xfffffe00f5272c50
vm_fault<span class="o">()</span> at vm_fault+0xbf4/frame 0xfffffe00f5272d60
vm_fault_trap<span class="o">()</span> at vm_fault_trap+0x6b/frame 0xfffffe00f5272db0
trap_pfault<span class="o">()</span> at trap_pfault+0x1d9/frame 0xfffffe00f5272e10
<span class="nb">trap</span><span class="o">()</span> at <span class="nb">trap</span>+0x442/frame 0xfffffe00f5272f30
calltrap<span class="o">()</span> at calltrap+0x8/frame 0xfffffe00f5272f30
<span class="nt">---</span> <span class="nb">trap </span>0xc, rip <span class="o">=</span> 0x82784d8d0, rsp <span class="o">=</span> 0x820a9f758, rbp <span class="o">=</span> 0x820a9f940 <span class="nt">---</span>
</code></pre> pfSense - Feature #15348 (New): Block out PSK when viewing Phase 1 IPsec configurationhttps://redmine.pfsense.org/issues/153482024-03-18T14:31:12ZMike Moore
<p>When filling out a PSK in the phase 1 proposal section, the PSK really should be entered in obfuscated with the option in the WebUI to show the password.<br />Entering a password in clear text so anyone shoulder surfing can see it is a security issue.</p> pfSense - Bug #15346 (Confirmed): Port Forward Add Unassociated Filter Rule Not Workinghttps://redmine.pfsense.org/issues/153462024-03-16T21:51:40ZTimo M
<p>Upon creating a port forward entry on pfSense Plus 23.09.1 and choosing the "Add unassociated filter rule" option under Filter Rule Association, no firewall rule was actually created. Next time I checked the port forward Filter Rule Association setting on the rule that was created, it had been automatically set to "None". The documentation seems to indicate that a rule should still be created even when the unassociated option is chosen.</p>
<p><a class="external" href="https://docs.netgate.com/pfsense/en/latest/nat/port-forwards.html#port-forward-settings">https://docs.netgate.com/pfsense/en/latest/nat/port-forwards.html#port-forward-settings</a></p> pfSense - Bug #15291 (New): Error on Traffic Shaper 0% Bandwidthhttps://redmine.pfsense.org/issues/152912024-02-26T09:35:21ZPavan K
<p>Link to post on pfSense Forum: <br /><a class="external" href="https://forum.netgate.com/topic/186137/error-on-traffic-shaper-0-bandwidth?_=1708915183963">https://forum.netgate.com/topic/186137/error-on-traffic-shaper-0-bandwidth?_=1708915183963</a></p>
<p>Backstory:<br />recently we migrated from pfSense 2.4.x to 2.7.2 which was a direct update. Everything worked fine etc the traffic shaping feature.</p>
<p>Following is the error:<br />There were error(s) loading the rules: pfctl: the sum of the child<br />bandwidth (1200000000) higher than parent "root_igc4" (1000000000) -<br />The line in question reads [0]: @ 2024-01-31 16:45:05</p>
<p>Following is our configuration:<br />Name → FAIRQ_7<br />Priority→ 7<br />Scheduler Option → Random Early detection in and out<br />Bandwidth → None</p>
<p>Add new Queue(Default)<br />Enable<br />Name → qFAIRQ_2(Default)<br />Priority→ 2<br />Scheduler Option → Default<br />Bandwidth → None</p>
<p>Add new Queue(ACK)<br />Enable<br />Name → qACK_6<br />Priority→ 6<br />Scheduler Option → Random Early detection in and out<br />Bandwidth → None</p>
<p>According to the configuration the Bandwidth on Queue(ACK) should be 0% which was migrated off from 2.4.x but on 2.7.2 it's not letting us save 0% bandwidth for some reason.</p>
<p>And due to this new rules which are created are not taking effect it's only after we disable and enable the Traffic Shaper completely the rule is effective.</p> pfSense - Bug #15116 (New): Kea not working with UEFI HTTPBoot URL configuredhttps://redmine.pfsense.org/issues/151162023-12-26T19:06:26ZJason Montleon
<p>I have configured and successfully use http boot to occasionally boot libvirt vms by checking off `Enable Network Booting` and entering a URL in the `UEFI HTTPBoot URL` field.</p>
<p>Seeing the banner message that ISC DHCP is deprecated I navigated to `System / Advanced / Networking` and switched to Kea DHCP. But when I do this I am no longer able to successfully use UEFI HTTPBoot.</p>
<p>Switching back and forth between ISC DHCP and Kea DHCP is all I need to do to fix and break the functionality again.</p>
<p>Looking at kea-dhcp4.conf there is nothing that stands out to me as obviously wrong, but clients never access the http server I have configured.</p> pfSense - Bug #15110 (New): pfSense hangs when rebootinghttps://redmine.pfsense.org/issues/151102023-12-21T16:09:41ZDanilo Zrenjanin
<p>Start the reboot from the GUI:<br /><pre>
Enter an option: pflog0: promiscuous mode disabled
Waiting (max 60 seconds) for system process `vnlru' to stop... done
Waiting (max 60 seconds) for system process `syncer' to stop...
Syncing disks, vnodes remaining... 0 0 0 0 0 0 done
All buffers synced.
Uptime: 3m20s
Khelp module "ertt" can't unload until its refcount drops from 1 to 0.
uhub0: detached
</pre><br />At this point, it hangs. Noticed on a Netgate 6100 with 23.09.1.</p> pfSense - Bug #15032 (Feedback): Kea DHCP sends wrong bootloader file for uefi boothttps://redmine.pfsense.org/issues/150322023-11-25T15:14:36ZDavid Masshardtdavid@masshardt.ch
<p>I already posted this problem in the pfSense forum and was asked to report this issue here. Here is the link of the discussion thread:<br /><a class="external" href="https://forum.netgate.com/topic/184301/kea-dhcp-uefi-pxe-boot-sends-wrong-boot-file">https://forum.netgate.com/topic/184301/kea-dhcp-uefi-pxe-boot-sends-wrong-boot-file</a></p>
<p>I'm using netboot.xyz for network booting and I just switched to Kea DHCP. After the migration I noticed that network booting from UEFI bios does not work anymore, but legacy bios boot still does work.</p>
<p>Here are the configuration values I set in pfSense:</p>
<p>TFTP Server: IP of my netboot server<br />Next Server: IP of my netboot server<br />Default BIOS File Name: netboot.xyz.kpxe<br />UEFI 32 bit File Name: netboot.xyz.efi<br />UEFI 64 bit File Name: netboot.xyz.efi<br />ARM 64 bit File Name: netboot.xyz-arm64.efi</p>
<p>The Kea DHCP server always offers the default netboot.xyz.kpxe file to UEFI machines.</p>
<p>Here are the logs from Kea DHCP for an UEFI bios:</p>
<pre>
Nov 23 12:23:55 kea-dhcp4 14098 INFO [kea-dhcp4.dhcp4.0x3e2f2f5b9300] EVAL_RESULT Expression ipxe_64_lan_pool_0 evaluated to 1
Nov 23 12:23:55 kea-dhcp4 14098 INFO [kea-dhcp4.dhcp4.0x3e2f2f5b9300] EVAL_RESULT Expression ipxe_legacy_lan_pool_0 evaluated to 1
Nov 23 12:23:55 kea-dhcp4 14098 INFO [kea-dhcp4.dhcp4.0x3e2f2f5b9300] EVAL_RESULT Expression ipxe_64_lan evaluated to 1
Nov 23 12:23:55 kea-dhcp4 14098 INFO [kea-dhcp4.dhcp4.0x3e2f2f5b9300] EVAL_RESULT Expression ipxe_legacy_lan evaluated to 1
Nov 23 12:23:55 kea-dhcp4 14098 INFO [kea-dhcp4.leases.0x3e2f2f5b9300] DHCP4_LEASE_ALLOC [hwtype=1 46:15:16:cd:59:84], cid=[no info], tid=0xaccc68dd: lease 172.17.128.2 has been allocated for 86400 seconds
Nov 23 12:23:55 kea-dhcp4 14098 INFO [kea-dhcp4.dhcpsrv.0x3e2f2f5b9300] EVAL_RESULT Expression pool_opt1_0 evaluated to 1
Nov 23 12:23:55 kea-dhcp4 14098 INFO [kea-dhcp4.dhcpsrv.0x3e2f2f5b9300] EVAL_RESULT Expression pool_lan_0 evaluated to 1
</pre>
<p>And here is the generated kea-dhcp4.conf file. (I just removed the reservations)</p>
<pre>
{
"Dhcp4": {
"interfaces-config": {
"interfaces": [
"mlxen0",
"mlxen0.2"
]
},
"lease-database": {
"type": "memfile",
"persist": true,
"name": "/var/lib/kea/dhcp4.leases"
},
"loggers": [
{
"name": "kea-dhcp4",
"output_options": [
{
"output": "syslog"
}
],
"severity": "INFO"
}
],
"valid-lifetime": 7200,
"max-valid-lifetime": 86400,
"ip-reservations-unique": false,
"echo-client-id": false,
"option-data": [
{
"name": "domain-name",
"data": "mydomain"
}
],
"option-def": [
{
"space": "dhcp4",
"name": "ldap-server",
"code": 95,
"type": "string"
}
],
"hooks-libraries": [
{
"library": "/usr/local/lib/kea/hooks/libdhcp_lease_cmds.so"
}
],
"control-socket": {
"socket-type": "unix",
"socket-name": "/tmp/kea4-ctrl-socket"
},
"authoritative": true,
"client-classes": [
{
"name": "ipxe_32_lan_pool_0",
"test": "option[93].hex == 0x0006",
"only-if-required": true,
"option-data": [
{
"name": "boot-file-name",
"data": "netboot.xyz.efi"
}
]
},
{
"name": "ipxe_64_lan_pool_0",
"test": "option[93].hex == 0x0007 or option[93].hex == 0x0009",
"only-if-required": true,
"option-data": [
{
"name": "boot-file-name",
"data": "netboot.xyz.efi"
}
]
},
{
"name": "ipxe_64arm_lan_pool_0",
"test": "option[93].hex == 0x000b",
"only-if-required": true,
"option-data": [
{
"name": "boot-file-name",
"data": "netboot.xyz-arm64.efi"
}
]
},
{
"name": "ipxe_legacy_lan_pool_0",
"test": "not member('ipxe_32_lan_pool_0') and not member('ipxe_64_lan_pool_0') and not member('ipxe_64arm_lan_pool_0')",
"only-if-required": true,
"option-data": [
{
"name": "boot-file-name",
"data": "netboot.xyz.kpxe"
}
]
},
{
"name": "pool_lan_0",
"test": "member('ALL')"
},
{
"name": "ipxe_32_lan",
"test": "option[93].hex == 0x0006",
"only-if-required": true,
"option-data": [
{
"name": "boot-file-name",
"data": "netboot.xyz.efi"
}
]
},
{
"name": "ipxe_64_lan",
"test": "option[93].hex == 0x0007 or option[93].hex == 0x0009",
"only-if-required": true,
"option-data": [
{
"name": "boot-file-name",
"data": "netboot.xyz.efi"
}
]
},
{
"name": "ipxe_64arm_lan",
"test": "option[93].hex == 0x000b",
"only-if-required": true,
"option-data": [
{
"name": "boot-file-name",
"data": "netboot.xyz-arm64.efi"
}
]
},
{
"name": "ipxe_legacy_lan",
"test": "not member('ipxe_32_lan') and not member('ipxe_64_lan') and not member('ipxe_64arm_lan')",
"only-if-required": true,
"option-data": [
{
"name": "boot-file-name",
"data": "netboot.xyz.kpxe"
}
]
},
{
"name": "pool_opt1_0",
"test": "member('ALL')"
}
],
"subnet4": [
{
"id": 1,
"subnet": "172.17.0.0/16",
"option-data": [
{
"name": "domain-name",
"data": "mydomain"
},
{
"name": "domain-search",
"data": "mydomain"
},
{
"name": "domain-name-servers",
"data": "172.17.1.1"
},
{
"name": "routers",
"data": "172.17.1.1"
},
{
"name": "netbios-name-servers",
"data": "172.17.2.1"
},
{
"name": "netbios-node-type",
"data": "8"
}
],
"pools": [
{
"pool": "172.17.128.0 - 172.17.128.199",
"client-class": "pool_lan_0",
"option-data": [
{
"name": "domain-name-servers",
"data": "172.17.1.1"
},
{
"name": "tftp-server-name",
"data": "172.17.2.17"
}
],
"require-client-classes": [
"ipxe_legacy_lan_pool_0",
"ipxe_32_lan_pool_0",
"ipxe_64_lan_pool_0",
"ipxe_64arm_lan_pool_0"
]
}
],
"valid-lifetime": 86400,
"next-server": "172.17.2.17",
"require-client-classes": [
"ipxe_legacy_lan",
"ipxe_32_lan",
"ipxe_64_lan",
"ipxe_64arm_lan"
],
"reservations-in-subnet": true
},
{
"id": 2,
"subnet": "172.20.0.0/16",
"option-data": [
{
"name": "domain-name-servers",
"data": "172.20.1.1"
},
{
"name": "routers",
"data": "172.20.1.1"
}
],
"pools": [
{
"pool": "172.20.128.0 - 172.20.128.255",
"client-class": "pool_opt1_0",
"option-data": [
{
"name": "domain-name-servers",
"data": "172.20.1.1"
}
]
}
],
"valid-lifetime": 86400,
"reservations-in-subnet": true
}
]
}
</pre>
<p>I noticed that the legacy classes in the require-client-classes are on top of all the other classes. After i changed the order so that the legacy classes are at the bottom netboot worked for legacy and UEFI boot.</p>
<p>I also created a patch file that fixes the problem in the services.inc file:</p>
<pre><code class="diff syntaxhl"><span class="gd">--- /etc/inc/services.inc.save 2023-11-24 15:19:26.797541000 +0100
</span><span class="gi">+++ /etc/inc/services.inc 2023-11-24 15:24:17.000000000 +0100
</span><span class="p">@@ -1548,7 +1548,7 @@</span>
if (!is_array($keapool['require-client-classes'])) {
$keapool['require-client-classes'] = [];
}
<span class="gd">- array_unshift($keapool['require-client-classes'], $name);
</span><span class="gi">+ $keapool['require-client-classes'][] = $name;
</span> }
if (!empty($poolconf['rootpath'])) {
<span class="p">@@ -1719,7 +1719,7 @@</span>
if (!is_array($keasubnet['require-client-classes'])) {
$keasubnet['require-client-classes'] = [];
}
<span class="gd">- array_unshift($keasubnet['require-client-classes'], $name);
</span><span class="gi">+ $keasubnet['require-client-classes'][] = $name;
</span> }
if (!empty($dhcpifconf['rootpath'])) {
</code></pre>
<p>Can you please take a look at this if this is the correct solution to this problem?</p> pfSense - Bug #14936 (Feedback): radvd service shows as stopped in services list when it should b...https://redmine.pfsense.org/issues/149362023-11-01T15:03:21ZJim Pingle
<p>The <code>is_radvd_enabled()</code> function in <code>pfsense-utils.inc</code> appears to incorrectly interpret the state of the radvd service in some cases.</p>
<p>For example I have a system with WAN DHCP6, LAN Track6 to WAN, but on LAN I have DHCPv6 disabled and RA disabled. When configured in this way, the radvd service is shown in the services list, but is listed as stopped. The <code>radvd.conf</code> file only contains the header, which is expected since there are no interfaces with RA enabled.</p> pfSense - Bug #14933 (Confirmed): Traffic Graph Widget only displays half of the real UL/DL bandw...https://redmine.pfsense.org/issues/149332023-10-28T21:48:22ZPatrik Stahlman
<p>Problem description:<br />The Traffic Graphs Widget fails to display the real bandwidth used after the Dashboard browser tab loses and regains visibility. The problem is fairly easily reproducable.</p>
<p>My Traffic Graphs Widget configuration:<br /><code>Refresh interval: 1<br />Inverse: On<br />Unit size: bits<br />Background updates: clear graphs when not visible<br />Graph smoothing: 0</code></p>
Problem reproduction:
<ul>
<li>configure the widget as above</li>
<li>start downloading a large file at consistetly high speed (100Mb/s in my case, WAN max speed) </li>
<li>verify that the Traffic Graphs Widget shows the expected speed</li>
<li>switch away from the dashboard (in my case to another virtual desktop)</li>
<li>switch back to the dashboard and note the Traffic Graphs widget is resetting the graph</li>
<li>the widget should now show half the expected interface speed (50Mb/s in my case)</li>
</ul>
<p>Bug and fix:<br />I found the root cause of this problem in /usr/local/www/js/traffic-graphs.js. <br />The existing code to handle the case where graph smoothing is zero is not imlpemented consistently.</p>
<p>The values for the graph is calculated here:<br /><code> 286 var trafficIn = ( priorIn[interfaceCount].reduce(function(a, b){ return a + b; },0) + currentIn)/(1 + priorIn[interfaceCount].length);<br /> 287 var trafficOut = ( priorOut[interfaceCount].reduce(function(a, b){ return a + b; },0) + currentOut) /(1 + priorOut[interfaceCount].length);<br /></code> <br />When the graph is correct, variables <code>priorX[interfaceCount].length</code> is zero as would be expected when smoothing is not taking place.</p>
<p>When the graph is incorrect, variables <code>priorX[interfaceCount].length</code> is one. This is what is causing the halving of the indicated speed as the division is by 2.</p>
<p>This is the piece of code that incorrectly adds an entry to the list even though no smoothing is active:<br /><code> 288 // circular array to keep track of 'x' amount of data points<br /> 289 priorIn[interfaceCount][smoothCount] = currentIn;<br /> 290 priorOut[interfaceCount][smoothCount] = currentOut;</code></p>
<p>With smoothing = 0 this piece of code also has unexpected side effects, smoothCount = NaN after % with zero<br /><code> 340 // increment the circular array<br /> 341 smoothCount ++;<br /> 342 smoothCount = smoothCount % smoothing;</code></p>
<p>The attached patch fixes these issues by wrapping the code in "if(smoothing > 0) {}" blocks</p>
<p>This issue was found in Plus 23.05.1 but I expect it is present in all versions of pfSense.</p> pfSense - Regression #14930 (Feedback): Clean installation using Auto (ZFS) + MBR (BIOS) does not...https://redmine.pfsense.org/issues/149302023-10-28T02:19:25ZBoycee .
<p>Installing pfSense 2.7.0 using the Auto (ZFS) + MBR (BIOS) options appears successful, however when the installer reboots the system, the system fails to boot successfully, with a message displayed indicating the operating system is missing.</p>
<p>It is possible to install 2.6.0 with these options (Auto (ZFS) + MBR (BIOS)) and successfully upgrade to 2.7.0.</p>
<p>I believe this issue is inherited from FreeBSD:</p>
<p><a class="external" href="https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=267843">https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=267843</a><br /><a class="external" href="https://reviews.freebsd.org/D40816">https://reviews.freebsd.org/D40816</a></p>
<p>Whilst this issue should ideally be resolved in future releases of pfSense, I assume it must be considering for future in-place upgrades to avoid “bricking” devices already configured in this way.</p> pfSense - Bug #14371 (New): Firewall does not respond to UDP traceroute requests over IPsechttps://redmine.pfsense.org/issues/143712023-05-10T22:08:35ZMarcos M
<p>Tested on <code>23.01</code>.</p>
<p>pfSense itself does not respond to UDP traceroutes when it receives the request over IPsec (both policy/routed tunnels tested, as well as with pf disabled).</p>
<p>In the following example, traceroute is run from a LAN client behind siteA to the LAN interface address of siteB.<br /><pre>
### siteA client
[22.01-DEVELOPMENT][root@sitea-lanhost.lab.arpa]/root: traceroute -n -I 192.168.1.1
traceroute to 192.168.1.1 (192.168.1.1), 64 hops max, 48 byte packets
1 172.19.1.1 0.337 ms 0.106 ms 0.174 ms
2 192.168.1.1 0.684 ms 0.607 ms 0.531 ms
[22.01-DEVELOPMENT][root@sitea-lanhost.lab.arpa]/root: traceroute -n 192.168.1.1
traceroute to 192.168.1.1 (192.168.1.1), 64 hops max, 40 byte packets
1 172.19.1.1 0.283 ms 0.185 ms 0.189 ms
2 * * *
3 * *^C
### siteB firewall
[23.01-RELEASE][root@siteb-fw1.lab.arpa]/root: ifconfig vmx1
vmx1: flags=8863<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
description: LAN
options=4e000bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,RXCSUM_IPV6,TXCSUM_IPV6,NOMAP>
ether 00:50:56:b2:00:fe
inet6 fe80::250:56ff:feb2:fe%vmx1 prefixlen 64 scopeid 0x2
inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255
media: Ethernet autoselect
status: active
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
[23.01-RELEASE][root@siteb-fw1.lab.arpa]/root: tcpdump -ni enc0 'host 172.19.1.4'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on enc0, link-type ENC (OpenBSD encapsulated IP), capture size 262144 bytes
19:01:30.681093 (authentic,confidential): SPI 0xca57b541: IP 172.19.1.4 > 192.168.1.1: ICMP echo request, id 32776, seq 4, length 28
19:01:30.681173 (authentic,confidential): SPI 0xcaa92d26: IP 192.168.1.1 > 172.19.1.4: ICMP echo reply, id 32776, seq 4, length 28
19:01:30.681567 (authentic,confidential): SPI 0xca57b541: IP 172.19.1.4 > 192.168.1.1: ICMP echo request, id 32776, seq 5, length 28
19:01:30.681586 (authentic,confidential): SPI 0xcaa92d26: IP 192.168.1.1 > 172.19.1.4: ICMP echo reply, id 32776, seq 5, length 28
19:01:30.682120 (authentic,confidential): SPI 0xca57b541: IP 172.19.1.4 > 192.168.1.1: ICMP echo request, id 32776, seq 6, length 28
19:01:30.682142 (authentic,confidential): SPI 0xcaa92d26: IP 192.168.1.1 > 172.19.1.4: ICMP echo reply, id 32776, seq 6, length 28
19:01:34.226850 (authentic,confidential): SPI 0xca57b541: IP 172.19.1.4.32816 > 192.168.1.1.33438: UDP, length 12
19:01:39.310089 (authentic,confidential): SPI 0xca57b541: IP 172.19.1.4.32816 > 192.168.1.1.33439: UDP, length 12
19:01:44.388844 (authentic,confidential): SPI 0xca57b541: IP 172.19.1.4.32816 > 192.168.1.1.33440: UDP, length 12
^C
9 packets captured
242 packets received by filter
0 packets dropped by kernel
</pre></p>
<p>Traceroutes to other clients on the siteB LAN work fine.</p> pfSense - Bug #13624 (New): Only one alias in local network of OpenVPN Server works in 2.6.0https://redmine.pfsense.org/issues/136242022-11-02T11:55:36ZFlorian Bat
<p>Issue <a class="issue tracker-2 status-3 priority-4 priority-default closed" title="Feature: Support aliases in OpenVPN local/remote/tunnel network fields (Resolved)" href="https://redmine.pfsense.org/issues/2668">#2668</a> implemented the possibility to have host/network aliases in the OpenVPN local/remote/tunnel network fields.</p>
<p>When using host aliases in the local network field, it seems only the hosts of the very first alias are pushed to the client as local network. all other aliases seem to be ignored.</p>
<p><strong>Example:</strong><br />Let's say I have 3 host alias lists (named alias1, alias2 and alias3) with 2 hosts defined in each alias.</p>
<p>Using this as "local network" in the OpenVPN Server definition only pushes the ips of the <strong>alias1</strong> list.</p>
<pre><code class="html syntaxhl">alias1, alias2, alias3
</code></pre>
<p>This only pushes the hosts of <strong>alias2</strong>:</p>
<pre><code class="html syntaxhl">alias2, alias3, alias1
</code></pre>
<p>And this would push the two hosts of <strong>alias1</strong> plus the <strong>192.168.1.0/24</strong> and <strong>192.168.2.0/24</strong> networks as local networks.</p>
<pre><code class="html syntaxhl">alias1, alias2, 192.168.1.0/24, alias3, 192.168.2.0/24
</code></pre>
<p>I am using<br />2.6.0-RELEASE (amd64)<br />built on Mon Jan 31 19:57:53 UTC 2022<br />FreeBSD 12.3-STABLE</p>