<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Inline responses… <br><br>On Mar 20, 2014, at 3:02 PM, Ryan Dunlop <<a href="mailto:ryan.c.dunlop@gmail.com">ryan.c.dunlop@gmail.com</a>> wrote:<br><br><blockquote type="cite">In the Alix documentation for that device it mentions that EHCI driver<br>could cause issues and panic conditions in FreeBSD. Maybe you want to<br>randomly toggle that off? Doesn't seem like anything to do with<br>anything, but neither does the rest of this situation…<br></blockquote>Not sure how to (easily) do that with the board without going via RS232. I’ll look into it.<br><br><blockquote type="cite">No outbound rules defined besides allow all?<br></blockquote>There were but I eliminated them.<br><br><blockquote type="cite">LAN address for pfSense static?<br></blockquote>Dynamic. Easier that way - assigned by the CenturyLink DSL modem<br><br><blockquote type="cite">Gateway defined for WAN?<br></blockquote>DHCP.<br><blockquote type="cite">Is the gateway (modem/switch in between) experiencing even short<br>glitches of being down?<br></blockquote>Not that I’ve seen. I can talk to the firewall constantly remotely (DMZ’d).<br><br><blockquote type="cite">There are a couple of settings in Advanced,<br>Miscellaneous for schedule states and gateway monitoring if your<br>connection is at all glitchy it may be killing all states for good<br>with these options and not coming back until a full reboot. Mine are<br>both unchecked.<br>Under Interfaces, LAN are you blocking private networks?<br></blockquote>No, because of the double-NAT.<br><br><blockquote type="cite">All cables in the bar good, no kinks, proper terminations, not mixed wiring?<br></blockquote>Yes, new cables, pre-fab, all tested.<br><br><blockquote type="cite">I know these are all very basic setup options, but being that neither<br>this list, nor the pfSense list can figure anything out, I want to<br>rule out a simple check box situation before the hardware is suspect.<br><br>Where does your RAM usage sit? I don't use much more (512MB) but <br>between 256MB and a 500Mhz proc, I am wondering if you are simply<br>pushing that hardware?<br></blockquote>I thought that, too. It’s working now after swapping the hardware out (again - third time). 54% utilization, 2% on states (459/23000), 22% of the disk in use.<br><br><blockquote type="cite">It should be fine for your bandwidth in a<br>simple setup but the 3 VLANS may be the issue when their bandwidth is<br>combined on the hardware. Mine is virtualized so although my RAM is<br>at that level it is also able to use a Xeon E5 2440. States aren't<br>being eaten up?<br></blockquote>My E5 VM at home is plugging away without issues… but it was built from the 2.0 image and upgraded to 2.1-RELEASE.<br><blockquote type="cite"><br>This is crazy...wish I could be more help!<br></blockquote><br>Heh, me too. I cannot possibly think of a reason. I was using a different power supply than was provided but I just put it to the right one today (12V 1A instead of 15V 1.5A I think it was shipped with).<br><div style=""><blockquote type="cite"><br><br><br><br>On Thu, Mar 20, 2014 at 2:09 PM, Ryan Coleman <<a href="mailto:ryanjcole@me.com">ryanjcole@me.com</a>> wrote:<br><blockquote type="cite">They load the first few lines but once it needs another site (say yahoo's CDN on their homepage) it stalls. Google loads but it's all inclusive - no CSS or JS files.<br><br>Email is blocked 90% of the time.<br><br>--<br>Ryan Coleman<br><a href="mailto:ryanjcole@me.com">ryanjcole@me.com</a><br>m. 651.373.5015<br>o. 612.568.2749<br><br><blockquote type="cite">On Mar 20, 2014, at 14:06, Ryan Dunlop <ryan.c.dunlop@gmail.com> wrote:<br><br>So are you actually not getting to these pages at all, or are these<br>just showing in the log? I ask because pfSense does this a lot. Here<br>is a look at my situation:<br><br>Mar 20 13:53:32 LAN 10.0.0.84:44553 74.125.225.6:80 TCP:FPA<br>Mar 20 13:53:32 LAN 10.0.0.84:38737 74.125.225.6:80 TCP:FPA<br>Mar 20 13:53:13 LAN 10.0.0.84:44553 74.125.225.6:80 TCP:FPA<br>Mar 20 13:53:13 LAN 10.0.0.84:38737 74.125.225.6:80 TCP:FPA<br>Mar 20 13:53:02 LAN 10.0.0.84:44553 74.125.225.6:80 TCP:FPA<br>Mar 20 13:53:02 LAN 10.0.0.84:38737 74.125.225.6:80 TCP:FPA<br>Mar 20 13:52:56 LAN 10.0.0.84:38737 74.125.225.6:80 TCP:FPA<br>Mar 20 13:52:56 LAN 10.0.0.84:44553 74.125.225.6:80 TCP:FPA<br>Mar 20 13:52:54 LAN 10.0.0.84:44553 74.125.225.6:80 TCP:FPA<br>Mar 20 13:52:54 LAN 10.0.0.84:38737 74.125.225.6:80 TCP:FPA<br>Mar 20 13:52:53 LAN 10.0.0.84:38737 74.125.225.6:80 TCP:FPA<br>Mar 20 13:52:53 LAN 10.0.0.84:44553 74.125.225.6:80 TCP:FPA<br>Mar 20 13:52:53 LAN 10.0.0.84:44553 74.125.225.6:80 TCP:FPA<br>Mar 20 13:52:53 LAN 10.0.0.84:38737 74.125.225.6:80 TCP:FPA<br>Mar 20 13:52:53 LAN 10.0.0.84:38737 74.125.225.6:80 TCP:FA<br>Mar 20 13:52:53 LAN 10.0.0.84:38737 74.125.225.6:80 TCP:PA<br>Mar 20 13:52:53 LAN 10.0.0.84:44553 74.125.225.6:80 TCP:FA<br>Mar 20 13:52:53 LAN 10.0.0.84:44553 74.125.225.6:80 TCP:PA<br><br>These are all "blocked". Yet in reality we got to these pages, it's<br>simply this: https://doc.pfsense.org/index.php/Why_do_my_logs_show_%22blocked%22_for_traffic_from_a_legitimate_connection<br><br>Although the article talks about it being late arriving FIN packets,<br>it does happen to ACK too... Just need to clarify if you are actually<br>getting fully rejected from getting anywhere, or if it's a log thing<br>you are seeing. I'll look back through your pfsense mailing list<br>postings too.<br><br>Ryan<br><br><blockquote type="cite">On Thu, Mar 20, 2014 at 11:46 AM, Ryan Coleman <ryanjcole@me.com> wrote:<br>I have an open issue that after about 20-24 hours the firewall stops routing internal data out (I can remote in, I can ping from internal networks, but many simple requests are getting blocked by the default rules).<br><br>I think I might be pushing my luck with the 3 routed VLANs (4, if you count VLAN1) on the hardware (ALIX 2D13) but I am otherwise completely at a loss for ideas.<br><br><br>--<br>Ryan<br><br><br>_______________________________________________<br>TCLUG Mailing List - Minneapolis/St. Paul, Minnesota<br>tclug-list@mn-linux.org<br>http://mailman.mn-linux.org/mailman/listinfo/tclug-list<br></blockquote>_______________________________________________<br>TCLUG Mailing List - Minneapolis/St. Paul, Minnesota<br>tclug-list@mn-linux.org<br>http://mailman.mn-linux.org/mailman/listinfo/tclug-list<br></blockquote>_______________________________________________<br>TCLUG Mailing List - Minneapolis/St. Paul, Minnesota<br>tclug-list@mn-linux.org<br>http://mailman.mn-linux.org/mailman/listinfo/tclug-list<br></blockquote>_______________________________________________<br>TCLUG Mailing List - Minneapolis/St. Paul, Minnesota<br><a href="mailto:tclug-list@mn-linux.org">tclug-list@mn-linux.org</a><br>http://mailman.mn-linux.org/mailman/listinfo/tclug-list<br></blockquote></div><br></body></html>