OPNsense Forum
English Forums => General Discussion => Topic started by: iMx on January 22, 2022, 09:00:03 am
-
Recently upgraded my Virgin Media connection to Gig1 and with it (unfortunately) I was provided with a Hub 4 - from day 1, it has been a PITA. It took me hours and hours to finally get an IP address from modem mode to opnsense.
Running the device in Modem Mode, it is extremely picky about when/if it will let opnsense have an IP - or the DHCP servers are - certainly with the default DHCP settings, even though the opnsense defaults request more frequently than the FreeBSD defaults.
There are various reports of problems, with people using opnsense, pfSense, Asus, you name it. It seems to be 'pot luck' whether the device behind the modem gets an IP address or not, the suggested steps of:
- Power off the modem
- Restart your main firewall/router
- Give it a few minutes
- Power on the modem
.. seems to work in some cases, but not others. I do firmly believe there is still an element of luck to whether this works or not.
I read somewhere that if the DHCP request doesn't complete in a 15 second window, after the modem has booted, it basically ignores all other requests after. This was quoted from a Virgin engineer, so who knows....
I thought I had cracked it last time I had problems, when I filtered 192.168.100.254 in 'Reject Leases From' - otherwise opnsense ends up getting a 192.168.100.x address instead. Note, previous modems you needed to filter 192.168.100.1 (I believe).
Running tcpdump, filtering for DHCP requests/replies, the requests are being made, but just no response or not a completed response:
tcpdump -i eth0 port 67 or port 68 -e -n -vv
Last night the UPS on my cable modem died, opnsense failed over beautifully to 4G and until I heard a whining noise on my way to bed coming from the garage I didn't realise it had failed (Muted PushOver notifications after 10PM). So I removed the UPS, powered on the cable modem and went to bed - this morning, it still hadn't got an IP and was still running on 4G.
I tried restarting the modem, and opnsense, using the basic procedure above that is reported to (sometimes) work. But it didn't.
In the end, I discovered that Asus now has some '12Hz DHCP' option - to supposedly fix similar issues, where the device doesn't get an IP - which requests an IP 12 times a second (12Hz)?!?!
https://www.asus.com/my/support/FAQ/1043591/
Frustrated, I ended up putting '1' in every box in the DHCP options for the WAN interface - along with filtering 192.168.100.254 from DHCP replies - to try to make DHCP requests as frequent as possible. Rebooted the Hub 4....and it got an IP address first time.
... I don't really want to test this again, just yet, but will update this post with any further developments next time I come across it.
Aside from this, does anyone have any idea how to replicate the Asus 12Hz option? I do see some mention that others with Starlink and other cable modems also need to use this feature, so it doesn't seem to be Virgin specific.
-
After doing a bit more digging, some seem to suggest that the Asus 12Hz is 12 per minute - every 5 seconds.... which means it isn't 12Hz at all...
But I don't have an Asus router to check. Replacement UPS should arrive later, so I'll have to restart the Hub again.
Will perhaps try modifying my DHCP options to replicate every 5 seconds, rather than every 1, I think the opnsense default is 15 seconds (but then extends the re-try if no response, so you have to time it correctly - repeatedly every X seconds would be better potentially for the Hub 4).
.. especially if it is true that there is a 15 second window when the Hub 4 will hand out an IP in modem mode and then ignores all others.
-
From: https://www.freebsd.org/cgi/man.cgi?query=dhclient.conf&sektion=5&n=1
opnsense defaults:
- Timeout: 60
- Retry: 15
- Select-timeout: 0
- Reboot: 1
- backoff cutoff: empty
- initial interval: 1
So, for as much my benefit to work through this as potentially anyone else, this means:
- 60 seconds must pass, before the firewall decides it's not going to be able to contact a server
- After the 60 second timeout has passed, if there are static leases (which we shouldn't have) or any leases not yet expired (possibly/likely), client will loop through them trying to validate them
- After the 60 second timeout has passed, if there are no valid static leases or expired leases, client will restart the protocol after retry (15) interval
- 15 seconds must pass after opnsense has determined there is no DHCP server present, before it tries again to contact a DHCP server (default is 5 minutes in FreeBSD)
- select-timeout only seems to be relevant if there is more than one DHCP server on a network, not sure this is relevant in this case, especially as we are excluding the local requests from 192.168.100.254 so we want the first 'other' offer we receive (but get it with a zero setting anyway)
- When the client is restarted, 1 second must pass before it gives up trying to get its old address again (default 10 seconds)
- To try to prevent many clients making requests in lockstep, opnsense uses a backoff algorithm with some
randomness, default for this is 2 minutes. This is called backoff cutoff.
- There is 1 second between the first attempt to reach a server and the second attempt, each message sent the interval is incremented by twice the current interval multiplied by a random number between 0 and 1. If it is greater than the backoff cut off (2 minutes) it is set to that amount (2 minutes)
If we accept as 'true' that a device connecting in modem mode must make a DHCP request within a 15 second window, which perhaps could be 30 seconds to a few minutes after the Hub 4 starts up, we need much more consistent DHCP requests over this period to ensure we make at least 1 request in that 15 second window.
I believe it is this continually sliding and partially random interval that causes problems and perhaps adds some weight to why Asus also call theirs 'continuous' - in that it makes requests in a metronomic type fashion, to ensure a request is made within that 15 second window.
So if we assume that 'Asus 12Hz Continous DHCP' is not 12Hz, so not 12 requests a second (!!!) but more likely 12 per minute/every 5 seconds, perhaps reasonable options would be:
- Timeout: 4
- Retry: 1
- Select-timeout: 0
- Reboot: 1
- backoff cutoff: 1
- initial interval: 1
- Reject Leases From: 192.168.100.254
.. this should also potentially help as/when the DHCP IP address offer changes, due to reboot being set to 1.
-
Replacement UPS should arrive later, so I'll have to restart the Hub again.
Well I swapped in the new UPS, I left the Virgin Hub 4 powered off for about 25 minutes as it was last night when the previous UPS failed, poweedr it up...
... opnsense got an IP address first time using the settings above.
Fingers crossed. Guess time will tell, or if anyone else who has/is having problems can test.
-
had a similar problem with my hub/firewall. have the settings helped?
-
I haven’t had a Hub 4 for over a year, but I no longer had issues after these settings.