Messages

Followed instructions exactly as printed and NAT is showing as strict. Where does one troubleshoot?

Can someone point me to working instructions to load balance multiple WAN connections? My implementation seems to just randomly choose which connection to use.

I created another server that didnt seem to have this same problem (so far) and rebuilt the problematic one in a CARP configuration.

I'm assuming this is now resolved.

Hopefully this is just a newbie error as it doesnt seem like im doing it right.

I set up CARP with my LAN connection (And each of my VLAN connections) as well as my 3 WAN connections.

Everything syncs and the status looks right.

If i remove a connection from one machine, it drops 1 ping and then transitions to the other machine and resumes pinging. The problem is that some of the VIPs are sitting on each node and services dont work so I cant actually do dns lookups for example. I have the checkbox for disable preempt off on both nodes and set up the outbound NAT rules as well. Is there something else that I am missing?

Running the requested command found no issues

  <unbound>
    <enable>1</enable>
    <noreglladdr6>1</noreglladdr6>
    <cache_max_ttl/>
    <cache_min_ttl/>
    <incoming_num_tcp>10</incoming_num_tcp>
    <infra_cache_numhosts>10000</infra_cache_numhosts>
    <infra_host_ttl>900</infra_host_ttl>
    <jostle_timeout>200</jostle_timeout>
    <log_verbosity>2</log_verbosity>
    <msgcachesize>4</msgcachesize>
    <num_queries_per_thread>4096</num_queries_per_thread>
    <outgoing_num_tcp>10</outgoing_num_tcp>
    <unwanted_reply_threshold/>

   
DNS Server   Use gateway
94.140.14.14    WIRELESS1_DHCP - opt2 -
94.140.15.15    WIRELESS1_DHCP - opt2 -
94.140.14.14    WAN12_DHCP - opt1 -
94.140.15.15    WAN12_DHCP - opt1 -
94.140.14.14    WAN18_DHCP - wan -
94.140.15.15    WAN18_DHCP - wan

Nothing checked on this page

The response doesnt seem super healthy though.

> bing.com
Server:  UnKnown
Address:  192.168.2.1

DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
Non-authoritative answer:
DNS request timed out.
    timeout was 2 seconds.
Name:    bing.com
Addresses:  204.79.197.200
          13.107.21.200

I was able to restore access by adding the attached firewall rule (though I had not made any firewall changes and have an allow all rule already)

Adding now that DNS is currently not responding. I have not made any firewall changes but I cannot make a DNS request on my lan currently. Restarting Unbound (and the machine) has not resolved the issue. I am able to make a DNS request on a VLAN but not on the LAN network.

I have a new installation and am finding that DNS stops working randomly and I could use some advise on where to go to troubleshoot.

Unbound was serving up requests last night and this morning I was seeing DNS errors in a browser. So I went into diagnostics to perform a DNS lookup and it shows failed to 127.0.0.1 but the other external DNS servers (set up in the General section) resolve. A restart of Unbound resolves the issue.

These are the logs (I didnt cut anything out) from the point they last wrote until when I kicked off the restart

2021-12-09T06:21:22   unbound[87125]   [87125:0] info: service stopped (unbound 1.13.2).   
2021-12-08T21:39:19   unbound[87125]   [87125:0] info: generate keytag query _ta-4f66. NULL IN   
2021-12-08T14:39:41   unbound[87125]   [87125:1] info: generate keytag query _ta-4f66. NULL IN   
2021-12-08T14:39:41   unbound[87125]   [87125:0] info: generate keytag query _ta-4f66. NULL IN   
2021-12-08T14:39:41   unbound[87125]   [87125:0] info: start of service (unbound 1.13.2).

While I want to get to the root of the issue and could use pointers to further troubleshoot as I'm stuck, I could also use some pointers on how to detect and automatically remediate in the short term.

Thank you.

I am trying to manage our multiple WAN connections by ordering them in a Gateway group (ordered by Tier). I have a rule set as the first in my firewall (testing of course) to allow anything using that group for its gateway but the selected connection is tier 2 (instead of Tier 1). I opened the Firewall Live logs and filtered by source address of the device and I see no traffic.

What am I doing wrong?

Solved

Deleted the existing rules and recreated and is now working.

Got it. Thank you.

Did you ever get anywhere with this for a long term fix? I am seeing the same thing with a handful of constant repeats.

Thank you. That works but is that by design. With both Sophos XG and PFSense, I am able to configure it as a VLAN in the respective tool and that seems to work just fine.

I have a new installation and DHCP works fine on the LAN interface.

I created a new vlan, assigned it, enabled the interface, assigned an IP, set up a dhcp scope and enabled it. Created a temporary allow all rule in the firewall to test. When I move a device to the new vlan, the DHCP request (in the log) tries to be served by the LAN address.

So I assigned a static address and tried to ping the gateway and cant ping. Where do I look to troubleshoot?

For context, this is a hyper-v vm and I have another firewall as a vm (from another vendor) that I am migrating from with the same settings on the same switch and the same hyper v settings and it works over there, so I can say the switch and the hyperv network are not the issue.

Thank you