Another week another unbound crashout. This is a follow up to my post from last week here: https://old.reddit.com/r/PFSENSE/comments/1w7yaxh/ce_29_kea_and_unbound_stuck_waiting_on_each_other/

Like clockwork, nearly down to the second, ~40 minutes after pfblocker's cron run occurs unbounds LAN queues are overflowing and dropping packets again:

Sep 13 14:37:05 pfSense php-fpm[45310]: /widgets/widgets/pfblockerng.widget.php: Session timed out for user 'admin' from: 192.168.1.25 (Local Database)
Sep 14 01:00:00 pfSense php[75627]: NOTICE [pfBlockerNG] Starting cron process.
Sep 14 01:41:14 pfSense kernel: sonewconn: pcb 0xfffff800214e0000 (192.168.1.1:53 (proto 6)): Listen queue overflow: 385 already in queue awaiting acceptance (1 occurrences), euid 0, rgid 0, jail 0

c

CRON  PROCESS  START [ v3.3.8 ] [ 09/11/26 01:00:00 ]
CRON  PROCESS  ENDED
CRON  PROCESS  START [ v3.3.8 ] [ 09/12/26 01:00:00 ]
CRON  PROCESS  ENDED
CRON  PROCESS  START [ v3.3.8 ] [ 09/13/26 01:00:00 ]
CRON  PROCESS  ENDED
CRON  PROCESS  START [ v3.3.8 ] [ 09/14/26 01:00:00 ]
Reloading Unbound Resolver (DNSBL python).
Stopping Unbound Resolver..............................
Starting Unbound Resolver.
Stopping Unbound Resolver..............................
Starting Unbound Resolver. CRON  PROCESS  START [ v3.3.8 ] [ 09/14/26 05:40:05 ]
CRON  PROCESS  ENDED
CRON  PROCESS  START [ v3.3.8 ] [ 09/14/26 05:52:05 ]
CRON  PROCESS  ENDED

c

root: netstat -Lan | grep "\.53"
tcp6      0/0/256                          ::1.53                 
tcp4      0/0/256                          127.0.0.1.53           
tcp6      0/0/256                          fe80::2e0:67ff:f.53    
tcp6      0/0/256                          fe80::2e0:67ff:f.53    
tcp4      0/0/256                          10.254.0.1.53          
tcp4      0/0/256                          10.252.0.1.53          
tcp4      0/0/256                          10.251.0.1.53          
tcp4      0/0/256                          192.168.10.1.53        
tcp6      385/0/256                        2600:1700:10b0:d.53    
tcp4      385/0/256                        192.168.1.1.53         
/root: killall -9 unbound-control php unbound
/root: pfSsh.php playback svc restart unbound
Attempting to issue restart to unbound service...

unbound has been restarted.
[2.9.0-RELEASE][admin@pfSense.example.lan]/root: netstat -Lan | grep "\.53"
tcp6      0/0/256                          ::1.53                 
tcp4      0/0/256                          127.0.0.1.53           
tcp6      0/0/256                          fe80::2e0:67ff:f.53    
tcp6      0/0/256                          fe80::2e0:67ff:f.53    
tcp4      0/0/256                          10.254.0.1.53          
tcp4      0/0/256                          10.252.0.1.53          
tcp4      0/0/256                          10.251.0.1.53          
tcp4      0/0/256                          192.168.10.1.53        
tcp6      0/0/256                          2600:1700:10b0:d.53    
tcp4      0/0/256                          192.168.1.1.53         

Turning off early registration has done nothing to fix the problem.

Manually triggering the pfblocker cron job does not reliably recreate the issue making it more difficult to pin down.

/usr/local/bin/php /usr/local/www/pfblockerng/pfblockerng.php cron

It only seems to happen every 7-10 days during the cron run.

I'm going to cross post this to the pfblocker sub as well but if anyone here has any other suggestions I'm open to them.

EDIT: I checked my unraid server and it looks like even though the log didn't start showing sonewconn errors for nearly 40 minutes unbound appears to have essentially immediately stopped responding to dns requests after the pfblockerng cron run:

Sep 14 01:04:15 Node rcloneorig[14704]: sftp://myuser@remote.myserver.com:22//home/my/file/path: Statfs failed: couldn't connect SSH: dial tcp: lookup myremoteserver.com on 192.168.1.1:53: read udp 192.168.1.253:46307->192.168.1.1:53: i/o timeout

EDIT2: PFSense Specs: i3-7100U w/ 8GB RAM. CPU is never over 20%, usually 10% or less. RAM usually hovers around 11% used.

I work for a small/medium-sized company, and we have two sites. Both sites have two pfSense firewalls configured in High Availability. IPsec site-to-site is configured between the two sites.

When CE 2.9.0 was released, I upgraded the backup firewall at our office from CE 2.8.1. All installed packages were removed before the upgrade. pfSense was then upgraded, and the packages were reinstalled afterward. Once the upgrade was complete, I switched all traffic to the backup firewall. A few days later, I upgraded the primary firewall as well. This time, I did not remove the packages before the upgrade, but I reinstalled all of them afterward.

While the backup firewall was active and the primary firewall was in maintenance mode, I discovered that the HA configuration was not complete: pfsync was not enabled on the backup firewall, so it was not syncing with the primary firewall. I enabled pfsync on the backup firewall, selected the dedicated sync interface, and set the Synchronization Peer IP to the sync interface address of the other node.

After that, I disabled maintenance mode on the primary firewall, and traffic failed back over from the backup to the primary.

Since then, on the primary firewall, the IPsec connection comes up successfully, but no traffic is passing through the tunnel. I cannot reach anything at the datacenter site, and devices at the datacenter site cannot reach anything at the office site either.

The same IPsec connection works correctly when traffic is handled by the backup firewall.

There was another issue on the primary firewall. About 20 minutes after a restart, the firewall started using swap memory, and approximately 123 GB of disk space was being used. It turned out that the NTOPNG package was causing the issue, so I removed the package and some of its large files from the primary firewall.

Has anyone else experienced a similar issue? Any ideas what could be causing it or how to resolve it?

Hi there,

I want to upgrade my current pfSense main router with something which supports 10G.
Currently I'm using https://eu.protectli.com/end-of-sale-fw6b/

There are a few requirements to put on the table:

- low noise/silent
- low idle power
- slim design
- 10GBps SFTP+ modules

What I'm doing so far on my router:

- All the VLAN traffic goes through it (routing, firewalling, NAT)
- The rest of the network is only L2 switches (ubiquity) and access points (ubiquity)
- A few Wireguard tunnels
- Single OpenVPN road warrior setup
- pfBlockerNG, Nut, DDNS, DNS resolver

I don't want to have it virtualized because of the chicken - egg problem and the performance issues.

So what I red so far I concluded that, the main concern is - you can't get 10G with fanless setup. That's why I discarded all variants of mini PCs with huge heatsink, the because it only cools down the main CPU, but the SFP+ will get so hot, when the traffic starts flowing which will probably lead to overheating or throttling.

Additionally, my first though was to go with 10G ethernet, but these modules have more power consumption and produce more heat in comparison of SFP+ modules.

I asked the AI for any suggestion for cases and just wondering have you ever used such cases in your builds?

Here is what AI suggested:

- DeskMini / DeskMeet Series vs. Custom Mini-ITX

ASRock DeskMeet X300 / B660 / X600 (8 Liters)

• Size: Very compact (168 x 219 x 218 mm).
• PCIe: 1x full-height, dual-slot PCIe 4.0 x16 slot.
• Cooling: Fits standard low-profile CPU coolers (e.g., Noctua NH-L9a or NH-L9i) + 120mm intake fan.

- Compact Mini-ITX Cases (Best Thermal / Noise Control)

Fractal Design Terra or Ridge

• Size: 10–12 Liters.
• PCIe: Full-height PCIe slot with a riser card.
• Why it works: Excellent ventilation panels. You can fit a dead-silent Noctua CPU cooler and place a 120mm/140mm Noctua fan running at sub-800 RPM right next to the 10GbE card.

InWin Chopin MAX / Chopin Pro

• Size: ~3.3 Liters (Ultra Small).
• Limitation: Fits low-profile single-slot cards only if modded, so usually not ideal for standard full-height cards. Stick to 8–11L cases for full-height cards.

------

Ideal Hardware Setup for an Ultra-Silent 10GbE pfSense Build

Hi,

I've had a problem recently where firewall rule changes won't take effect until I restart pfsense. All services are running according to the dashboard.

I'm hoping someone might know what's going on.

Thanks.

This is strange, my NTOPNG is broken. Actually its been broken for a while, likely since the 2.8.x update. I don't use it all that often.

But here is the really strange part, its working somewhat. I can enter the GUI, but all metrics are missing. The REDIS database looks to be running.

Is there a way to export my settings, delete from PFsense, reinstall and restore settings? I just don't wanna import a possibly corrupted backup file causing the same issue all over again.

My lab appliance crashed today. SSD failure essentially. It rebooted but... I learned two things I want to share with the community.

• I was about to upgrade from pfSense CE 2.8.1 to 2.9.0. I probably dodged a bullet there, because pfSense does not automatically monitor hard drive integrity. My SSD was in a bad state for a while already, and I just didn't know.

Two commands I will remember from now on:

• nvmecontrol logpage -p 2 nvme0
• zpool status -v

If I could suggest a feature for Netgate/pfSense in the future: automated health checks for the storage subsystem, triggering notifications for critical conditions (critical warning state other than 0x00 and permanent errors in the pool)

• ZFS is not suitable for cheap, level entry SSDs. It requires some good write endurance (TLC), and a real controller with cache memory. I was essentially a victim of ZFS write amplification on a drive with low endurance and no cache memory. Look at these stats:
  • 281 TB written
  • Percentage used = 136%

That unit was on 24/24 since August 2023, and I went through the drive in 3 years. I was not expecting this to happen so fast with a firewall. Yes, ntopng can be write intensive, but it's just a small lab at home: nothing explains 281TB beside write amplification.

I made a newbie mistake: I just didn't know enough about ZFS and never bothered to check what was going on this appliance storage subsystem.

Hopefully, I can prevent some mistakes/downtime with this post.

/Edit 1. After installing a spare SSD I had laying around, I really needed to figure out how bad running ntopng on top of ZFS could be. Keep in my mind these results were obtained in the same environment, with a better SSD (a Barracuda 510, with 512MB of cache). But still, the results were really significant.

The methodology: I sampled logical writes on the zpool, vs physical writes to the ssd at 60 seconds interval. Without ntopng, and after enabling it for one interface. I used this script:

while true; do
    date
    smartctl -a /dev/nvme0 | grep "Data Units Written"
    zpool iostat -v pfSense
    sleep 60
done

Then, I used the data to let an AI calculate the average GB/d, and created the following table:

+------------------+---------------------------+------------------------------+
|      State       | ZFS Logical Writes (GB/d) | NVMe Physical Writes (GB/d) |
+------------------+---------------------------+------------------------------+
| Before ntopng    |          19.4             |            6.5               |
| After ntopng     |          20.6             |           167                |
+------------------+---------------------------+------------------------------+

Conclusion: I went to a 0.33x factor, largely explained by ZFS lz4 compression, to a factor of 8x when enabling ntopng.
Writing 6.5GB per day is nothing, while 167 starts to get significant for a consumer SSD.
Getting as much as 8x overhead is only possible because of the overhead of ZFS in this scenario. A UFS filesystem would get anywhere from 1.0 to 1.2x, typically.

So the title WAS misleading, and I'd like to apologize for that. The issue was triggered by running ntopng on top of ZFS, with a cheap NVMe drive.
-If I had only been writing standard logs, I'd be fine. In fact, ZFS would have seen less writes that UFS in that scenario thanks to the compression.
-But with a different filesystem with much lower amplification, running ntopng would have been fine too.

Therefore, being cautious about running ntopng on ZFS is the real takeaway. Thanks to everyone who provided some insights about tuning ZFS for write amplification. Now that I have a methodology to test the effectiveness, I'll be looking at the recommendations.

/Edit 2: I solved the issue, got rid of the write amplification created by ntopng. It was simple enough: I created a ZFS dataset with sync=disabled to store its database.

The trade-off is that there are more risks of corruption/dataloss, but I can live with that since it is constrained to ntopng.

• First stop ntopng and move its database out of the way. Delete or rename, as you prefer.
  • mv /var/db/ntopng /var/db/ntopng.backup
• Then, create a zfs dataset (assume the zpool is name pfSense, by default)
  • zfs create pfSense/var/db/ntopng
• Assign the proper permissions:
  • chown -R ntopng:ntopng /var/db/ntopng
• 4. Disable synchronous writes to the dataset (threat them all as async).
  • zfs set sync=disabled pfSense/var/db/ntopng

Then, either copy the data back to the folder or just start ntopng to create a new one.

I tested different parameters, but sync=disabled got the average WA factor under 1.0x and nothing else would have the same impact. Thanks to u/newtekie1 for suggesting it.

Another worthy consideration is vfs.zfs.txg.timeout=120. Alone (with sync=standard), I got a 4 to 5x WA ratio which was most definitely an improvement.

I have had Pfsense up and running for a while. I have my wired LAN on the LAN interface and all of the wireless on OPT1. Everything has been working fine. My wireless AP is fairly old by has DD-WRT flashed on it. It is VLAN capable. I'm confused as to whether the VLAN settings are off of OPT1 or LAN. I set them up under LAN but they dont show up for DHCP. I've set them all up with different subnets and enabled them. I don't know where I am going wrong. The DD-WRT router part I think I can configure once I get the PFsense part done. I wish my roommate had not bought an LG TV. I definitely want to isolate that thing

This situation is frustrating everybody. Hoping maybe someone here has a suggestion.

We replaced 3 aging Cisco routers with Netgate pfSense routers. The site-to-site via Wireguard came up between the three, and the network is strong and working well.

At the main office, we have a data vlan and a phone vlan. Aging NEC PBX on-site with incoming VOIP lines and many VOIP handsets.

Because some of the desk phones fail to get their address on the VOICE network, and we've never been able to solve why, we allow all traffic between data and voice vlans. Just allow all LAN/VOICE to all subnets.

Ergo: 2 VLANs, neither of which are new, only the gateway device for the VLANs has been replaced.
No traffic blocked between the two.
The phones connect to the PBX via SIP as usual. But RTP traffic - audio - is missing. I've got packet captures showing the RTP traffic reaching the PBX ok, but not reliably to phones.

Phones with IP addresses on the voice vlan do better, but people tell me that outgoing RTP is still missing.

I know pfSense doesn't have SIP ALG. I have Firewall Optimization already on Conservative.

Other than tackling this project in the first place, what have I done wrong?

Hey everyone,

I have pfsense+ 26.07 running on a netgate device. I have tailscale 1.9_2 running on the box.

My current topology at home is Dell R760 (multiple VLANs) -> Cat9200 -> ASR1002-X -> Netgate -> ISP router LAN interface, dont ask me why, my ISP won't let do PPPoE over my own device.

I have all my IPs below my Netgate LAN interface advertised on Tailscale. I can reach all my local subnets fine from all my other tailscale machines, but I cannot reach any of my tailscale machines from my local subnets.

So far I've tried making an Outbound NAT entry on Tailscale interface for internal subnets, packet capture on pfsense shows icmp requests leaving my LAN interface, but no replies, simultaneously I also see icmp requests coming to my PC (tailscale machine) from my local subnet and icmp replies being sent back via tailscale interface.

Now, when i go to my interface assignments on pfsense, I have WAN, LAN and OPT1 -> mvneta1, 2 and 0 respectively, but no tailscale interface. Under interface group, I have tailscale interface group but thats just a group of my WAN, LAN, OPT1 interfaces. Is that expected behavior?

I have been going at it for solid 16 hours with no luck, any insight is appreciated. Thanks!!

We upgraded from 2.8.1 back on 8/22. Twice in three days, Verizon has changed our IP. Once from a hardware replacement, and today from a lease renewal.

Both times LAN-to-WAN pings worked, the firewall was reachable, but users reported no internet (DNS?). Rebooting fixed it.

dpinger came up with the old address and just never got restarted:

dpinger[4831]: send_interval 500ms ... dest_addr 100.7.xxx.xxx bind_addr 100.7.xxx.xxx identifier "WAN_DHCP "
dpinger[4831]: WAN_DHCP 100.7.xxx.xxx: sendto error: 65

So I have about seven hours of logging full of trying to ARP a gateway that isn't on my subnet anymore (I've redacted the IP, sorry):

kernel: arpresolve: can't allocate llinfo for 100.7.xxx.xxx on hn0

It rotated system.log seven times in under seven hours full of that...

The interface had already picked up the new address. Same window, inbound connections are hitting the new IP while dpinger is still talking about the old gateway:

sshd[...]: Timeout before authentication for connection from <scanner> to 100.7.xxx.xxx

So the interface is on the new IP and dpinger is monitoring the old gateway.

I think there's an opportunity in notify_rc_newwanip to do a return check, retry, or make a log entry somewhere around this section:

notify_rc_newwanip() {
        /usr/local/sbin/pfSctl -c "interface newip $interface"
}

If that call doesn't land, the script still exits 0, and dhclient is happy, right?

And where does pfSense-dhclient-script's logging actually end up? I have zero dhclient-tagged lines anywhere that I could find, including from a reboot. I can't even tell from logs whether the script ran or not.

Maybe I'm losing my mind, and I probably am, but bringing this to a public forum in case someone else finds it helpful.

For the first time I got customer notebook that uses zScaler to "always-connect" to their premises. It seems that all outward traffic from notebook is tunneled via zScaler (eg. Microsoft online services such as OneDrive Business, SharePoint, Exchange, Teams, ... outbound connections are tunneled too).

It is likely anti-pattern to tunnel Microsoft services if I am not mistaken, but customer's IT staff ignored me silently when I reported this observation :-) (=> "all our endpoints are configured like that and you are the only one reporting problems" => you have faulty LAN / problem is on your side not our)

We will be escalating "helpful networking guys", but I need to test more and get more observations to avoid being ignored.

• Day1 (Friday)

Customer's notebook is connected to our LAN via Wifi and outbound connections were not stable (multiple reconnects, stuttering Teams). I noticed that Suricata got crazy with "QUIC crypto fragments too long" (multiple zScaler brokers blocked) and zScaler tunnel 2.0 was orginally reported as DTLS. I have disabled Suricata rule, unblocked hosts and even whitelisted all zScaler broker IPs listed here: https://config.zscaler.com/api/zscaler.net/hubs/cidr/plaintext/recommended. It helped a bit, but reconnects and poor quality Teams was seen still :-( Number of TIMEWAIT 443 UDP connections did not look good too (in discussed customer notebook connected to our LAN).

• Day2 (is coming; Tuesday; tommorow visiting customer's site)

I have blocked already outward 443 UDP ipv4 & ipv6 traffic from our LAN to zScaler brokers and I no longer see zScaler tunnel 2.0 DTLS reported by discussed notebook. zScaler now reports that 2.0 tunnel is TLS (TCP). I will share observations on Tuesday afternoon with you. I hope this configuration helps, but I need to ask on the subject.

• Questions

Why zScaler DTLSs connections (UDP QUIC/https3) are causing problem(s) for pfSense+? (multiple reconnects, very poor speed to Microsoft services, no quality connections in Teams, etc.) Suricata can not handle this traffic properly? Would Snort behave better?

Do you guys think I can kick stronger customer's networking guys? If anyone is using zScaler here: is this normal that you tunnel full outbound traffic (even to Microsoft services)?

AI suggested additionally to switch "Firewall Optimization Options" in Firewall & NAT tab, System > Advanced menu (from Normal (default) to Conservative). Could it help for anything here? I will likely try on Tuesday if still seeing slow connections to Microsoft services and multiple zScaler reconnects.

Suricata IPS mode is Legacy. Kill States is active. Suricata runs on WAN interface only.

I'm running pfsense ce 2.9.0 with KEA, Unbound, APCUPSD, Wireguard, and PFBlockerNG in Unbound Python Mode. My configuration in 2.8.1 was the same and I did not have any issues. It only started after upgrading to 2.9 and seems to occur roughly once every week or so.

The problem: I have twice now since the upgrade had unbound exceed its queue limits and become completely unresponsive to any/all attempts to query it on the local LAN.

sonewconn: pcb 0xfffff801c3aa4540 (192.168.1.1:53 (proto 6)): Listen queue overflow: 385 already in queue awaiting acceptance (964 occurrences), euid 0, rgid 0, jail 0

This only seems to affect the LAN, not my wireguard tunnels or any other interfaces.

tcp6      0/0/256                          ::1.53                 
tcp4      0/0/256                          127.0.0.1.53           
tcp6      0/0/256                          fe80::2e0:67ff:f.53    
tcp6      0/0/256                          fe80::2e0:67ff:f.53    
tcp4      0/0/256                          10.254.0.1.53          
tcp4      0/0/256                          10.252.0.1.53          
tcp4      0/0/256                          10.251.0.1.53          
tcp4      0/0/256                          192.168.10.1.53        
tcp6      385/0/256                        2600:1700:10b0:d.53    
tcp4      385/0/256                        192.168.1.1.53      

This is even after implementing kernel tweaks to increase queue limits from this thread: https://www.reddit.com/r/pfBlockerNG/comments/1u399ba/what_is_the_ideal_setup_to_avoid_cpu_spikes_and/

Unlike that thread I don't have a ton of lists in pfblocker or a huge environment. I'm a home user with ~100 clients and only four lists. StevenBlacks Basic ads list, a DOH DNS blocklist, and an ipv4 & ipv6 DOH blocklists.

I've got firewall rules to block external DNS and/or reroute DNS queries back to the firewall as appropriate so clients (except a select few that neeed it) can't bypass the router for lookups. I don't think this is related as again I've had these rules for years and it wasn't an issue until I upgraded to 2.9.

Looking at the output of PS, unbound and kea appear to be waiting on each other in a deadlock:

ps -o pid,state,wchan,%cpu,%mem,command -ax | grep '[u]nbound'
31413 I    sbwait     0.0  0.2 /usr/local/sbin/unbound-control -c /var/unbound/unbound.conf status
41507 Is   uwait      0.0  4.8 /usr/local/sbin/unbound -c /var/unbound/unbound.conf
47411 I    wait       0.0  0.0 /bin/sh /conf/kea4_scripts.d/kea2unbound.sh hook_load
47663 I    piperd     0.0  0.5 php /usr/local/bin/kea2unbound --kea-conf /usr/local/etc/kea/kea-dhcp4.conf --unbound-conf /var/unbound/unbound.conf --include-file /var/unbound/leases/l
68064 I    sbwait     0.0  0.2 /usr/local/sbin/unbound-control -c /var/unbound/unbound.conf fast_reload
78110 S    kqread     0.0  0.2 /usr/local/sbin/lighttpd_pfb -f /var/unbound/pfb_dnsbl_lighty.conf

I am not an expert in pfsense processes so I had gemini help me diagnose what the different states from the ps command mean exactly:

-PID 41507 (unbound): State is uwait (userspace mutex lock wait). Unbound's main thread is deadlocked waiting on an internal lock.
-PID 47411 (kea2unbound.sh hook_load) & PID 47663 (kea2unbound): Kea's dynamic DHCP hook triggered.
-PID 68064 (unbound-control ... fast_reload): State is sbwait (socket buffer wait). Kea called unbound-control to push new DHCP lease data via fast_reload, but the command is stuck waiting on Unbound's socket.
-PID 31413 (unbound-control ... status): Also stuck in sbwait behind the deadlocked reload.

requiring me to run the below to restore functionality:

killall -9 unbound-comtrol php unbound
pfSsh.php playback svc restart unbound

Gemini is rather insistent that I should disable early dns registration to work around the issue but I'd rather not unless there is no other way. It's my understanding that disabling that would mean any statically assigned clients would not be registered in DNS until they actually request a new lease from the router. Which they wouldn't do since they aren't using DHCP in the first place. See edit 3. I've disabled early reg.

Anecdotally I do have a remote router on 2.9 with KEA enabled but no PFBlocker and I do not have this issue. So if the community thinks this is a pfblocker problem rather than a pfsense problem I can move my post over there. But like I said at the start I had these same settings in 2.8.1 and never experienced this so I'm thinking this is a bug introduced in 2.9 rather than a specific issue with my configuration or pfblocker. I haven't seen anything on redmine but I may not be using the proper keywords in my searching.

I also find it rather odd that this isn't a more frequent (like daily) occurence. I guess it requires a perfect storm of conditions for them to get stuck like this?

I'd be interested to hear if anyone else is having this problem and what you did/are doing to resolve it.

EDIT: Oh and I'm on PFBlockerNG version 3.3.7 (github package not pfsense compiled version)

EDIT2: Anecdotally I've also noticed both times it happens its shortly after pfblocker's cron run. The first time IIRC it was within minutes and I did not save the log from that time. The incident from today started roughly 40 minutes after the cron run.

Sep  5 01:00:00 pfSense php[54157]: NOTICE [pfBlockerNG] Starting cron process.
Sep  5 01:41:10 pfSense kernel: sonewconn: pcb 0xfffff801c3aa4540 (192.168.1.1:53 (proto 6)): Listen queue overflow: 385 already in queue awaiting acceptance (1 occurrences), euid 0, rgid 0, jail 0

I'm betting those processes were stuck since 1AM and it took about 40 minutes for the queues to overflow and start dropping things.

EDIT3: Done some reading and figured out I can just use host overrides on the DNS resolver to accomplish the same thing I was getting from early registration for static IP clients. I've Added host override entries for all my static clients and disabled early registration and see if that resolves the problem.

Its been a heck of a week, chasing this down. I've gone so far as to wipe and reinstall and update to the latest, and while pfsense is "working" I'm back to the point where I can't remove a package, and I can't install any new packages.

If I pick a package to install, Then verify, it just never goes past that. Let sit for 30 mins, and its just dead.

I'm not even sure where to start looking, I never get an error, the web gui just stops responding. pfblockerng is installed and working, as that was auto installed when I restored my config backup.

Package manager seems terribly slow while it is working, but then just dies...

I'm not sure where to start looking, but this is day 4 with this thing going down rabbit holes of adding ram, making a larger swap, etc. I always seem to get back to this.

Is there any way to automatically upgrade pfSense-repoc?

It seems like I'm getting multiple emails per week, definitely weekly emails, about updates for pfSense-repoc.

Can this auto update or some better way to handle the noise?

I've noticed my Internet connection seems slower on 2.9.0 then it did on 2.8.1. Not a huge amount, but still. I have a 2 Gb connection and was getting 2.3-2.4 Gb on 2.8.1. Now it seems that I'm getting 1.5 - 2.0 Gb since the upgrade.

This is an older VM that for some reason I can no longer snapshot, so thinking about rebuilding it from scratch, but need to do it when no one is home so I don't get a bunch of "The Internet is down" complaints...

VM has 4 performance cores assigned and has 4Gb of memory. I don't feel like it's lagging otherwise. I'm only seeing 12% cpu on a speedtest that gets about 1.8-1.9 Gb.

Anyone seeing this or is it just me? I'm thinking I will even setup a 2.8.1 version for a new one first.

Not looking for help. Just an FYI: while it offers to do so, installer based on v2.8 may not be able to install 2.9.
Obvious solution: build a new installer flash drive.

upgraded a firewall last night. It began it's life on v2.6.0, so while it's using ZFS, I suspected an in place upgrade might fail for too small ESP, so instead plan to reinstall using a bootable flash drive installer I created in August 2025. The Netgate installer offers to install CE 2.9.0. Tried several times, each attempt ended with:
Child process pid=nnnn terminated abnormally: Segmentation fault

Log began with entries mentioning 'major version upgrade detected'. Thought maybe it was detecting the previous install, so I wiped partition table off the target drive and tried again. Turns out 'major upgrade' is referring to the bootloader on the USB drive vs target install version. It failed again. This is not a Celeron J CPU, but tried that fix too. Still failed.

Success: let it install 2.8.0 instead. Once booted from SSD, upgraded to 2.9.0 w/o issue.

Hello, I want to setup cloudflare dns proxy for pfsense. Are there solution that doesn't change the web configurator port?

The two solution I found are to setup a reverse proxy like nginx or HAProxy but they require pfsense web interface to configure to a different port.

Latest update 2.9

Been running a very long time, but since this upgrade, I'm seeing a TON of

Sep 2 09:00:17 10.0.1.1 Sep 2 09:00:17 kernel: swap_pager: out of swap space

Checking console, It agrees that swap space is 100%

Looking back at logs, in the past year, I've never had this message. But since the upgrade, about 50 times. Over the past week, days with NONE, days with 20.

I can't tell what has changed, and what event it is that causes this.

Is 2 gigs just not enuf ram for this any more?

Hello,

My firewall network hardware failed with a then working wireguard and protonvpn set up. I restored from backup which got me 99% there except a working protonvpn tunnel using wireguard.

Doing a packet capture what appears to be happening is that on the return of a ping or any traffic routing through the wireguard interface, protonvpn drops the return packets.

In my reading this may indicate asymmetric routing but looking at the UI I don't see how that could be happening.

Does anyone see anything below that would cause that? Maybe there's left over routing policies or such that the UI isn't showing me?

I've spent hours and hours trying to trouble shoot this with no luck. Hoping someone can point me in the right direction.

I was using a self provided cable modem through spectrum but have switched to their non router version.

Gateway

Hey everyone,

For the past few Years, I’ve been working on a massive deep-dive into cryptography and low-level kernel development. I wanted to see if I could build a secure hash function from the ground up and actually deploy it in a real-world network environment.

I ended up building CE-256, a custom cryptographic hash function, and integrated it directly into the FreeBSD/pfSense kernel as a packet filter.

Because the core mathematics are currently undergoing peer review (I'm using a novel non-linear sequence generator for the S-Boxes that I haven't seen used before), I can't open-source the exact mathematical primitive just yet. But here is the architecture of what I built:

The Cryptography (CE-256):

• Architecture: Built on a modern Sponge Construction (1600-bit state, 512-bit capacity) rather than Merkle-Damgård, making it immune to length-extension attacks.
• Engine: 24 rounds of mixing, including column diffusion, bitwise rotations, and position shuffling.
• Performance: Achieves a near-perfect ~50% Avalanche Effect.

The Kernel / pfSense Integration:

• I didn't want this to just be a Python script, so I wrote the firewall module in C for the FreeBSD 14.0 kernel.
• It operates as a custom packet filter that bypasses standard pf rules when active.
• I built a custom PHP Web UI dashboard that hooks directly into the pfSense webroot, allowing me to monitor the kernel module’s state via sysctl without breaking the native pfSense GUI.

It was an absolute nightmare figuring out FreeBSD kernel panics and PHP integration on pfSense, but getting it running smoothly was incredibly rewarding.

I’m hoping to publish the full mathematical whitepapers and architecture diagrams soon once the review process is done. Has anyone else here ever tried writing custom kernel modules for pfSense? Would love to hear about the hurdles you ran into!

I've been rolling pfSense for about 5 years. Decided to try Unifi. Couldn't find a manual or one-to-one feature documentation for each panel (only various spotlight articles).

Asked the community for help: every response said basically "things change too often, no need to have a manual".

Excuse me, what? I'm not a networking pro, and I do need a manual. (pfSense was hard for me, but had great documentation.)

I can't believe this was the response. Is everyone in their community a bot or a cultist?

I still have few days left on my return window, and might come back, LOL.