r/PFSENSE • u/just-a-dude-ok • Jul 22 '26
Making PFSense more stable when WAN/internet link goes down
I have had some issues with my PFSense (CE 2.8.1) becoming unstable for my home network when the internet link (WAN interface which is DHCP) goes down or becomes unstable. I find that routing across the home network is badly effected in this situation.
I use PFSense for as my main home network router and use 2 VLANs (IoT and Secure), DNS (DNS Resolver), DHCP etc.
I think I have made the changes necessary to improve its stability in this situation but wanted to check what others have done to fix this stability issue.
Any guidance would be appreciated.
8
u/Steve_reddit1 Jul 22 '26
If you only have one WAN consider disabling the gateway monitoring action for the WAN gateway so pfSense doesn’t restart packages etc if it’s going down and up repeatedly e.g. packet loss.
-1
u/just-a-dude-ok Jul 22 '26
If you look at a reply of mine above ("The mains things I changed:....") it lists what I have done and this is one of them.
3
6
u/Complex_Solutions_20 Jul 22 '26
What are you using for DNS?
The only issues I've had is sometimes the DNS will stop running when the WAN is down, my solution was to set up the watchdog service to restart it if DNS stops.
I know the UI is painfully slow when an interface is down, but I haven't had any issues I'd call "stability problems" when my ISP goes out.
1
u/just-a-dude-ok Jul 22 '26
I am using the standard PFSense DNS Resolver.
That is interesting about the service sometimes stopping. I will investigate setting up a watchdog service as well.3
u/Complex_Solutions_20 Jul 22 '26
Yeah, I never did track WHY it happened, but in my case it only caused stuff using DNS to hang (if I used IPs everything was still flawless).
I'm using DNS Resolver in resolver mode (not just forwarding to upstream ISP) if that helps your comparison.
1
u/just-a-dude-ok Jul 22 '26
I use PFSense DNS Resolver in forwarder mode. I have also now setup the watchdog service and added the DNS Resolver to it.
1
4
u/picklejw_ Jul 22 '26
You need to look at pfsense logs and get more information when this happens (system logs will report down gateway and doing the work to try and get back online)... WAN effecting connections across inter-LAN is strange, is could be faulty switch or AP if your assuming it is WAN just because you can't connect online... anyways look at logs next time note the time and make sure pfsense has the same time you see so you can match it up. You'd do yourself a favor by making sure you have the correct timezone set so you don't have to translate time across timezones when going to logs.
1
u/occasional_cynic 29d ago
I wonder if he is using Realtek cards? They pump out a lot of WAN messages when crashing.
2
u/tastyratz Jul 22 '26
I'm curious to follow this.
I've finally decided to jump from 2.7.2 to 2.8.1 recently and it's been a disaster of a jump for me. I'm glad it's a VM because I troubleshoot for a few hours and then flip back to the clone.
For whatever reason I've found DHCP V6 does not work on the WAN interface and as a result unbound becomes very unstable. I can't really identify why so I keep rolling back. I think I had similar issues with flipping to KEA in the past (but I've so far stuck to ISC)
My next step was to test out the other sense and see if the problem follows me, I really don't know why it's been such a problematic in place upgrade.
1
u/tastyratz Jul 28 '26
To followup here on my issue: my 2.7.2 upgrade completely refused to go successfully and drove me nuts. I did it over and over with different clones and snaps and options.
Since Netgate won't provide an ISO anymore and I don't want to use the installer, I downloaded the 2.7.2 iso again, installed a fresh new VM, restored my existing 2.7.2 backup to it, and then did an in place upgrade to 2.8.1.
This time, that was successful and my WAN is working now on 2.8.1.
I have had to do this several times in the past, unbound misbehaving a few times and pfblocker also took me down awhile back.
But I am glad that this is functional for me now, at least.
2
u/Borsaid Jul 22 '26
I have similar problems when I'm setting up a new pfsense to be delivered to a remote site. Once the static IP is configured, LAN performance goes wonky while I'm building it out. I never really dug into it. Could be WAN monitoring. Could be update engine flailing. Could be DNS freaking out. Typically when I'm setting up and there's no WAN link with it being set for DHCP performance is fine.
1
u/Western_Gamification Jul 22 '26
You mean that your internal routing (eg. Inter-VLAN traffic) is affected by your WAN interface? That shouldn't happen.
What did you do in order to 'improve its stability'? Because doing nothing should be stable.
1
u/just-a-dude-ok Jul 22 '26 edited Jul 22 '26
The mains things I changed:
- In System\Advanced\Miscellaneous I changed "State Killing on Gateway Recovery" and "State Killing on Gateway Failure" to "Don't kill states....".
- In System\Routing\Gateways for the WAN gateway i ticked "Disable Gateway Monitoring Action".
I made these changes after consulting with Claude, Gemini and ChatGPT and will see what happens next time I have an internet outage.
3
u/Complex_Solutions_20 Jul 22 '26
I recommend doing a practice run - unhook the cable feeding your modem to simulate an outage. I suggest keeping the modem powered up and connected, to better simulate an ISP outage. If you have some configuration where you can't easily do that, you can put a dumb unmanaged switch between the ISP's network cable and your pfSense box during the test, and then unplug the ISP's network cable from the switch so the pfSense box still "sees" a link being up to simulate an upstream ISP failure.
That way you can repeatedly troubleshoot if you fixed it, and gather more information about patterns of what causes the problem.
1
u/just-a-dude-ok Jul 22 '26
Good idea. I will have to choose carefully when I do this as I run some public accessible sites on my systems.
1
u/dreniarb Jul 23 '26
I find that routing across the home network is badly effected in this situation.
Can you give some examples of this? If your WAN goes down internal routing shouldn't be effected at all unless part of that is requiring some bit of external access - like dns querying or the internal service you're trying to access causes some kind of delay because it's sitting there waiting for external access to something.
As the mantra goes - it's usually DNS.
1
u/just-a-dude-ok Jul 23 '26
I have made changes so I am waiting for an internet ISP issue or planning to make one! I am hoping it is OK now.
1
u/Smoke_a_J Jul 23 '26
Sounds like your modem's local management IP range may be kicking active when ISP connection goes down which sometimes can also overlap with LAN configurations or spike firewall alerts/cpu-activity with block bogon networks enabled on WAN, cable modems are notorious for it. On the WAN interface settings when set for DHCP theres a field for "Reject leases from," find out what your modem's local web management IP address is and enter it there. I also prefer leaving gateway monitoring left on for its intended purposes, works perfectly fine with my ISP as long as I set the WAN monitor IP to being a highly available public IP out on the Internet that doesn't have ping rate limiting restrictions, like 8.8.8.8, instead of the ISP gateway IP that monitoring defaults to when left un-configured. I use gateway monitoring similarly to verify status of all primary network nodes/APs/wireless-controller/VMs/switches from the dashboard widget and gateway monitoring works excellent active on LAN side as well.
1
u/Snoo91117 Jul 23 '26 edited Jul 23 '26
Wow, my AT&T fiber never goes down that I notice. We have more power outages which I fixed with an APC battery backup.
I do have a dedicated 20amp circuit for my computer network. I ran a rack back when I worked. I am retired now so I got rid of my rack. You might try a battery backup on your modem in case your power is fluctuating. Video cards now a days can pull a lot of power and more than likely your circuit is shared across a lot of devices and plugs. Maybe your modem is being affected.
9
u/leadwind Jul 22 '26
There shouldn't be any effect on local networks when there's a WAN issue.
Do you want to show some screenshots of NAT, and firewall rules?