Intel igb/em Interfaces Broken on 2.6/22.01+

[ChronicledMonocle]

The dhcp lease for connections is not handed through to the ngeth0 interface properly. There isn't any real "errors" in the logs.

If you try to run the script manually after boot you get "ngctl: send msg: File exists"

Logs from pfatt.log:

2022-02-14 14:36:56 :: [pfatt.sh] :: pfSense + AT&T U-verse Residential Gateway for true bridge mode
2022-02-14 14:36:56 :: [pfatt.sh] :: Configuration:
2022-02-14 14:36:56 :: [pfatt.sh] :: ONT_IF: igb0
2022-02-14 14:36:56 :: [pfatt.sh] :: RG_IF: igb1
2022-02-14 14:36:56 :: [pfatt.sh] :: RG_ETHER_ADDR: [MY MAC HERE]
2022-02-14 14:36:56 :: [pfatt.sh] :: attaching interfaces to ng_ether... OK!
2022-02-14 14:36:56 :: [pfatt.sh] :: building netgraph nodes...
2022-02-14 14:36:56 :: [pfatt.sh] :: creating ng_one2many... 2022-02-14 14:37:00 :: [pfatt.sh] :: pfSense + AT&T U-verse Residential Gateway for true bridge mode

I am not running wpa_supplicant mode.

[Grassyloki]

Can confirm its not working after an upgrade. Following the troubleshooting instructions shows that the modules have loaded. PFatt logs dont show anything.

[bigjohns97]

Can confirm it is broken for me as well, running supplicant

[neydah700]

Same issue. Not grabbing DHCP.

Edit: I am using the WPA supplicant method.

[ChronicledMonocle]

Want to confirm that reverting to 2.5.2 or 21.05.2 immediately restores internet for me after setting everything back up.

[neydah700]

Want to confirm that reverting to 2.5.2 or 21.05.2 immediately restores internet for me after setting everything back up.

Yes, It was an absolute pain in the a**, but restoring to 21.05.2 immediately fixed it for me. IPv6 wouldn't grab for an hour or so but finally started working.

[neydah700]

Also, I posted on the Netgate Forums. If anyone else wants to add anything over there here is the link. https://forum.netgate.com/topic/169882/22-01-2-6-0-upgrade-broke-dhcp-on-wan-interface-with-custom-startup-script

[titanfuryog]

I am having the same problem and now my WireGuard and other tools don't work and can't get them to work.

[grevelle]

Yep - supplicant not working for me either. The last time a new version of pfsense broke pfatt Matt Johnson submitted this issue to pfsense redmine. Should we do that here? Here is the issue that originated the whole thing.

[bigg1969]

It also broke mine after update. Per the docs, I ran "tcpdump -ei ONT_IF" and "tcpdump -ei RG_IF", which should filter and capture link layer information (2), on my interfaces and captured 0 packets from RG_IP and only the bridged DHCP traffic on the ONT_IF interface.

I reset netgraph, which removes the hooks, rebooted the gateway and modem with tcpdump running and captured 0 packets from the interfaces. Before removing the netgraph hooks, the only traffic I seen on any of the three interfaces, was the DHCP request on the ngeth0 virtual interaface, and the bridged ONT_IF interface. So the DHCP requests are still getting to the correct interface.

The fact that tcpdump doesn't see any traffic makes me think its being filtered, like promisc mode isn't allowing EAPOL 802.1X traffic to be capture, and there fore is not bridged. No authentication mean no DHCP response. IMO

I've moved to inline behind the gateway until this can be figured out. I would be willing to test once a day.

[neydah700]

Okay, had some success today based on info I gathered from all the various discussions online. I think it is something to do with the em(4) driver. Do all of you having issues have Intel NIC's? I put together a test pfSense server from a bunch of spare parts and it worked right away on the latest release. After digging, I couldn't get any Intel NIC to work. Using what I had around (a few crappy USB dongles worked and old PC's with integrated NICs) I had success with everything not Intel GbE. When I re-upgraded my main pfSense box I was able to move my WAN link to an SFP slot (with RJ45 Module) with some success. I say "some" because all my SFP/RJ45 modules are 10GB and they do not negotiate well with the ONT.

Something interesting for me, if_em.ko is present in /boot/kernel on 2.6.0 but wasn't in my previous version of pfSense. My knowledge is limited but I am not sure where the driver was located in the previous version? Anyone smarter than me know?

Some Useful Links:
FreeBSD 12.3 Release Notes (em(4) driver notes) - https://www.freebsd.org/releases/12.3R/relnotes/
Reddit Discussion - https://www.reddit.com/r/PFSENSE/comments/ssgsha/psa_260_breaks_att_bypass/?sort=new
Netgate Forum Discussion - https://forum.netgate.com/topic/99190/att-uverse-rg-bypass-0-2-btc/396?_=1644931323812
OPNSense GIT Issue - #65

[titanfuryog]

I think this is going somewhere because I've tried multiple different boxes but they're all Intel Nics, when I get off work I will try a couple USB dongle's to see if it gets traffic that way.

[neydah700]

I think this is going somewhere because I've tried multiple different boxes but they're all Intel Nics, when I get off work I will try a couple USB dongle's to see if it gets traffic that way.

The USBs work for me but are slow. Download is like 100m, upload is better at around 400m. I have a 1G SFP that should get here tomorrow. Really hoping that talks better with the ONT then the 10G did.

[titanfuryog]

For USBs to work at 1 gig speeds you have to have 3.1 USB port or better. For FreeBSD, I am using a box equivalent to the netgate 1541 Same everything but a lot more powerful. Let me know how it goes with the other Nics.

[neydah700]

For USBs to work at 1 gig speeds you have to have 3.1 USB port or better. I am using a box equivalent to the netgate 1541 Same everything but a lot more powerful. Let me know how it goes with the other Nics.

Will do! If it helps I'm using the XG-1537 so USB3.0

[titanfuryog]

Is the usb dongles 3.0, when I was using usb in past it worked great I was able to get full 1gb speeds out of my usb ports. If the usb is 3.0 then I don't know why I am getting full 1gb speeds. But I did downgrade back to 2.5.2 now WireGuard don't work on 2.5.2.