# Error in diagnostic since v6 with pfsense as upstream

**URL:** <https://discourse.pi-hole.net/t/error-in-diagnostic-since-v6-with-pfsense-as-upstream/77192>\
**Category:** Community Help\
**Created:** [February 28, 2025, 3:15pm UTC](https://discourse.pi-hole.net/t/error-in-diagnostic-since-v6-with-pfsense-as-upstream/77192 "2025-02-28T15:15:47Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![nodiaque](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/n/a87d85/32.png) [@nodiaque](https://discourse.pi-hole.net/u/nodiaque)\
**Post date:** [February 28, 2025, 3:15pm UTC](https://discourse.pi-hole.net/t/error-in-diagnostic-since-v6-with-pfsense-as-upstream/77192/1 "2025-02-28T15:15:47Z")

</div>

Hello,

I have a pfsense router that is used as my upstream dns on my piholes. I still work but the log are now spammed with that message (and also seen in diagnostic).

> Connection error ( **x.x.x.x#853** ): TCP connection failed while receiving payload length from upstream ( **Connection prematurely closed by remote server** )

I'm unsure how to fix that.

Thank you!

---

<div class="post-metadata">

**Author:** ![Bucking\_Horn](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/bucking_horn/32/18719_2.png) [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)\
**Post date:** [February 28, 2025, 7:24pm UTC](https://discourse.pi-hole.net/t/error-in-diagnostic-since-v6-with-pfsense-as-upstream/77192/2 "2025-02-28T19:24:14Z")

</div>

As Pi-hole only uses Do53, usage of port **853** would indicate that message isn't from pihole.log?

What's the DNS server on your pfsense that is receiving inbound DNS from Pi-ole?

---

<div class="post-metadata">

**Author:** ![nodiaque](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/n/a87d85/32.png) [@nodiaque](https://discourse.pi-hole.net/u/nodiaque)\
**Post date:** [February 28, 2025, 8:16pm UTC](https://discourse.pi-hole.net/t/error-in-diagnostic-since-v6-with-pfsense-as-upstream/77192/3 "2025-02-28T20:16:36Z")

</div>

my upstream DNS is connected to port 853 in upstream DNS setting (x.x.x.x:853).

pfsense use ubound and work both on 53 and 853 for dns over tls. didn't had that message on v5. I don't see any message on pfsense side

edit: I did just found out that unbound seems to restart quite frequently, which wasn't the case before. That might be the issue

---

<div class="post-metadata">

**Author:** ![Bucking\_Horn](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/bucking_horn/32/18719_2.png) [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)\
**Post date:** [February 28, 2025, 8:25pm UTC](https://discourse.pi-hole.net/t/error-in-diagnostic-since-v6-with-pfsense-as-upstream/77192/4 "2025-02-28T20:25:21Z")

</div>

Please upload a debug log and post **just the token URL** that is generated after the log is uploaded by running the following command from the Pi-hole host terminal:

```auto
pihole -d

```

or if you run your Pi-hole as a Docker container:

```auto
docker exec -it <pihole-container-name-or-id> pihole -d

```

where you substitute `<pihole-container-name-or-id>` as required.

---

<div class="post-metadata">

**Author:** ![nodiaque](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/n/a87d85/32.png) [@nodiaque](https://discourse.pi-hole.net/u/nodiaque)\
**Post date:** [February 28, 2025, 8:37pm UTC](https://discourse.pi-hole.net/t/error-in-diagnostic-since-v6-with-pfsense-as-upstream/77192/5 "2025-02-28T20:37:24Z")

</div>

[https://tricorder.pi-hole.net/4L3VTscz/](https://tricorder.pi-hole.net/4L3VTscz/)

---

<div class="post-metadata">

**Author:** ![Bucking\_Horn](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/bucking_horn/32/18719_2.png) [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)\
**Post date:** [February 28, 2025, 8:59pm UTC](https://discourse.pi-hole.net/t/error-in-diagnostic-since-v6-with-pfsense-as-upstream/77192/6 "2025-02-28T20:59:47Z")

</div>

So you've configured Pi-hole to use your router as its upstream:

```auto
   [dns]
     upstreams = [
       "192.168.0.1#853"
     ] ### CHANGED, default = []

```

As I understand it, unbound is listening on port 853 on your router.

> [@nodiaque](#):
>
> pfsense use ubound and work both on 53 and 853 for dns over tls.

Pi-hole only talks plain DNS/Do53, i.e. it does not encrypt its DNS requests. Configuring it to use an upstream port 853 does not change this.

As port 853 is indeed reserved for DoT usage, you should consider to change your upstream to 192.168.0.1#53.

As for your observation:

> [@nodiaque](#):
>
> didn't had that message on v5.

You wouldn't, as Pi-hole v5 didn't log that message, so that doesn't mean that the reported TCP connection failure hasn't happened already with v5.

As for the potential causes, we've intensively analysed and identified that as being caused by specific behaviour of unbound, see [Two Pi-hole instances, One with "failed to send..." - #44 by DL6ER](https://discourse.pi-hole.net/t/two-pi-hole-instances-one-with-failed-to-send/75057/44).

There is currently nothing that Pi-hole could do to improve this.

The condition has been reported to unbound, where some potential measures are currently explored. Increasing unbound's `incoming-num-tcp` (e.g. to 20) is reported to mitigate the issue.

You may consider to contribute your observation over at [failed to send TCP(read\_write) packet (Connection prematurely closed by remote server) · Issue #1237 · NLnetLabs/unbound · GitHub](https://github.com/NLnetLabs/unbound/issues/1237).

---

<div class="post-metadata">

**Author:** ![system](https://discourse.pi-hole.net/uploads/default/original/3X/7/c/7c8792f649eeb921c5d2b4c41564ffa873d9a2b8.png) [@system](https://discourse.pi-hole.net/u/system)\
**Post date:** [March 21, 2025, 9:00pm UTC](https://discourse.pi-hole.net/t/error-in-diagnostic-since-v6-with-pfsense-as-upstream/77192/7 "2025-03-21T21:00:21Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.