# Error in diagnostic since v6 with pfsense as upstream

**URL:** <https://discourse.pi-hole.net/t/error-in-diagnostic-since-v6-with-pfsense-as-upstream/77192>\
**Category:** Community Help\
**Created:** [February 28, 2025, 3:15pm UTC](https://discourse.pi-hole.net/t/error-in-diagnostic-since-v6-with-pfsense-as-upstream/77192 "2025-02-28T15:15:47Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![Bucking\_Horn](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/bucking_horn/32/18719_2.png) [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)\
**Post date:** [February 28, 2025, 8:59pm UTC](https://discourse.pi-hole.net/t/error-in-diagnostic-since-v6-with-pfsense-as-upstream/77192/6 "2025-02-28T20:59:47Z")

</div>

So you've configured Pi-hole to use your router as its upstream:

```auto
   [dns]
     upstreams = [
       "192.168.0.1#853"
     ] ### CHANGED, default = []

```

As I understand it, unbound is listening on port 853 on your router.

> [@nodiaque](#):
>
> pfsense use ubound and work both on 53 and 853 for dns over tls.

Pi-hole only talks plain DNS/Do53, i.e. it does not encrypt its DNS requests. Configuring it to use an upstream port 853 does not change this.

As port 853 is indeed reserved for DoT usage, you should consider to change your upstream to 192.168.0.1#53.

As for your observation:

> [@nodiaque](#):
>
> didn't had that message on v5.

You wouldn't, as Pi-hole v5 didn't log that message, so that doesn't mean that the reported TCP connection failure hasn't happened already with v5.

As for the potential causes, we've intensively analysed and identified that as being caused by specific behaviour of unbound, see [Two Pi-hole instances, One with "failed to send..." - #44 by DL6ER](https://discourse.pi-hole.net/t/two-pi-hole-instances-one-with-failed-to-send/75057/44).

There is currently nothing that Pi-hole could do to improve this.

The condition has been reported to unbound, where some potential measures are currently explored. Increasing unbound's `incoming-num-tcp` (e.g. to 20) is reported to mitigate the issue.

You may consider to contribute your observation over at [failed to send TCP(read\_write) packet (Connection prematurely closed by remote server) · Issue #1237 · NLnetLabs/unbound · GitHub](https://github.com/NLnetLabs/unbound/issues/1237).

---

_[View the full topic](https://discourse.pi-hole.net/t/error-in-diagnostic-since-v6-with-pfsense-as-upstream/77192)._