Get public ip for pcs

[s_serra]

@johnpoz

I sent it in pm which returned the packet capture

[johnpoz]

@s_serra Ok - well so getting to pfsense.

Now do the same thing on the lan side interface.. If we don't see it there, then something wrong with the bridge..

My ping is still running. If you do see it there - then something on the client blocking it.

[s_serra]

@johnpoz

15:56:55.997368 IP x.x.x.x > 176.79.22.208: ICMP echo request, id 54626, seq 182, length 40
15:57:00.994130 IP x.x.x.x > 176.79.22.208: ICMP echo request, id 54626, seq 183, length 40

on the lan side it also worked, I tested it on the bridge interface and it also receives a response

[stephenw10]

So you see replies from the server on LAN and Bridge but not WAN?

Did you check the MAC addresses in the pcap yet? You need to confirm those are correct.

[johnpoz]

@s_serra You say you see a response? Or you see my ping going to your 22.208 address?

[s_serra]

@johnpoz

I saw ping icmp on all interfaces

[johnpoz]

@s_serra the reply, not just the request?

[s_serra]

@johnpoz

I just get it

[s_serra]

@stephenw10

how I use pcap is it in pfsense or is it another tool?

[johnpoz]

@s_serra so that is pfsense sending on my request to your 22.208 box - which is not answering..
Which would assume means its running a firewall

If you validate that the mac address pfsense sent to was the correct mac address of your 22.208 box. You can view that by downloading the packet capture and viewing with say wireshark. Or up the verbosity of the packet capture where it shows mac address.

But what I would bet a very large sum of money on is your 22.208 box is running its own firewall and just not answering the traffic.

[stephenw10]

@s_serra said in Get public ip for pcs:

I just get it

So to confirm you are only seeing requests and no replies when you pcap on BOTH WAN and LAN?

[s_serra]

@johnpoz

here it works on my pc so i think it's not from the machine's firewall

[johnpoz]

@s_serra your machine where? There is a HUGE difference in talking to some box on the same network as you - and some strange public IP..

[johnpoz]

@s_serra dude - I have to assume 22.207 is on your network as well since you said your mask is /24 - or is this assigned to someone else??

Because 22.207 answers

$ ping 176.79.22.207

Pinging 176.79.22.207 with 32 bytes of data:
Reply from 176.79.22.207: bytes=32 time=120ms TTL=45
Reply from 176.79.22.207: bytes=32 time=119ms TTL=45

Which is another SCREAMING indication of firewall on the 22.208 box

22.206 also answers, and 22.210-212 all answer..

[s_serra]

@johnpoz
These IPS are other people's. MY ISP provides IPS via DHCP as available. The machine on which it works is also connected to a bridge with another public IP of a different range.

[johnpoz]

@s_serra well here is what we know.. Pfsense is seeing the traffic on its wan, and it sends it on to the 22.208 box via your sniff on the lan.

But there is no answer from the 22.208 box. This means its not pfsense - and something on the machine.. Maybe its not getting the ping requests? Sniff on the machine.. My ping is still running.

But if your saying outbound works, and we see the pings go out pfsense lan side interface to the 22.208 box.. It screams something on the machine is blocking it.

It sure is not pfsense causing the issue.. If it was you either wouldn't see the traffic sent on the lan side interface to 22.208, or you would see the reply and just not going out the wan interface.

[stephenw10]

@stephenw10 said in Get public ip for pcs:

@s_serra said in Get public ip for pcs:

I just get it

So to confirm you are only seeing requests and no replies when you pcap on BOTH WAN and LAN?

Can you confirm that ^ before we go any further here?

[johnpoz]

@stephenw10 from what he posted here

https://forum.netgate.com/post/1001734

This was on the lan side when he was sniffing - and it only sees the request not the reply.. So unless there was a drastic misunderstanding and what he posted was just on the wan.. Then the lan side is sending request, but not seeing reply.

[stephenw10]

Are you sure that was the LAN side? Seems completely unclear to me.

[johnpoz]

@stephenw10 Well you would hope so - since that is what I asked for ;)

But sure lets wait til he validates..