Get public ip for pcs

s_serra

how I use pcap is it in pfsense or is it another tool?

johnpoz

@s_serra so that is pfsense sending on my request to your 22.208 box - which is not answering..
Which would assume means its running a firewall

If you validate that the mac address pfsense sent to was the correct mac address of your 22.208 box. You can view that by downloading the packet capture and viewing with say wireshark. Or up the verbosity of the packet capture where it shows mac address.

But what I would bet a very large sum of money on is your 22.208 box is running its own firewall and just not answering the traffic.

stephenw10

@s_serra said in Get public ip for pcs:

I just get it

So to confirm you are only seeing requests and no replies when you pcap on BOTH WAN and LAN?

s_serra

@johnpoz

here it works on my pc so i think it's not from the machine's firewall

johnpoz

@s_serra your machine where? There is a HUGE difference in talking to some box on the same network as you - and some strange public IP..

johnpoz

@s_serra dude - I have to assume 22.207 is on your network as well since you said your mask is /24 - or is this assigned to someone else??

Because 22.207 answers

$ ping 176.79.22.207

Pinging 176.79.22.207 with 32 bytes of data:
Reply from 176.79.22.207: bytes=32 time=120ms TTL=45
Reply from 176.79.22.207: bytes=32 time=119ms TTL=45

Which is another SCREAMING indication of firewall on the 22.208 box

22.206 also answers, and 22.210-212 all answer..

s_serra

@johnpoz
These IPS are other people's. MY ISP provides IPS via DHCP as available. The machine on which it works is also connected to a bridge with another public IP of a different range.

johnpoz

@s_serra well here is what we know.. Pfsense is seeing the traffic on its wan, and it sends it on to the 22.208 box via your sniff on the lan.

But there is no answer from the 22.208 box. This means its not pfsense - and something on the machine.. Maybe its not getting the ping requests? Sniff on the machine.. My ping is still running.

But if your saying outbound works, and we see the pings go out pfsense lan side interface to the 22.208 box.. It screams something on the machine is blocking it.

It sure is not pfsense causing the issue.. If it was you either wouldn't see the traffic sent on the lan side interface to 22.208, or you would see the reply and just not going out the wan interface.

stephenw10

@stephenw10 said in Get public ip for pcs:

@s_serra said in Get public ip for pcs:

I just get it

So to confirm you are only seeing requests and no replies when you pcap on BOTH WAN and LAN?

Can you confirm that ^ before we go any further here?

johnpoz

@stephenw10 from what he posted here

https://forum.netgate.com/post/1001734

This was on the lan side when he was sniffing - and it only sees the request not the reply.. So unless there was a drastic misunderstanding and what he posted was just on the wan.. Then the lan side is sending request, but not seeing reply.

stephenw10

Are you sure that was the LAN side? Seems completely unclear to me.

johnpoz

@stephenw10 Well you would hope so - since that is what I asked for ;)

But sure lets wait til he validates..

s_serra

@johnpoz

sorry for the delay in answering i had to leave.

I tried connecting the wan cable directly to my pc. without going through pfsense

I used my cell phone to try to access it through an open public network and without going through pfsense it works.

s_serra

I've already passed it back to pfsense. it was just to test

s_serra

This post is deleted!

s_serra

johnpoz

@s_serra all of those packet captures show reply with it going back out the wan

s_serra

@johnpoz

icmp seems to be fine. but the problem is the ports don't work when i go through pfsense.

if I don't go through pfsense everything is fine but I would like to have a firewall and a few more things like suricata.

johnpoz

@s_serra no its not fine - I am not actually getting an answer to my ping - even though you show the reply going out the wan - I am not getting the reply.

s_serra

@johnpoz
where is this blocking?

do you want access to my pfsense to check? (I sent the info in pm)
I maybe did something wrong in pfsense