Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Send Traffic from 1 host to a specific GW

    Scheduled Pinned Locked Moved Routing and Multi WAN
    25 Posts 3 Posters 1.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      smalldragoon @smalldragoon
      last edited by

      @smalldragoon [Edit]
      Reading again my post, I missed one answer :
      If I configure DNS as being pfsense, I get resolution working ( of course )

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator @smalldragoon
        last edited by

        @smalldragoon those outbound rules look ODD for hybrid..

        Where are the auto rules?

        example here is mine where I can policy route traffic out different gateway (vpn)

        outbound.jpg

        sniffing could be done, but quite complicated

        How is that? Diagnostic menu, packet capture - pick the interface, hit start..

        the connection between pfsense and the 3GModem is wifi only

        Well that could be a problem.. Is there no way to wire this.. How do you not the issue is not the wifi connection..

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        S 1 Reply Last reply Reply Quote 0
        • S
          smalldragoon @johnpoz
          last edited by

          @johnpoz
          Full screen then, with auto at the bottom

          7812a873-aa05-4f89-958b-10ff4f153961-image.png

          regarding packet capture, I was old school, was thinking to put a host on switch, copy traffic with tcpdump. Was not aware of the feature :( .. my bad sorry :

          here is the logs, we can see only the regular "live check" on 8.8.4.4

          14:54:30.989052 IP 192.168.1.21 > 8.8.4.4: ICMP echo request, id 30718, seq 51214, length 9
14:54:31.032082 IP 8.8.4.4 > 192.168.1.21: ICMP echo reply, id 30718, seq 51214, length 9
14:54:31.114563 IP 192.168.1.21.40178 > 5.62.53.53.443: tcp 72
14:54:31.491202 IP 192.168.1.21 > 8.8.4.4: ICMP echo request, id 30718, seq 51215, length 9
14:54:31.526845 IP 8.8.4.4 > 192.168.1.21: ICMP echo reply, id 30718, seq 51215, length 9
14:54:31.716827 IP 192.168.1.21.40178 > 5.62.53.53.443: tcp 72
14:54:31.870853 IP 192.168.1.21.55915 > 99.84.5.21.443: tcp 517
14:54:32.013028 IP 192.168.1.21 > 8.8.4.4: ICMP echo request, id 30718, seq 51216, length 9
14:54:32.042089 IP 8.8.4.4 > 192.168.1.21: ICMP echo reply, id 30718, seq 51216, length 9
14:54:32.090728 IP 192.168.1.21.38116 > 5.62.40.127.443: tcp 0
14:54:32.122245 IP 5.62.40.127.443 > 192.168.1.21.38116: tcp 0
14:54:32.122787 IP 192.168.1.21.38116 > 5.62.40.127.443: tcp 0
14:54:32.123818 IP 192.168.1.21.38116 > 5.62.40.127.443: tcp 194
14:54:32.372577 IP 192.168.1.21.38116 > 5.62.40.127.443: tcp 194
14:54:32.525046 IP 192.168.1.21 > 8.8.4.4: ICMP echo request, id 30718, seq 51217, length 9
14:54:32.551868 IP 8.8.4.4 > 192.168.1.21: ICMP echo reply, id 30718, seq 51217, length 9
14:54:32.673729 IP 192.168.1.21.38116 > 5.62.40.127.443: tcp 194
14:54:32.921461 IP 192.168.1.21.40178 > 5.62.53.53.443: tcp 72
14:54:33.037036 IP 192.168.1.21 > 8.8.4.4: ICMP echo request, id 30718, seq 51218, length 9
14:54:33.080653 IP 8.8.4.4 > 192.168.1.21: ICMP echo reply, id 30718, seq 51218, length 9
14:54:33.276159 IP 192.168.1.21.38116 > 5.62.40.127.443: tcp 194
14:54:33.549048 IP 192.168.1.21 > 8.8.4.4: ICMP echo request, id 30718, seq 51219, length 9
14:54:33.590496 IP 8.8.4.4 > 192.168.1.21: ICMP echo reply, id 30718, seq 51219, length 9
14:54:33.759219 IP 192.168.1.21.14704 > 34.107.221.82.80: tcp 0
14:54:33.792240 IP 34.107.221.82.80 > 192.168.1.21.14704: tcp 0
14:54:33.792787 IP 192.168.1.21.14704 > 34.107.221.82.80: tcp 0
14:54:33.794986 IP 192.168.1.21.14704 > 34.107.221.82.80: tcp 322
14:54:33.842543 IP 34.107.221.82.80 > 192.168.1.21.14704: tcp 243
14:54:33.843571 IP 192.168.1.21.14704 > 34.107.221.82.80: tcp 0
14:54:33.846300 IP 192.168.1.21.14704 > 34.107.221.82.80: tcp 0
14:54:33.847262 IP 192.168.1.21.14704 > 34.107.221.82.80: tcp 0
14:54:34.061075 IP 192.168.1.21 > 8.8.4.4: ICMP echo request, id 30718, seq 51220, length 9
14:54:34.100409 IP 8.8.4.4 > 192.168.1.21: ICMP echo reply, id 30718, seq 51220, length 9
14:54:34.480645 IP 192.168.1.21.38116 > 5.62.40.127.443: tcp 194
14:54:34.573057 IP 192.168.1.21 > 8.8.4.4: ICMP echo request, id 30718, seq 51221, length 9
14:54:34.602147 IP 8.8.4.4 > 192.168.1.21: ICMP echo reply, id 30718, seq 51221, length 9
14:54:34.750538 IP 192.168.1.21.11093 > 5.62.53.53.443: tcp 44
14:54:35.085061 IP 192.168.1.21 > 8.8.4.4: ICMP echo request, id 30718, seq 51222, length 9
14:54:35.111597 IP 8.8.4.4 > 192.168.1.21: ICMP echo reply, id 30718, seq 51222, length 9
14:54:35.330553 IP 192.168.1.21.40178 > 5.62.53.53.443: tcp 72
14:54:35.597055 IP 192.168.1.21 > 8.8.4.4: ICMP echo request, id 30718, seq 51223, length 9
14:54:35.633887 IP 8.8.4.4 > 192.168.1.21: ICMP echo reply, id 30718, seq 51223, length 9
14:54:36.109094 IP 192.168.1.21 > 8.8.4.4: ICMP echo request, id 30718, seq 51224, length 9
14:54:36.142105 IP 8.8.4.4 > 192.168.1.21: ICMP echo reply, id 30718, seq 51224, length 9
14:54:36.616010 IP 192.168.1.21 > 8.8.4.4: ICMP echo request, id 30718, seq 51225, length 9
14:54:36.652550 IP 8.8.4.4 > 192.168.1.21: ICMP echo reply, id 30718, seq 51225, length 9
14:54:36.673398 IP 192.168.1.21.55915 > 99.84.5.21.443: tcp 517
14:54:36.870766 IP 192.168.1.21.24556 > 34.107.221.82.80: tcp 0
14:54:36.889724 IP 192.168.1.21.38116 > 5.62.40.127.443: tcp 194
14:54:36.902138 IP 34.107.221.82.80 > 192.168.1.21.24556: tcp 0
14:54:36.902670 IP 192.168.1.21.24556 > 34.107.221.82.80: tcp 0
14:54:36.904829 IP 192.168.1.21.24556 > 34.107.221.82.80: tcp 322
14:54:36.935144 IP 34.107.221.82.80 > 192.168.1.21.24556: tcp 243
14:54:36.936140 IP 192.168.1.21.24556 > 34.107.221.82.80: tcp 0
14:54:36.938972 IP 192.168.1.21.24556 > 34.107.221.82.80: tcp 0
14:54:36.939811 IP 192.168.1.21.24556 > 34.107.221.82.80: tcp 0
14:54:37.074848 IP 192.168.1.21.55915 > 99.84.5.21.443: tcp 1
14:54:37.133052 IP 192.168.1.21 > 8.8.4.4: ICMP echo request, id 30718, seq 51226, length 9
14:54:37.162212 IP 8.8.4.4 > 192.168.1.21: ICMP echo reply, id 30718, seq 51226, length 9
14:54:37.645096 IP 192.168.1.21 > 8.8.4.4: ICMP echo request, id 30718, seq 51227, length 9
14:54:37.672103 IP 8.8.4.4 > 192.168.1.21: ICMP echo reply, id 30718, seq 51227, length 9
14:54:38.078553 IP 192.168.1.21.55915 > 99.84.5.21.443: tcp 1
14:54:38.157528 IP 192.168.1.21 > 8.8.4.4: ICMP echo request, id 30718, seq 51228, length 9
14:54:38.192096 IP 8.8.4.4 > 192.168.1.21: ICMP echo reply, id 30718, seq 51228, length 9
14:54:38.669091 IP 192.168.1.21 > 8.8.4.4: ICMP echo request, id 30718, seq 51229, length 9
14:54:38.701893 IP 8.8.4.4 > 192.168.1.21: ICMP echo reply, id 30718, seq 51229, length 9
14:54:39.082263 IP 192.168.1.21.55915 > 99.84.5.21.443: tcp 1
14:54:39.199200 IP 192.168.1.21 > 8.8.4.4: ICMP echo request, id 30718, seq 51230, length 9
14:54:39.242104 IP 8.8.4.4 > 192.168.1.21: ICMP echo reply, id 30718, seq 51230, length 9
14:54:39.705194 IP 192.168.1.21 > 8.8.4.4: ICMP echo request, id 30718, seq 51231, length 9
14:54:39.742093 IP 8.8.4.4 > 192.168.1.21: ICMP echo reply, id 30718, seq 51231, length 9
14:54:39.946235 IP 192.168.1.21.28540 > 34.107.221.82.80: tcp 0
14:54:39.972169 IP 34.107.221.82.80 > 192.168.1.21.28540: tcp 0
14:54:39.972626 IP 192.168.1.21.28540 > 34.107.221.82.80: tcp 0
14:54:39.973992 IP 192.168.1.21.28540 > 34.107.221.82.80: tcp 322
14:54:40.012199 IP 34.107.221.82.80 > 192.168.1.21.28540: tcp 243
14:54:40.012917 IP 192.168.1.21.28540 > 34.107.221.82.80: tcp 0
14:54:40.014800 IP 192.168.1.21.28540 > 34.107.221.82.80: tcp 0
14:54:40.015335 IP 192.168.1.21.28540 > 34.107.221.82.80: tcp 0
14:54:40.095186 IP 192.168.1.21.55915 > 99.84.5.21.443: tcp 1
14:54:40.142112 IP 192.168.1.21.40178 > 5.62.53.53.443: tcp 72
14:54:40.207717 IP 192.168.1.21 > 8.8.4.4: ICMP echo request, id 30718, seq 51232, length 9
14:54:40.242119 IP 8.8.4.4 > 192.168.1.21: ICMP echo reply, id 30718, seq 51232, length 9
14:54:40.708015 IP 192.168.1.21 > 8.8.4.4: ICMP echo request, id 30718, seq 51233, length 9
14:54:40.718872 IP 192.168.1.21.17873 > 172.217.18.196.443: tcp 0
14:54:40.741284 IP 172.217.18.196.443 > 192.168.1.21.17873: tcp 0
14:54:40.741866 IP 192.168.1.21.17873 > 172.217.18.196.443: tcp 0
14:54:40.744162 IP 192.168.1.21.17873 > 172.217.18.196.443: tcp 517
14:54:40.752182 IP 8.8.4.4 > 192.168.1.21: ICMP echo reply, id 30718, seq 51233, length 9
14:54:41.001739 IP 192.168.1.21.17873 > 172.217.18.196.443: tcp 517
14:54:41.095130 IP 192.168.1.21.55915 > 99.84.5.21.443: tcp 1
14:54:41.229094 IP 192.168.1.21 > 8.8.4.4: ICMP echo request, id 30718, seq 51234, length 9
14:54:41.262195 IP 8.8.4.4 > 192.168.1.21: ICMP echo reply, id 30718, seq 51234, length 9
14:54:41.314075 IP 192.168.1.21.17873 > 172.217.18.196.443: tcp 517
14:54:41.704021 IP 192.168.1.21.38116 > 5.62.40.127.443: tcp 194
14:54:41.741109 IP 192.168.1.21 > 8.8.4.4: ICMP echo request, id 30718, seq 51235, length 9
14:54:41.772097 IP 8.8.4.4 > 192.168.1.21: ICMP echo reply, id 30718, seq 51235, length 9
14:54:41.923129 IP 192.168.1.21.17873 > 172.217.18.196.443: tcp 517
14:54:42.110939 IP 192.168.1.21.55915 > 99.84.5.21.443: tcp 1
14:54:42.253102 IP 192.168.1.21 > 8.8.4.4: ICMP echo request, id 30718, seq 51236, length 9
          johnpozJ 1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator @smalldragoon
            last edited by johnpoz

            @smalldragoon said in Send Traffic from 1 host to a specific GW:

            14:54:33.843571 IP 192.168.1.21.14704 > 34.107.221.82.80: tcp 0
            14:54:33.846300 IP 192.168.1.21.14704 > 34.107.221.82.80: tcp 0
            14:54:33.847262 IP 192.168.1.21.14704 > 34.107.221.82.80: tcp 0

            Looks like more than the live checks to me.. I just don't see any answers.. So pfsense sends traffic, if there is not response - there is nothing pfsense can do about that.

            14:54:33.842543 IP 34.107.221.82.80 > 192.168.1.21.14704: tcp 243

            There is some sort of reponse - was that a RST.. You can download the pcap into say wireshark and get more easy to view with details.

            And that outbound nat is messed up... Delete all those "mappings" that already exist in auto.. Why would you put those in?? And since you have auto outbound for your 3g, there is no use of any hybrid mappings.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            S 1 Reply Last reply Reply Quote 0
            • S
              smalldragoon @johnpoz
              last edited by

              @johnpoz
              Cleaned all Outbound rules. I did not created anything, it was automatically generated.
              I simplified my architecture , it now fully reflect the schema I posted before ( LAN is and only is 172.16.25.0/24 )
              So, here is my outbound rules set now :

              208277c3-f799-4bc7-8588-2a349c372471-image.png

              Lan Rules:

              f4a26214-b5a7-44a9-95b5-e10236a589d4-image.png

              johnpozJ 1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @smalldragoon
                last edited by

                @smalldragoon well clearly there is listed at 14 different states being sent out that policy rule.. So pfsense is routing traffic like you told it too.

                States are being created.. And from your sniff traffic is being sent out..

                And again with your outbound nat being created auto, there is no need for hybrid.. Hybrid are used when doing say vpn.. And no gateway setup in the actual interface that tells pfsense is a "wan" connection and therefore create the outbound nats.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                S 1 Reply Last reply Reply Quote 0
                • S
                  smalldragoon @johnpoz
                  last edited by

                  @johnpoz said in Send Traffic from 1 host to a specific GW:

                  And again with your outbound nat being created auto, there is no need for hybrid.. Hybrid are used when doing say vpn.. And no gateway setup in the actual interface that tells pfsense is a "wan" connection and therefore create the outbound nats.

                  sorry, my bad english . you mean then I can stick back to auto and remove the 1st mapping I did , like this ?

                  2c020d8b-0c1a-4274-b4db-8c4fe7841125-image.png

                  ?

                  johnpozJ 1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator @smalldragoon
                    last edited by

                    @smalldragoon Yeah see in your auto, where it lists your 3g interface.. So there is no need for hybrid mappings.

                    So what does your state table show for that interface.. From your latest rules posting - it showed 14 states and and almost 4MB of traffic..

                    From your sniff - clearly traffic was being sent out that gateway from the .21 address.. And there were some responses.. But maybe they were RST, seems like maybe some retrans because of no answers going on, etc.

                    You can do your sniff, exclude the icmp stuff - set the count to more than 100... Do some testing of connections, dns etc. And then download the pcap and view with say wireshark to get a better understanding of what is going on via the sniff. But from what have shown traffic is flowing out the gateway..

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    S 1 Reply Last reply Reply Quote 0
                    • S
                      smalldragoon @johnpoz
                      last edited by

                      @johnpoz
                      Ok, thanks, will do , and keep you posted

                      1 Reply Last reply Reply Quote 0
                      • S
                        SteveITS Galactic Empire @smalldragoon
                        last edited by

                        @smalldragoon said in Send Traffic from 1 host to a specific GW:

                        I set all the rules to any any accept to avoid any blocking :
                        3G - Orange

                        Orange is an Internet connection? You probably don't want to allow all inbound traffic on it, which would allow the Internet to log in to pfSense.

                        Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                        When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                        Upvote 👍 helpful posts!

                        johnpozJ 1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @SteveITS
                          last edited by

                          @steveits While agree with your for sure - he is clearly behind a nat with that 192.168.1.21 address - so unless they are port forwarding to him, or he has something setup on the isp device I don't see how any inbound could come in unsolicited.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          S 1 Reply Last reply Reply Quote 0
                          • S
                            SteveITS Galactic Empire @johnpoz
                            last edited by

                            @johnpoz said in Send Traffic from 1 host to a specific GW:

                            behind a nat with that 192.168.1.21

                            I missed that, never mind. Unless it's set as a DMZ.
                            The bigger picture point is probably that an inbound rule on an interface won't affect outbound traffic.

                            Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                            When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                            Upvote 👍 helpful posts!

                            johnpozJ 1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @SteveITS
                              last edited by

                              @steveits said in Send Traffic from 1 host to a specific GW:

                              The bigger picture point is probably that an inbound rule on an interface won't affect outbound traffic.

                              Very true and good point..

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              S 1 Reply Last reply Reply Quote 0
                              • S
                                smalldragoon @johnpoz
                                last edited by

                                @johnpoz
                                Hi All, I made many tests as suggested and still nothing .
                                Today, found that the IP allocated as "wan" to the 3G router is 10. X.Y.Z.
                                Is there anything in PFSense preventing RFC1918 and all non routable network restrictions ?
                                Found some doc , doesn't seem to be relevant, but I'm doublechecking ..
                                Thx

                                S 1 Reply Last reply Reply Quote 0
                                • S
                                  SteveITS Galactic Empire @smalldragoon
                                  last edited by

                                  @smalldragoon said in Send Traffic from 1 host to a specific GW:

                                  anything in PFSense preventing RFC1918

                                  Each interface has a "Block private networks and loopback addresses" checkbox but that would normally be for inbound traffic.

                                  Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                                  When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                                  Upvote 👍 helpful posts!

                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.