Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Send Traffic from 1 host to a specific GW

    Scheduled Pinned Locked Moved Routing and Multi WAN
    25 Posts 3 Posters 1.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator @smalldragoon
      last edited by johnpoz

      @smalldragoon said in Send Traffic from 1 host to a specific GW:

      14:54:33.843571 IP 192.168.1.21.14704 > 34.107.221.82.80: tcp 0
      14:54:33.846300 IP 192.168.1.21.14704 > 34.107.221.82.80: tcp 0
      14:54:33.847262 IP 192.168.1.21.14704 > 34.107.221.82.80: tcp 0

      Looks like more than the live checks to me.. I just don't see any answers.. So pfsense sends traffic, if there is not response - there is nothing pfsense can do about that.

      14:54:33.842543 IP 34.107.221.82.80 > 192.168.1.21.14704: tcp 243

      There is some sort of reponse - was that a RST.. You can download the pcap into say wireshark and get more easy to view with details.

      And that outbound nat is messed up... Delete all those "mappings" that already exist in auto.. Why would you put those in?? And since you have auto outbound for your 3g, there is no use of any hybrid mappings.

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      S 1 Reply Last reply Reply Quote 0
      • S
        smalldragoon @johnpoz
        last edited by

        @johnpoz
        Cleaned all Outbound rules. I did not created anything, it was automatically generated.
        I simplified my architecture , it now fully reflect the schema I posted before ( LAN is and only is 172.16.25.0/24 )
        So, here is my outbound rules set now :

        208277c3-f799-4bc7-8588-2a349c372471-image.png

        Lan Rules:

        f4a26214-b5a7-44a9-95b5-e10236a589d4-image.png

        johnpozJ 1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator @smalldragoon
          last edited by

          @smalldragoon well clearly there is listed at 14 different states being sent out that policy rule.. So pfsense is routing traffic like you told it too.

          States are being created.. And from your sniff traffic is being sent out..

          And again with your outbound nat being created auto, there is no need for hybrid.. Hybrid are used when doing say vpn.. And no gateway setup in the actual interface that tells pfsense is a "wan" connection and therefore create the outbound nats.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          S 1 Reply Last reply Reply Quote 0
          • S
            smalldragoon @johnpoz
            last edited by

            @johnpoz said in Send Traffic from 1 host to a specific GW:

            And again with your outbound nat being created auto, there is no need for hybrid.. Hybrid are used when doing say vpn.. And no gateway setup in the actual interface that tells pfsense is a "wan" connection and therefore create the outbound nats.

            sorry, my bad english . you mean then I can stick back to auto and remove the 1st mapping I did , like this ?

            2c020d8b-0c1a-4274-b4db-8c4fe7841125-image.png

            ?

            johnpozJ 1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator @smalldragoon
              last edited by

              @smalldragoon Yeah see in your auto, where it lists your 3g interface.. So there is no need for hybrid mappings.

              So what does your state table show for that interface.. From your latest rules posting - it showed 14 states and and almost 4MB of traffic..

              From your sniff - clearly traffic was being sent out that gateway from the .21 address.. And there were some responses.. But maybe they were RST, seems like maybe some retrans because of no answers going on, etc.

              You can do your sniff, exclude the icmp stuff - set the count to more than 100... Do some testing of connections, dns etc. And then download the pcap and view with say wireshark to get a better understanding of what is going on via the sniff. But from what have shown traffic is flowing out the gateway..

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              S 1 Reply Last reply Reply Quote 0
              • S
                smalldragoon @johnpoz
                last edited by

                @johnpoz
                Ok, thanks, will do , and keep you posted

                1 Reply Last reply Reply Quote 0
                • S
                  SteveITS Galactic Empire @smalldragoon
                  last edited by

                  @smalldragoon said in Send Traffic from 1 host to a specific GW:

                  I set all the rules to any any accept to avoid any blocking :
                  3G - Orange

                  Orange is an Internet connection? You probably don't want to allow all inbound traffic on it, which would allow the Internet to log in to pfSense.

                  Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                  When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                  Upvote ๐Ÿ‘ helpful posts!

                  johnpozJ 1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator @SteveITS
                    last edited by

                    @steveits While agree with your for sure - he is clearly behind a nat with that 192.168.1.21 address - so unless they are port forwarding to him, or he has something setup on the isp device I don't see how any inbound could come in unsolicited.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    S 1 Reply Last reply Reply Quote 0
                    • S
                      SteveITS Galactic Empire @johnpoz
                      last edited by

                      @johnpoz said in Send Traffic from 1 host to a specific GW:

                      behind a nat with that 192.168.1.21

                      I missed that, never mind. Unless it's set as a DMZ.
                      The bigger picture point is probably that an inbound rule on an interface won't affect outbound traffic.

                      Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                      When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                      Upvote ๐Ÿ‘ helpful posts!

                      johnpozJ 1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator @SteveITS
                        last edited by

                        @steveits said in Send Traffic from 1 host to a specific GW:

                        The bigger picture point is probably that an inbound rule on an interface won't affect outbound traffic.

                        Very true and good point..

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        S 1 Reply Last reply Reply Quote 0
                        • S
                          smalldragoon @johnpoz
                          last edited by

                          @johnpoz
                          Hi All, I made many tests as suggested and still nothing .
                          Today, found that the IP allocated as "wan" to the 3G router is 10. X.Y.Z.
                          Is there anything in PFSense preventing RFC1918 and all non routable network restrictions ?
                          Found some doc , doesn't seem to be relevant, but I'm doublechecking ..
                          Thx

                          S 1 Reply Last reply Reply Quote 0
                          • S
                            SteveITS Galactic Empire @smalldragoon
                            last edited by

                            @smalldragoon said in Send Traffic from 1 host to a specific GW:

                            anything in PFSense preventing RFC1918

                            Each interface has a "Block private networks and loopback addresses" checkbox but that would normally be for inbound traffic.

                            Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                            When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                            Upvote ๐Ÿ‘ helpful posts!

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.