VMware Workstation VMs Web Traffic Being Blocked
-
@stephenw10
I did a short packet capture and want to share it but there is a hard limit on the file size, tried compressing it but still not less than 2mb. Is there another method I could share it with you?I would think it was something to do with vmware workstation but can't think of a reason why it would work on a Cisco ASA and not this netgate appliance. Don't believe I did anything special with the Cisco at all.
Either case, I definitely want to use the new netgate hardware for a few reasons, one being this hardware isn't 7yrs old :).
-
@stephenw10
Think I got it:
pcap4.pcapng.gz -
@dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:
I think the screen shot it shows that the type is vmnet0.
Nope, that would be part of the "custom" option, you are currently using the E1000e driver from VMwareTools as the default driver Intel 82574
it's definitely the interaction between virtual environment and windows, I wouldn't think pfSense is cool to differentiate between physical machine and VM machine on the same subnet
try playing around with the virtual machine NIC driver, as a high number of retransmission may indicate a stall....
+++edit:
https://kb.vmware.com/s/article/2032184 -
@daddygo said in VMware Workstation VMs Web Traffic Being Blocked:
https://kb.vmware.com/s/article/2032184
I'll give this a shot here in a few and update the post. Thank you!
-
@daddygo
Looks like the vmware specific drivers do not want to play ball with the host:
-
@stephenw10
Hi Steve,
Was wondering if you had any other ideas on what you were seeing on the network packet captures?Thanks!
David -
@dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:
Looks like the vmware specific drivers do not want to play ball with the host:
Ouupss...
Unfortunately I don't use Windows with workstation16, only on ESXi with vmxnet3 and no problems behind pfSense....
just out of curiosity would you try it behind NAT on your workstation16...(?)
BTW:
windows is a strange beast when it comes to type 2 hypervisors, although I haven't seen this on VirtualBox yet either, I'll install one on workstation16 tomorrow.I'm getting more and more excited, but I can definitely feel that it's not a pfSense question
edit:
Ubuntu behaves perfectly well in this setting, so I suspect to MS
-
Mmm, I would not think either pfSense or the Cisco router would have any idea which traffic comes from a VM. And it shouldn't matter.
Things I could imagine happening are the Cisco doing some fragmentation or reassembly pfSense is not. -
@stephenw10 said in VMware Workstation VMs Web Traffic Being Blocked:
Cisco doing some fragmentation or reassembly pfSense is not.
Yuppp,... This is also possible, but the problem is that it is transferred to the VM environment in different ways, ergo one of the device drivers (VM) is messing with us (maybe)
BTW:
ens33 has nothing wrong with this on Ubuntu -
In the pcap there are some jumbo frames shown between internal hosts. So possibly something is trying to use them externally. I don't see that in the capture though.
-
@daddygo
Ok so interestingly enough, switching it to NAT and then allowing it to get an "IP" from the VMware hosting pieces with its little internal DHCP server it does restore internet functionality. However, I think with the solutions that I'm hosting (Endpoint management with BigFix) that this may very well stop it from service providing for the rest of the infrastructure. Haven't tested that out yet or anything but wanted to drop the note that it is allowing for browsing under nat settings.I'll test out the other functionality to see if I am getting roadblocks for its other services. Clients external to that system register to the management area so I am worried that if it was buried behind the hosting laptops identity on the network.
-
@dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:
it does restore internet functionality.
I felt it was going to be
which is why I don't use a windows on type two hypervisor, hihihihibut still I understand your concern and I'm sure it can be made to work, now I'm going to watch CNN (damn war , ): ), but tomorrow I'll install a win10 (on ws16) and test it, because it's interesting
I'll let you know what I find
-
@dfinjr
It makes sense to me why going NAT would work but I did just verify that it makes the hosting services invisible on the network. So it does fix browsing but does break the availability of listening services. -
@daddygo
Thank you for all the help today! I am going to keep going but you've shed some light on things to say the least! -
@dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:
but does break the availability of listening services.
Well this is how I hide my Ubuntu machine on WS16, yes indeed not a "bridge" type connection
-
@dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:
but you've shed some light on things to say the least!
you're welcome,
if you keep testing, post it here so I can see it tomorrow -
@stephenw10 said in VMware Workstation VMs Web Traffic Being Blocked:
I could imagine happening are the Cisco doing some fragmentation or reassembly pfSense is not.
Is there a way for me to enable something like this in pfsense?
-
@daddygo
Will do! -
@dfinjr There is one setting that might do something like that though the traffic you have there would not normally affected. In Sys > Adv > Firewall&NAT try setting 'IP Do-Not-Fragment compatibility'.
Make sure the Cisco router did not have jumbo frames set on any of it's interfaces.
To get a definitive diagnostic I would try to capture a failing connection on the pfSense LAN and the host VM at the same time so we can compare exactly what each is seeing.
Filter both by the external IP it's connecting to so we don't have to wade through a load of other traffic if possible.Steve
-
@stephenw10
Thank you for the advice. I'll perform that test as soon as I'm back onsite (tonight/tomorrow early AM) and also validate your inquiry about jumbo frames.
