VMware Workstation VMs Web Traffic Being Blocked
-
@stephenw10
Hi Steve,
Was wondering if you had any other ideas on what you were seeing on the network packet captures?Thanks!
David -
@dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:
Looks like the vmware specific drivers do not want to play ball with the host:
Ouupss...
Unfortunately I don't use Windows with workstation16, only on ESXi with vmxnet3 and no problems behind pfSense....
just out of curiosity would you try it behind NAT on your workstation16...(?)
BTW:
windows is a strange beast when it comes to type 2 hypervisors, although I haven't seen this on VirtualBox yet either, I'll install one on workstation16 tomorrow.I'm getting more and more excited, but I can definitely feel that it's not a pfSense question
edit:
Ubuntu behaves perfectly well in this setting, so I suspect to MS
-
Mmm, I would not think either pfSense or the Cisco router would have any idea which traffic comes from a VM. And it shouldn't matter.
Things I could imagine happening are the Cisco doing some fragmentation or reassembly pfSense is not. -
@stephenw10 said in VMware Workstation VMs Web Traffic Being Blocked:
Cisco doing some fragmentation or reassembly pfSense is not.
Yuppp,... This is also possible, but the problem is that it is transferred to the VM environment in different ways, ergo one of the device drivers (VM) is messing with us (maybe)
BTW:
ens33 has nothing wrong with this on Ubuntu -
In the pcap there are some jumbo frames shown between internal hosts. So possibly something is trying to use them externally. I don't see that in the capture though.
-
@daddygo
Ok so interestingly enough, switching it to NAT and then allowing it to get an "IP" from the VMware hosting pieces with its little internal DHCP server it does restore internet functionality. However, I think with the solutions that I'm hosting (Endpoint management with BigFix) that this may very well stop it from service providing for the rest of the infrastructure. Haven't tested that out yet or anything but wanted to drop the note that it is allowing for browsing under nat settings.I'll test out the other functionality to see if I am getting roadblocks for its other services. Clients external to that system register to the management area so I am worried that if it was buried behind the hosting laptops identity on the network.
-
@dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:
it does restore internet functionality.
I felt it was going to be
which is why I don't use a windows on type two hypervisor, hihihihibut still I understand your concern and I'm sure it can be made to work, now I'm going to watch CNN (damn war , ): ), but tomorrow I'll install a win10 (on ws16) and test it, because it's interesting
I'll let you know what I find
-
@dfinjr
It makes sense to me why going NAT would work but I did just verify that it makes the hosting services invisible on the network. So it does fix browsing but does break the availability of listening services. -
@daddygo
Thank you for all the help today! I am going to keep going but you've shed some light on things to say the least! -
@dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:
but does break the availability of listening services.
Well this is how I hide my Ubuntu machine on WS16, yes indeed not a "bridge" type connection
-
@dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:
but you've shed some light on things to say the least!
you're welcome,
if you keep testing, post it here so I can see it tomorrow -
@stephenw10 said in VMware Workstation VMs Web Traffic Being Blocked:
I could imagine happening are the Cisco doing some fragmentation or reassembly pfSense is not.
Is there a way for me to enable something like this in pfsense?
-
@daddygo
Will do! -
@dfinjr There is one setting that might do something like that though the traffic you have there would not normally affected. In Sys > Adv > Firewall&NAT try setting 'IP Do-Not-Fragment compatibility'.
Make sure the Cisco router did not have jumbo frames set on any of it's interfaces.
To get a definitive diagnostic I would try to capture a failing connection on the pfSense LAN and the host VM at the same time so we can compare exactly what each is seeing.
Filter both by the external IP it's connecting to so we don't have to wade through a load of other traffic if possible.Steve
-
@stephenw10
Thank you for the advice. I'll perform that test as soon as I'm back onsite (tonight/tomorrow early AM) and also validate your inquiry about jumbo frames. -
@stephenw10
Good morning Steve, picking up where I left off this morning. Here is a screen shot from the Cisco device, which I failed over to yesterday afternoon for some work stuff but I just redid the test and then processed this output. I'll do a quick packet capture while I'm at it before I switch back over to the netgate appliance and resume testing. Let me know if you want a packet capture while the Cisco appliance is hooked up because I'll have it but won't send it to you unless you think it would be helpful:
I'll resume testing after I switch over her shortly back to the netgate.
-
No that looks fine, nothing there looks like it would be doing anything different.
I think simultaneous pcaps form the pfSense LAN and the client should be revealing.
Steve
-
@stephenw10
Ok got it all done, noticed something interesting this morning that was a little different. Still sites failing but I tried bestbuy.com and amazon.com this morning and amazon super struggled to load but I think eventually completed and bestbuy also navigated. However, gmail, gmail webstore and speedtest.net (and the sites I use for work) all failed to load/render.Attached is from the client as well as the capture from the "labsystems" vlan where the client resides. packetcapture-3.cap clientcaptureshort.pcapng
-
@stephenw10
Just realized I didn't have that "IP Do-Not-Fragment compatibility" turned on so I turned it on and reran the test. Same results. packetcapture-4.cap clientcapture443-3.pcapng.gz Both perspectives are again attached. -
@dfinjr Yeah your frame size is all messed up!
Client capture
Here is from a normal client with your typical mtu of 1500. Talking to a local server
