VMware Workstation VMs Web Traffic Being Blocked

dfinjr

@johnpoz
Checked the virtual settings and it looks like the ethernet 0 adapter itself is set to 1500 MTU as well:

dfinjr

I'd be happy to try that but can't find the config file you're speaking about. I went to the virtual machine directory and don't see a vmx config file.

Can you help me understand where that might be if it isn't under the directory holding the VM?

Thanks!

DaddyGo

@dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:

Can you help me understand where that might be if it isn't under the directory holding the VM?

Sure,

as others have said too, something is very wrong with this VM, hihihihi

as I said, I prefer ESXi, but this should work (on WS16):

https://kb.vmware.com/s/article/1003880

DaddyGo

@dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:

I'd be happy

comes to my mind....

if you have a chance throw up a fresh windows install already to see if it behaves similarly, I wonder?

(let's rule out a possible problem with the "squeaky" windows)

dfinjr

@daddygo
Thank you that got me to the config file.

Powered off the host and modified the file:

Made the modifications and started the machine again.

Unsurprisingly it needed me to set the info again for the static IP (Not a DHCP subnet) and is now showing up like this:

However I am sad to say it is the same result.

Same sites don't load same sites do. Captured a fresh packet capture with the new vmxnet3 device just in case it would be handy.clientcapture443-4.pcapng.gz

dfinjr

@daddygo
I'll do you one better. Spun up a Ubuntu instance.

Same results:

Netgate.com loads but none of the other sites in question.

Open to any and all thoughts :)

johnpoz

@dfinjr and you still have same issue in that pcap

That is going to have nothing but problems on a normal 1500 mtu ethernet network..

Forget about what loads or doesn't load - putting that sized frame on a etherenet network that is not designed for that size is going to have nothing but problems.

Even if you have something that fragments it back down to the standard, that is not a fix.. The fix is to use standard frame size.

Where exactly are you sniffing that - inside the virtual machine, on the vm host to the wire? That is going to be nothing but problematic no matter if sniffing on the vm, or the physical nic..

DaddyGo

@dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:

However I am sad to say it is the same result.

OMG.... this is get more interesting
but I still say it's not pfSense that's doing this

totally agree with John, but what makes this MTU value?

stephenw10

Mmm, isn't that internal traffic to VMWare though? Is that actually failing?

It looked like it was using standard sized frames for external connections previously. Though this absolutely does feel like an MTU issue.

Steve

johnpoz

@daddygo said in VMware Workstation VMs Web Traffic Being Blocked:

but I still say it's not pfSense that's doing this

pfsense has ZERO to do with this that is for sure!! Pfsense has nothing to do with some client on the network putting odd ball sized frames on the wire.

dfinjr

To everyone here. I do have a Cisco packet capture from earlier this morning. Would that be neat to see? Traffic flows... No modification to VM at all.

DaddyGo

@johnpoz said in VMware Workstation VMs Web Traffic Being Blocked:

pfsense has ZERO to do with this that is for sure!!

Yup, but the OP came here because he thought it was a pfSense thing

the son of man is always learning, hihihi
(this would be interesting to solve, it's probably just a banal problem)

DaddyGo

@dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:

To everyone here.

I would go further by saying that the NAT solved the problem yesterday, here's where the dog will be buried

johnpoz

@daddygo said in VMware Workstation VMs Web Traffic Being Blocked:

OP came here because he thought it was a pfSense thing

They always do - xyz doesn't work, must be pfsense ;) But a packet capture showing some odd ball frame size on some client being put on the wire sure has nothing to do with pfsense.

What version of vmware station is being used here? I find it hard to believe such an odd ball setup is default.. Someone prob tried setting jumbo frames at some point or time, and maybe their cisco was set for those which is why it so called worked..

1753 sure isn't even a normal jumbo size, or standard anything..

dfinjr

@johnpoz
Don't burn me at the stake already guys. Attached is the capture log from Cisco being the backbone for the same VMs. Traffic goes. Why would that be the case? Again please educate me :) precaptureoncisco.pcapng.gz

DaddyGo

@dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:

Don't burn me at the stake already guys.

Don't take it to heart, we're just "moaning" a bit...

can we look at the case where you give DNS (Unbound) and DHCP to the VM out of the pfSense box?

say from a single interface without VLAN(s)
(forget about pi, for a bit)

johnpoz

@dfinjr that is still all messed up! your seeing same frame sizes over the standard with a max of that 1753

DaddyGo

@johnpoz said in VMware Workstation VMs Web Traffic Being Blocked:

What version of vmware station is being used here?

in principle VMware WS16PRO

dfinjr

@daddygo

DHCP now, same results

johnpoz

@dfinjr your actual vm has mtu set to 1500, so somewhere in the vmworksation switch or setting you have it borked up..

Someone at some time tried doing something with jumbo frames is my guess.. But that frame size isn't even a standard for jumbo or even baby giant frames which could be 1600.