Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    VMware Workstation VMs Web Traffic Being Blocked

    Scheduled Pinned Locked Moved General pfSense Questions
    221 Posts 6 Posters 50.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      dfinjr @DaddyGo
      last edited by

      @daddygo
      Thank you that got me to the config file.

      Powered off the host and modified the file:
      597fd71f-d376-486b-a6b1-e8bf782d4ffa-image.png

      Made the modifications and started the machine again.

      Unsurprisingly it needed me to set the info again for the static IP (Not a DHCP subnet) and is now showing up like this:
      d327bed3-08a2-4a95-8a49-bf8aa0aec456-image.png

      However I am sad to say it is the same result.

      Same sites don't load same sites do. Captured a fresh packet capture with the new vmxnet3 device just in case it would be handy.clientcapture443-4.pcapng.gz

      johnpozJ DaddyGoD 2 Replies Last reply Reply Quote 0
      • D
        dfinjr @DaddyGo
        last edited by

        @daddygo
        I'll do you one better. Spun up a Ubuntu instance.

        Same results:
        98a1de85-1587-485b-b53f-0e4c15eead0b-image.png

        Netgate.com loads but none of the other sites in question.

        Open to any and all thoughts :)

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator @dfinjr
          last edited by johnpoz

          @dfinjr and you still have same issue in that pcap

          framesize.jpg

          That is going to have nothing but problems on a normal 1500 mtu ethernet network..

          Forget about what loads or doesn't load - putting that sized frame on a etherenet network that is not designed for that size is going to have nothing but problems.

          Even if you have something that fragments it back down to the standard, that is not a fix.. The fix is to use standard frame size.

          Where exactly are you sniffing that - inside the virtual machine, on the vm host to the wire? That is going to be nothing but problematic no matter if sniffing on the vm, or the physical nic..

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • DaddyGoD
            DaddyGo @dfinjr
            last edited by

            @dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:

            However I am sad to say it is the same result.

            OMG.... this is get more interesting
            but I still say it's not pfSense that's doing this

            totally agree with John, but what makes this MTU value?

            Cats bury it so they can't see it!
            (You know what I mean if you have a cat)

            johnpozJ 1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              Mmm, isn't that internal traffic to VMWare though? Is that actually failing?

              It looked like it was using standard sized frames for external connections previously. Though this absolutely does feel like an MTU issue.

              Steve

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @DaddyGo
                last edited by

                @daddygo said in VMware Workstation VMs Web Traffic Being Blocked:

                but I still say it's not pfSense that's doing this

                pfsense has ZERO to do with this that is for sure!! Pfsense has nothing to do with some client on the network putting odd ball sized frames on the wire.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                D DaddyGoD 2 Replies Last reply Reply Quote 0
                • D
                  dfinjr @johnpoz
                  last edited by

                  To everyone here. I do have a Cisco packet capture from earlier this morning. Would that be neat to see? Traffic flows... No modification to VM at all.

                  DaddyGoD 1 Reply Last reply Reply Quote 0
                  • DaddyGoD
                    DaddyGo @johnpoz
                    last edited by

                    @johnpoz said in VMware Workstation VMs Web Traffic Being Blocked:

                    pfsense has ZERO to do with this that is for sure!!

                    Yup, but the OP came here because he thought it was a pfSense thing 😉

                    the son of man is always learning, hihihi
                    (this would be interesting to solve, it's probably just a banal problem)

                    Cats bury it so they can't see it!
                    (You know what I mean if you have a cat)

                    johnpozJ 1 Reply Last reply Reply Quote 0
                    • DaddyGoD
                      DaddyGo @dfinjr
                      last edited by

                      @dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:

                      To everyone here.

                      I would go further by saying that the NAT solved the problem yesterday, here's where the dog will be buried

                      Cats bury it so they can't see it!
                      (You know what I mean if you have a cat)

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator @DaddyGo
                        last edited by johnpoz

                        @daddygo said in VMware Workstation VMs Web Traffic Being Blocked:

                        OP came here because he thought it was a pfSense thing

                        They always do - xyz doesn't work, must be pfsense ;) But a packet capture showing some odd ball frame size on some client being put on the wire sure has nothing to do with pfsense.

                        What version of vmware station is being used here? I find it hard to believe such an odd ball setup is default.. Someone prob tried setting jumbo frames at some point or time, and maybe their cisco was set for those which is why it so called worked..

                        1753 sure isn't even a normal jumbo size, or standard anything..

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        D DaddyGoD 2 Replies Last reply Reply Quote 0
                        • D
                          dfinjr @johnpoz
                          last edited by

                          @johnpoz
                          Don't burn me at the stake already guys. Attached is the capture log from Cisco being the backbone for the same VMs. Traffic goes. Why would that be the case? Again please educate me :)precaptureoncisco.pcapng.gz

                          DaddyGoD johnpozJ stephenw10S 3 Replies Last reply Reply Quote 0
                          • DaddyGoD
                            DaddyGo @dfinjr
                            last edited by DaddyGo

                            @dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:

                            Don't burn me at the stake already guys.

                            Don't take it to heart, we're just "moaning" a bit...😉

                            can we look at the case where you give DNS (Unbound) and DHCP to the VM out of the pfSense box?

                            • say from a single interface without VLAN(s)
                              (forget about pi, for a bit)

                            Cats bury it so they can't see it!
                            (You know what I mean if you have a cat)

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @dfinjr
                              last edited by johnpoz

                              @dfinjr that is still all messed up! your seeing same frame sizes over the standard with a max of that 1753

                              frame.jpg

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • DaddyGoD
                                DaddyGo @johnpoz
                                last edited by

                                @johnpoz said in VMware Workstation VMs Web Traffic Being Blocked:

                                What version of vmware station is being used here?

                                in principle VMware WS16PRO

                                Cats bury it so they can't see it!
                                (You know what I mean if you have a cat)

                                D 1 Reply Last reply Reply Quote 0
                                • D
                                  dfinjr @DaddyGo
                                  last edited by

                                  @daddygo
                                  322a4891-c918-4172-a5fa-164a9337364d-image.png

                                  DHCP now, same results

                                  johnpozJ DaddyGoD 2 Replies Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator @dfinjr
                                    last edited by johnpoz

                                    @dfinjr your actual vm has mtu set to 1500, so somewhere in the vmworksation switch or setting you have it borked up..

                                    Someone at some time tried doing something with jumbo frames is my guess.. But that frame size isn't even a standard for jumbo or even baby giant frames which could be 1600.

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    1 Reply Last reply Reply Quote 0
                                    • DaddyGoD
                                      DaddyGo @dfinjr
                                      last edited by DaddyGo

                                      @dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:

                                      DHCP now, same results

                                      To recap a bit, on anything that is VM related guest Linux/Windows this MTU sees, please do it a packet capture on an external physical machine

                                      I ask, clean version of the WS16?
                                      (only two can hear - :))

                                      +++++edit:
                                      what network card is in the machine running WS16?

                                      +++edit2:
                                      VMware HCL approved?

                                      Cats bury it so they can't see it!
                                      (You know what I mean if you have a cat)

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator @dfinjr
                                        last edited by

                                        @dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:

                                        Attached is the capture log from Cisco being the backbone for the same VMs

                                        That was actually taken on the Cisco?

                                        Yeah there are oversized frames there but all between 172.16.0.202 and 172.17.0.7. What are those things? I had assumed they are both inside VMWare. And also that 192.168.1.100 is?

                                        Steve

                                        1 Reply Last reply Reply Quote 0
                                        • D
                                          dfinjr
                                          last edited by

                                          Ok I'm going to try and tag you all because I know you're all waiting on me at this point :)...

                                          @johnpoz
                                          I'm looking to see if there is something that I can configure in the virtual switch itself tied to VMware Workstation 16 Pro. I don't see specifics yet tied to MTU but so far just seeing some basic items such as host-only/NAT... items of the sort. I'm the only one using this environment for lab/demonstration purposes. If there was a jumbo frame it would of likely been me but most everything outside of standard static networking is pretty vanilla. Stock installs/stock configs. I don't know enough to get fancy.

                                          @DaddyGo
                                          I believe it is a clean install of WS16? What would make it not clean? :)
                                          Here is the card on the hosting system:
                                          4c7d77be-9800-488d-8170-04177261f361-image.png

                                          @stephenw10
                                          That packet capture was taken from the same 172.16.0.202 client but the network backbone being the Cisco ASA. Sorry I was very unclear with how I said that earlier.

                                          Those are likely packets for the management software I was talking about. I am a sales engineer for HCL BigFix. The frames you're seeing are likely my other subnet managed systems reaching back out to the 172.16.0.202 as it is my hosting server for BigFix. Not both inside of VMware, the only hosts inside of vmware are the 172.16.0.0/24 subnet, anything outside is physical systems as what would be happening from 172.17.0.0/24. Not sure on 192.168.1.100 at the moment I'll have to look into that. I have pfsense running on its default subnet of 192.168.1.0/24 so perhaps another systems is sitting there somewhere on that same subnet.

                                          To everyone: Why would the Cisco equipment flow this traffic no problem vs what is happening with PFSENSE? I am not trying to bash pfsense or anything I really want to use it. I am just saying what is the difference in the handling?

                                          Thanks!

                                          johnpozJ DaddyGoD 2 Replies Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator @dfinjr
                                            last edited by johnpoz

                                            @dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:

                                            so perhaps another systems is sitting there somewhere on that same subnet.

                                            You shouldn't see any packets... I see specific traffic from sent from 172.16.0.202 being sent to 192.168.1.100 in one of your sniffs. With a large frame size!

                                            Why would the Cisco equipment flow this traffic no problem vs what is happening with PFSENSE

                                            Maybe the interfaces on the cisco is set to allow jumbo.. Doesn't matter to be honest - putting frames on the wire at that size is BORKED!! They are not standard jumbo size, they are not any other size like baby giants, etc.. They seem to be just someone pulled out of then air and lets use 1753 as a mtu? The cisco sure didn't pass that traffic out to the internet with that frame size that is for sure..

                                            Trying to run a network with that odd ball frame size is going to cause you nothing but grief and issues..

                                            In the process of installing vmworkstation 16.2.2... This is the nic it created on my windows machine. You can see its not using jumbo and defaults to 1514.. What does your show?

                                            workstation.jpg

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            D 2 Replies Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.