Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    VMware Workstation VMs Web Traffic Being Blocked

    Scheduled Pinned Locked Moved General pfSense Questions
    221 Posts 6 Posters 51.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      dfinjr @DaddyGo
      last edited by

      @daddygo
      Thanks for bringing it up with your vexpert contacts. I can likely setup a downstream device in the same area of the network and put virtual box on it and see what it does. I'll let you know what I get.

      1 Reply Last reply Reply Quote 0
      • D
        dfinjr
        last edited by

        So I went and did a bigger test and I'm sold on the idea that the Cisco ASA was doing something to the packets to make them flow. I decided to try another router (TPLink ER605) just to see how it behaved with the VMS. Not exactly the same but very very close to the same results. Interestingly enough, the tplink was able to do sites such as netgate.com and speedtest.net (which it was able to execute the speedtest.net speedtest) but the .202 client is still failing to fully load some sites such as pfsense.org and gmail.

        So the ASA had to be doing something to make it so the packets would survive because 2 other firewalls aren't doing whatever that ASA is doing to make it behave normally...

        I'm going to hook back up the ASA and dig into anything I see there that would stand out as anything that might be doing this as nothing comes to mind.

        It did prove to me though that the ASA was doing something special to the traffic and that the vmware vm traffic routing is definitely not playing a regular game with the packets in one form or another. My current best guess is that the packets were arriving to the VMware VMS/hosting system in such a way that it was able to pass the traffic already modified from the ASA through the VMWare logical networking.... Just gotta figure out what that is!

        Color me confused but feeling like we're finally on the right track.

        1 Reply Last reply Reply Quote 0
        • D
          dfinjr
          last edited by

          just keeping everyone up to speed. No idea why this would make a lick of difference but I hard set the MTU on the labsystems interface to 1500 MTU and now speedtest.net will load and run to full expectation. Now just gotta finish sorting out the last few sites. Heading the right direction.

          johnpozJ DaddyGoD 2 Replies Last reply Reply Quote 0
          • D
            dfinjr
            last edited by

            I went line by line on the Cisco ASA config and found nothing that would be special by any means. I'll start looking at the analysis difference between the two sets of captures.

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator @dfinjr
              last edited by

              @dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:

              but I hard set the MTU on the labsystems interface to 1500 MTU

              what is this labsystems exactly - there is nothing labeled that in your drawing.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              D DaddyGoD 2 Replies Last reply Reply Quote 0
              • DaddyGoD
                DaddyGo @dfinjr
                last edited by

                @dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:

                just keeping everyone up to speed.

                What I recently got a warning from a "vexpert" line that there are problems with the I219-V Intel stuff in virtualization environments from the beginning, problems all over the place....

                these are only somewhat mitigated by the Fling community driver, it may be related(?)

                https://flings.vmware.com/community-networking-driver-for-esxi/
                https://www.virten.net/2017/02/heads-up-esxi-not-working-on-7th-gen-kaby-lake-intel-nuc/

                same is the case for some Linux flavours with this Intel
                maybe there is something in this

                Cats bury it so they can't see it!
                (You know what I mean if you have a cat)

                1 Reply Last reply Reply Quote 0
                • D
                  dfinjr @johnpoz
                  last edited by

                  @johnpoz
                  Labsystems is the vlan where my VMs live. 172.16.0.0/24. Connects from PFsense to the TPlink switch to the vm hosting system and the rpi.

                  johnpozJ 1 Reply Last reply Reply Quote 0
                  • DaddyGoD
                    DaddyGo @johnpoz
                    last edited by

                    @johnpoz said in VMware Workstation VMs Web Traffic Being Blocked:

                    what is this labsystems exactly

                    supposed to be port 4 of SG2100

                    Cats bury it so they can't see it!
                    (You know what I mean if you have a cat)

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @dfinjr
                      last edited by

                      @dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:

                      Labsystems is the vlan where my VMs live. 172.16.0.0/24

                      And where did you set the mtu exactly - on what? What was it that it wasn't the standard and you had to "hard code" it?

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      D 1 Reply Last reply Reply Quote 0
                      • D
                        dfinjr @johnpoz
                        last edited by

                        @johnpoz
                        d5d57e70-ecd9-45f6-8c5c-0d366ad2043c-image.png

                        It only somewhat helped. Afterward I could get speedtest.net to render.

                        johnpozJ 1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @dfinjr
                          last edited by johnpoz

                          @dfinjr and if you ssh to your pfsense and do a ifconfig - what are all the mtu for all the intefaces showing?

                          Looking at your ciscoasa pcap - the frame sizes are sill OFF.. 1434 and 1380?

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          D stephenw10S 2 Replies Last reply Reply Quote 0
                          • D
                            dfinjr @johnpoz
                            last edited by

                            @johnpoz
                            doesn't look like this output shows the MTU:
                            25008f12-9903-4a15-a3ab-84244fd3fd6d-image.png

                            is there another command I can run in order to give you what you're after?

                            Yeah I bet the frame sizes were still off. No idea how the ASA was compensating for it.

                            johnpozJ 1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @dfinjr
                              last edited by johnpoz

                              @dfinjr that is not an ifconfig command

                              ifconfig.jpg

                              from the main pfsense menu, do 8 and then run the command

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              D 1 Reply Last reply Reply Quote 0
                              • D
                                dfinjr @johnpoz
                                last edited by

                                @johnpoz
                                8a4ea268-55da-4d80-ac26-c28df85358fa-image.png

                                DaddyGoD 1 Reply Last reply Reply Quote 0
                                • DaddyGoD
                                  DaddyGo @dfinjr
                                  last edited by

                                  @dfinjr

                                  rather so, enter the shell (8) 😉

                                  ecb33df2-df30-49ae-a3bd-2d1a146a9008-image.png

                                  Cats bury it so they can't see it!
                                  (You know what I mean if you have a cat)

                                  D 1 Reply Last reply Reply Quote 0
                                  • D
                                    dfinjr @DaddyGo
                                    last edited by

                                    @daddygo
                                    my bad!
                                    37773157-b1a8-4e60-81a7-2f221ac16e13-image.png

                                    DaddyGoD 1 Reply Last reply Reply Quote 0
                                    • DaddyGoD
                                      DaddyGo @dfinjr
                                      last edited by

                                      @dfinjr

                                      this looks good....
                                      we're not moving forward, we're stuck in one place, I can think of two things:

                                      1. do you have a good quality USB NIC in your hands?
                                      2. VirtualBox temp install

                                      Cats bury it so they can't see it!
                                      (You know what I mean if you have a cat)

                                      D 1 Reply Last reply Reply Quote 0
                                      • D
                                        dfinjr @DaddyGo
                                        last edited by

                                        @daddygo
                                        I agree. breaking out another system with mint/virtual box on it to test. stand by for a sec and let me build something up.

                                        1 Reply Last reply Reply Quote 0
                                        • stephenw10S
                                          stephenw10 Netgate Administrator @johnpoz
                                          last edited by

                                          @johnpoz said in VMware Workstation VMs Web Traffic Being Blocked:

                                          Looking at your ciscoasa pcap - the frame sizes are sill OFF.. 1434 and 1380?

                                          Yeah, interesting. Something is restricting the MTU there.

                                          Also interesting is that the pcap on the VM host sees the traffic both ways with the Cisco in there.

                                          Steve

                                          1 Reply Last reply Reply Quote 0
                                          • D
                                            dfinjr
                                            last edited by

                                            While we're waiting...

                                            Would you expect to see a block between two systems on these two vlans?

                                            751843a1-910b-4b65-849b-f90d5dc4c693-image.png

                                            d94f25e9-e57a-4716-820f-a3ac0cc6e8d6-image.png

                                            got something interesting going on here and I wonder if it is the same thing we've been seeing...

                                            As I mentioned once before, I am a Bigfix sales engineer.

                                            The DMZ client can ping/curl everything I would expect for the system to connect to the Bigfix management server yet I am seeing it fail.

                                            aa252999-1313-4aa7-8c1c-1ac87377b9ff-image.png

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.