Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    VMware Workstation VMs Web Traffic Being Blocked

    Scheduled Pinned Locked Moved General pfSense Questions
    221 Posts 6 Posters 51.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DaddyGoD
      DaddyGo @dfinjr
      last edited by

      @dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:

      just keeping everyone up to speed.

      What I recently got a warning from a "vexpert" line that there are problems with the I219-V Intel stuff in virtualization environments from the beginning, problems all over the place....

      these are only somewhat mitigated by the Fling community driver, it may be related(?)

      https://flings.vmware.com/community-networking-driver-for-esxi/
      https://www.virten.net/2017/02/heads-up-esxi-not-working-on-7th-gen-kaby-lake-intel-nuc/

      same is the case for some Linux flavours with this Intel
      maybe there is something in this

      Cats bury it so they can't see it!
      (You know what I mean if you have a cat)

      1 Reply Last reply Reply Quote 0
      • D
        dfinjr @johnpoz
        last edited by

        @johnpoz
        Labsystems is the vlan where my VMs live. 172.16.0.0/24. Connects from PFsense to the TPlink switch to the vm hosting system and the rpi.

        johnpozJ 1 Reply Last reply Reply Quote 0
        • DaddyGoD
          DaddyGo @johnpoz
          last edited by

          @johnpoz said in VMware Workstation VMs Web Traffic Being Blocked:

          what is this labsystems exactly

          supposed to be port 4 of SG2100

          Cats bury it so they can't see it!
          (You know what I mean if you have a cat)

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator @dfinjr
            last edited by

            @dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:

            Labsystems is the vlan where my VMs live. 172.16.0.0/24

            And where did you set the mtu exactly - on what? What was it that it wasn't the standard and you had to "hard code" it?

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            D 1 Reply Last reply Reply Quote 0
            • D
              dfinjr @johnpoz
              last edited by

              @johnpoz
              d5d57e70-ecd9-45f6-8c5c-0d366ad2043c-image.png

              It only somewhat helped. Afterward I could get speedtest.net to render.

              johnpozJ 1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @dfinjr
                last edited by johnpoz

                @dfinjr and if you ssh to your pfsense and do a ifconfig - what are all the mtu for all the intefaces showing?

                Looking at your ciscoasa pcap - the frame sizes are sill OFF.. 1434 and 1380?

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                D stephenw10S 2 Replies Last reply Reply Quote 0
                • D
                  dfinjr @johnpoz
                  last edited by

                  @johnpoz
                  doesn't look like this output shows the MTU:
                  25008f12-9903-4a15-a3ab-84244fd3fd6d-image.png

                  is there another command I can run in order to give you what you're after?

                  Yeah I bet the frame sizes were still off. No idea how the ASA was compensating for it.

                  johnpozJ 1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator @dfinjr
                    last edited by johnpoz

                    @dfinjr that is not an ifconfig command

                    ifconfig.jpg

                    from the main pfsense menu, do 8 and then run the command

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    D 1 Reply Last reply Reply Quote 0
                    • D
                      dfinjr @johnpoz
                      last edited by

                      @johnpoz
                      8a4ea268-55da-4d80-ac26-c28df85358fa-image.png

                      DaddyGoD 1 Reply Last reply Reply Quote 0
                      • DaddyGoD
                        DaddyGo @dfinjr
                        last edited by

                        @dfinjr

                        rather so, enter the shell (8) 😉

                        ecb33df2-df30-49ae-a3bd-2d1a146a9008-image.png

                        Cats bury it so they can't see it!
                        (You know what I mean if you have a cat)

                        D 1 Reply Last reply Reply Quote 0
                        • D
                          dfinjr @DaddyGo
                          last edited by

                          @daddygo
                          my bad!
                          37773157-b1a8-4e60-81a7-2f221ac16e13-image.png

                          DaddyGoD 1 Reply Last reply Reply Quote 0
                          • DaddyGoD
                            DaddyGo @dfinjr
                            last edited by

                            @dfinjr

                            this looks good....
                            we're not moving forward, we're stuck in one place, I can think of two things:

                            1. do you have a good quality USB NIC in your hands?
                            2. VirtualBox temp install

                            Cats bury it so they can't see it!
                            (You know what I mean if you have a cat)

                            D 1 Reply Last reply Reply Quote 0
                            • D
                              dfinjr @DaddyGo
                              last edited by

                              @daddygo
                              I agree. breaking out another system with mint/virtual box on it to test. stand by for a sec and let me build something up.

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator @johnpoz
                                last edited by

                                @johnpoz said in VMware Workstation VMs Web Traffic Being Blocked:

                                Looking at your ciscoasa pcap - the frame sizes are sill OFF.. 1434 and 1380?

                                Yeah, interesting. Something is restricting the MTU there.

                                Also interesting is that the pcap on the VM host sees the traffic both ways with the Cisco in there.

                                Steve

                                1 Reply Last reply Reply Quote 0
                                • D
                                  dfinjr
                                  last edited by

                                  While we're waiting...

                                  Would you expect to see a block between two systems on these two vlans?

                                  751843a1-910b-4b65-849b-f90d5dc4c693-image.png

                                  d94f25e9-e57a-4716-820f-a3ac0cc6e8d6-image.png

                                  got something interesting going on here and I wonder if it is the same thing we've been seeing...

                                  As I mentioned once before, I am a Bigfix sales engineer.

                                  The DMZ client can ping/curl everything I would expect for the system to connect to the Bigfix management server yet I am seeing it fail.

                                  aa252999-1313-4aa7-8c1c-1ac87377b9ff-image.png

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    What's the advanced option you have set on the LABSYSTEMS rule?

                                    I would not expect anything blocked, do you see blocks in the firewall log?

                                    D 1 Reply Last reply Reply Quote 0
                                    • D
                                      dfinjr @stephenw10
                                      last edited by

                                      @stephenw10
                                      It's likely this, from troubleshooting:

                                      0bdfec37-d09f-4f66-be0a-f9b69f7216b1-image.png

                                      Maybe so:
                                      72c194fa-9f03-4796-9e44-05be2bdac071-image.png

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        You shouldn't need that TCP flags setting unless you have an asymmetric route and it would be a lot more broken if you did.

                                        Those blocked packets look like the host at 10.10.0.10 sending acks after the state has closed, which is usually not an issue.
                                        https://docs.netgate.com/pfsense/en/latest/troubleshooting/log-filter-blocked.html#troubleshooting-blocked-log-entries-for-legitimate-connection-packets

                                        D 1 Reply Last reply Reply Quote 0
                                        • D
                                          dfinjr @stephenw10
                                          last edited by

                                          @stephenw10

                                          Recommendation?

                                          @DaddyGo

                                          Almost done with the virtual box vm.

                                          1 Reply Last reply Reply Quote 0
                                          • DaddyGoD
                                            DaddyGo
                                            last edited by DaddyGo

                                            @dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:

                                            Recommendation?

                                            Recommendation!
                                            https://forum.netgate.com/topic/36362/log-shows-tcp-fa-tcp-fpa-blocked-from-lan

                                            Cats bury it so they can't see it!
                                            (You know what I mean if you have a cat)

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.