Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    VMware Workstation VMs Web Traffic Being Blocked

    Scheduled Pinned Locked Moved General pfSense Questions
    221 Posts 6 Posters 50.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      dfinjr @stephenw10
      last edited by

      @stephenw10
      It's likely this, from troubleshooting:

      0bdfec37-d09f-4f66-be0a-f9b69f7216b1-image.png

      Maybe so:
      72c194fa-9f03-4796-9e44-05be2bdac071-image.png

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        You shouldn't need that TCP flags setting unless you have an asymmetric route and it would be a lot more broken if you did.

        Those blocked packets look like the host at 10.10.0.10 sending acks after the state has closed, which is usually not an issue.
        https://docs.netgate.com/pfsense/en/latest/troubleshooting/log-filter-blocked.html#troubleshooting-blocked-log-entries-for-legitimate-connection-packets

        D 1 Reply Last reply Reply Quote 0
        • D
          dfinjr @stephenw10
          last edited by

          @stephenw10

          Recommendation?

          @DaddyGo

          Almost done with the virtual box vm.

          1 Reply Last reply Reply Quote 0
          • DaddyGoD
            DaddyGo
            last edited by DaddyGo

            @dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:

            Recommendation?

            Recommendation!
            https://forum.netgate.com/topic/36362/log-shows-tcp-fa-tcp-fpa-blocked-from-lan

            Cats bury it so they can't see it!
            (You know what I mean if you have a cat)

            1 Reply Last reply Reply Quote 0
            • D
              dfinjr
              last edited by

              any chance any of you would be in for a direct troubleshooting session with me? I feel like I am burning a lot of your time and I was hoping to speed up the process for us all. If so I was thinking I can host a meeting at 11AM EST over gotomeeting if anyone is interested?

              DaddyGoD 1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by stephenw10

                You can try setting the firewall optimisation to conservative in Sys > Adv > Firewall&NAT. That gives you longer state timeouts if it needs that.

                I really wouldn't expect that though.

                If you actually do have some asymmetry there that could explain a number of things. Why you only saw one way traffic on the VMhost NIC for example. But I would expect far more to be broken if that was the case.

                Steve

                1 Reply Last reply Reply Quote 0
                • DaddyGoD
                  DaddyGo @dfinjr
                  last edited by

                  @dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:

                  any chance any of you would be in for a direct troubleshooting session with me?

                  ๐Ÿ˜‰

                  The truth is that we always say here that others learn from what we write here (forum) and can be retrieved for a long time.
                  This is why many people (member) use NoChat/NoPM in their signature

                  Cats bury it so they can't see it!
                  (You know what I mean if you have a cat)

                  1 Reply Last reply Reply Quote 0
                  • D
                    dfinjr
                    last edited by

                    Ok so a few updates have taken place.

                    First of all:
                    @DaddyGo
                    Your virtual box build idea works. All traffic all sites work. Problem is localized to the vm workstation area on that host machine.

                    Firewall to 10.10.0.10:
                    Still failing to register for unknown reasons after adjusting to conservative.

                    on the live session:
                    I'd be happy to do a write up from whatever we wall potentially do in this forum post. My goal was only to let you all see first hand what is happening. Happy to keep it here if that is what you all want. Obviously I do not want to ask anyone to do anything they're not comfortable with.

                    Overall I feel like we're getting close to the answer. We know that the vm workstation virtual switching is part of the problem for sure but are still on the mystery why the Cisco ASA was able to cope and route.

                    This 10.10.0.10 secondary problem is interesting because that is physical > virtual connection where I have that working in a multitude of places outside of that DMZ vlan. A handful of systems are able to effectively do what that DMZ client is failing to do from both the other vlans (labsystems and default)

                    DaddyGoD 2 Replies Last reply Reply Quote 0
                    • DaddyGoD
                      DaddyGo @dfinjr
                      last edited by DaddyGo

                      @dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:

                      but are still on the mystery why the Cisco ASA was able to cope and route.

                      I think the answer is here in the Cisco FW (RFC1191) ๐Ÿ˜‰ :

                      4e006c98-a297-4f07-8c6b-38e7f26bd4e6-image.png

                      +++edit:

                      https://www.cisco.com/c/en/us/td/docs/security/asa/asa96/configuration/general/asa-96-general-config/interface-mtu.html

                      Cats bury it so they can't see it!
                      (You know what I mean if you have a cat)

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        Try to get a pcap of the failing registration session from 10.10.0.10. See what's actually happening there. Seems highly likely it will be something similar. Might be easier to see with all local traffic though.

                        1 Reply Last reply Reply Quote 0
                        • DaddyGoD
                          DaddyGo @dfinjr
                          last edited by DaddyGo

                          @dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:

                          Your virtual box build idea works. All traffic all sites work. Problem is localized to the vm workstation area on that host machine.

                          So then you have to say that it is possible that the rumor is true and there are problems between the i219-v and VMware stuff (hypervisors)

                          +++edit:
                          Yup and you need to open a ticket for this at VMware ๐Ÿ˜‰

                          Cats bury it so they can't see it!
                          (You know what I mean if you have a cat)

                          D 1 Reply Last reply Reply Quote 1
                          • D
                            dfinjr @DaddyGo
                            last edited by

                            @daddygo

                            Son of a gun! Based on what you were saying I dropped the hardwire lan and bumped it over to wifi (just to switch the network interface) and it worked. VM is able to navigate regularly. Color me shocked!

                            Ok, trying to figure out now where I go from here.

                            I still gotta make sure that I can VPN to the lab systems but clearly there is an issue with the hardline network. May be taking a short retail trip to get a usb network adapter just like you mentioned.

                            DaddyGoD 1 Reply Last reply Reply Quote 1
                            • DaddyGoD
                              DaddyGo @dfinjr
                              last edited by DaddyGo

                              @dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:

                              Ok, trying to figure out now where I go from here.

                              It will be difficult because it's a laptop (vm host), hihihi

                              A really good quality USB adapter will help.
                              You rarely hear that from my mouth here on this forum ๐Ÿ˜‰

                              ++++edit:
                              Beware of the Realtek chip, please,....you can save a lot of crying

                              Cats bury it so they can't see it!
                              (You know what I mean if you have a cat)

                              D 2 Replies Last reply Reply Quote 0
                              • D
                                dfinjr @DaddyGo
                                last edited by

                                @daddygo

                                Yeah nothing wants to connect to the Bigfix resources well being on Google Wifi so I think your hardline USB adapter is the place to start. I'll get my hands on that first, test, and let everyone know.

                                1 Reply Last reply Reply Quote 0
                                • D
                                  dfinjr @DaddyGo
                                  last edited by

                                  @daddygo

                                  And just to clarify on the Cisco vs pfsense deal. The reason that the Cisco was able to cope is because of the rfc1191 that Cisco has correct? Is that something that PFSense doesn't support?

                                  BTW thank you all for the great help, beginning to see the lights at the end of the tunnel.

                                  DaddyGoD 1 Reply Last reply Reply Quote 0
                                  • DaddyGoD
                                    DaddyGo @dfinjr
                                    last edited by

                                    @dfinjr said in VMware Workstation VMs Web Traffic Being Blocked:

                                    And just to clarify on the Cisco vs pfsense deal.

                                    Yes it looks very much like that MTU RFC1191 ๐Ÿ˜‰

                                    Cisco is my other big favorite, I've been working with them for 18 years, has a lot of small, sophisticated services for which you pay a lot afterwards

                                    but this does nothing to dampen the greatness of pfSense,
                                    unfortunately pfSense can't do these MTU tricks, but it is better at other things

                                    Cats bury it so they can't see it!
                                    (You know what I mean if you have a cat)

                                    1 Reply Last reply Reply Quote 0
                                    • stephenw10S
                                      stephenw10 Netgate Administrator
                                      last edited by

                                      Hmm, it's hard to imagine pfSense/FreeBSD would break MTU path discovery. Many, many things would be broken by that. Though clearly the path MTU is set far lower with the Cisco in place.

                                      Also that would apply equally to any NIC on the VM host. Unless maybe the wifi NIC itself has a reduced MTU. ๐Ÿค”

                                      DaddyGoD 2 Replies Last reply Reply Quote 0
                                      • D
                                        dfinjr
                                        last edited by

                                        @DaddyGo
                                        Thank you for that clarification! I am CCNA security certified (education and not a ton of real world) but it is all very interesting for me. It is tough to have a small capable/affordable personal Cisco firewall deployment with VPN capabilities. That and they're somewhat difficult to buy and license on an individual scale. Bet you've run into that too.

                                        @stephenw10
                                        I'm very happy to shed any further desired light on the issue. Anything else that I can see/learn in the process is welcomed for sure.

                                        Anything else that I can diagnose/packet capture/etc that would do well for anyone trying to nail this down in the future?

                                        DaddyGoD 1 Reply Last reply Reply Quote 0
                                        • DaddyGoD
                                          DaddyGo @stephenw10
                                          last edited by

                                          @stephenw10 said in VMware Workstation VMs Web Traffic Being Blocked:

                                          Also that would apply equally to any NIC on the VM host.

                                          certainly not break it, just...

                                          Yeah, the trick must be in Cisco ASA FW and its MTU handling, probably more sophisticated

                                          this will soon become clear after a good USB NIC test
                                          BTW:
                                          the vExpert forum is full of Intel i219-v problems

                                          Cats bury it so they can't see it!
                                          (You know what I mean if you have a cat)

                                          D 1 Reply Last reply Reply Quote 0
                                          • DaddyGoD
                                            DaddyGo @stephenw10
                                            last edited by

                                            @stephenw10 said in VMware Workstation VMs Web Traffic Being Blocked:

                                            Unless maybe the wifi NIC itself has a reduced MTU.

                                            I am not a fan of wifi, , but I remember something like this... :)

                                            with (MTU+MAC+Encryp.):

                                            default 802.11 MTU = 2304

                                            • wep = 2346
                                            • wpa2 = 2354

                                            Cats bury it so they can't see it!
                                            (You know what I mean if you have a cat)

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.