Unable to ping a specific public ip when using pfsense not when bypass.
-
I just tried to ping while using Surfshark vpn and I can ping. Thank kinda makes sense.
I will try packet capture and see
-
@okjello
So this is my Lan side, 10.1.0.45 my pc, the 172 was a google ping
I do not see replies from 138.197.130.124.21:10:24.039494 IP 10.1.0.45 > 172.217.13.163: ICMP echo request, id 1, seq 11068, length 40
21:10:24.065435 IP 172.217.13.163 > 10.1.0.45: ICMP echo reply, id 1, seq 11068, length 40
21:10:24.774889 IP 10.1.0.45.55445 > 142.251.16.189.443: UDP, length 33
21:10:24.818331 IP 142.251.16.189.443 > 10.1.0.45.55445: UDP, length 26
21:10:25.050849 IP 10.1.0.45 > 172.217.13.163: ICMP echo request, id 1, seq 11069, length 40
21:10:25.081907 IP 172.217.13.163 > 10.1.0.45: ICMP echo reply, id 1, seq 11069, length 40
21:10:25.531754 IP 10.1.0.45.59249 > 172.253.63.188.5228: tcp 1
21:10:25.576188 IP 172.253.63.188.5228 > 10.1.0.45.59249: tcp 0
21:10:26.363807 IP 10.1.0.45 > 138.197.130.124: ICMP echo request, id 1, seq 11070, length 40
21:10:26.424892 IP 10.1.0.45.55445 > 142.251.16.189.443: UDP, length 33
21:10:26.468575 IP 142.251.16.189.443 > 10.1.0.45.55445: UDP, length 26
21:10:27.249660 IP 10.1.0.45.59292 > 172.217.13.197.443: tcp 1 -
@okjello sniff on your WAN!!
Do you see the echo request go out? Its that simple - yes or no? You said you can ping google, so why would you would think showing us that?
-
@okjello Is the IP address you're trying to ping the specific monitoring IP address for the Bypass Gateway?
-
@okjello said in Unable to ping a specific public ip when using pfsense not when bypass.:
WAN icmp 64.66.xxx.xx:44889 (10.1.0.45:1) -> 138.197.130.124:44889 0:0 8 / 0 480 B / 0 B
If your showing state then that means it went outbound - if it went outbound and you don't get a response that has ZERO to do with pfsense.
You plugging a different device into a cable modem gets you a different IP.. Because your mac changes.
I want you to sniff on pfsense wan so you see the traffic go out for yourself.. This isn't a pfsense issue.. This is upstream.
Just think for 2 seconds.. What thing could be wrong on a clean install to some IP, but every other IP works..
-
@okjello said in Unable to ping a specific public ip when using pfsense not when bypass.:
Normally I would think my public ip is being blocked etc but i can unplug the uplink from cable modem to pfsense and plug my computer directly into cable modem and i can ping that ip all day long.
Are you sure the public IP is the same in both situations?
-
@stephenw10 said in Unable to ping a specific public ip when using pfsense not when bypass.:
Are you sure the public IP is the same in both situations?
Tell you right now they are not.. Why would a dhcp server give a different mac the same IP?
He shows pfsense having a public IP in his wan state.. In what scenario would different macs from a dhcp server get the same IP?
What makes more sense - IP X blocked by this server, or pfsense just deciding to not work on some random IP, but creates the outbound traffic, as you can see via the state..
-
Yup that seems most likely. Though you would think the laptop running pfSense would also get a different IP and be able to connect. Just unlucky maybe....
-
@stephenw10 where did he say he used a different laptop then previous? He just telling you what he is running pfsense on, and that he reinstalled it.
He didn't say he changed the nic being plugged into the cable modem..
-
Ah, yes, I may have misread that.
-
@stephenw10 If I was handicapping this - just a blocked IP would be the super-duper AAA 5 Star lock of the decade.. While odds of it being pfsense would be the long shot of the century.. Like betting your Shetland pony is going to win the Kentucky derby ;) Make that not just the derby but the whole triple crown ;)
-
@johnpoz
I agree the whole thing is strange, I see the ping go I do not see reply, but would pfsense not have to pass the reply back? You can ping that ip on pfsense right? If i put my cisco rv042 back in place i can ping and get replies when i put pfsense in i can't. That is what i find strange. -
Do you see the same public IP in use when using the Cisco though?
-
@okjello said in Unable to ping a specific public ip when using pfsense not when bypass.:
I see the ping go I do not see reply
Pfsense can not pass back what it doesn't get.. Now if you saw the ping go out, and saw the reply in your sniff but your client didn't get it - then that would be super odd.. But sniffing and see sent, and no reply just means you didn't get a reply, and nothing pfsense can do about that.
-
@stephenw10
I think so but will have to double check. I will get back to you -
Very good point, I did check again and results same packet out not not in.
-
@stephenw10
Correct not the same public ip, similar but different ending or host ip. -
Ah, OK. Try spoofing the WAN MAC of the Cisco in the pfSense WAN interface setup. It should then get the same IP and not be blocked.
Steve
-
@stephenw10 another option would be to just flip the interfaces so use the LAN interface as the wan and the wan interface as lan - this will give you different mac and different IP from your isp then the one that is not working.
But just spoofing the mac prob simpler solution to test.
-
It has been a long day so hoping this makes sense, so please bare with me.
I plugged laptop directly into modem and i got public ip different then pfsense was getting, similar but different laptop got 64.x.x.200 pf sense was 64.x.x.35
This kinda makes sense i guess, I would have thought my public was assigned based on the cable modem mac ??So when i plugged into cable modem with laptop this time I didn't get a reply to the 138 problem ip. I know I did last time I tested as I have pic of a tracert completing.
So I did power cycle the cable modem this time, and I'm honestly not sure if I did that before i tested with laptop or after.
So this proves to me that pfsense is not the issue as you said all along.
Now thinking maybe an isp / modem thing I pushed the reset on cable modem, now my wan public ip is 192.248.195.5 so i need to go plug into modem again and see if there is now a local configurable web page or something.
The best part is pfsense must have noticed this private ip as it unchecked the "Block private networks" on the wan interface.I thought I would reconfigure my pfsenses interfaces so the usb nic was now lan and onboard nic now wan, so opposite. Why well just for the sake of change and to see if wan change based on wan nic mac.
so after all of this with pfsense using a 192 as public i can ping the problem 138 and get reply.
packet capture shows the modem replying, so no longer in transparent nat mode i guess.
20:26:23.789157 IP 192.248.195.5 > 192.248.195.1: ICMP echo request, id 53692, seq 14128, length 9
20:26:23.809728 IP 192.248.195.1 > 192.248.195.5: ICMP echo reply, id 53692, seq 14128, length 9I never configured the modem it came in nat mode, it has 1 lan port. This company Citywide resells the local bigger company {eastlink} cable service.
So why my ciscorv042 router never had the issue and pfsense did im not sure i assume something wonkey with the nat on the cable modem? Unless im missing something and that in entirely possible!
Hopefully me next reply will be i reconfigured the cable modem and all is well?...
Thanks again for all the help and pointers.
