Unable to ping a specific public ip when using pfsense not when bypass.
-
@johnpoz
I agree the whole thing is strange, I see the ping go I do not see reply, but would pfsense not have to pass the reply back? You can ping that ip on pfsense right? If i put my cisco rv042 back in place i can ping and get replies when i put pfsense in i can't. That is what i find strange. -
Do you see the same public IP in use when using the Cisco though?
-
@okjello said in Unable to ping a specific public ip when using pfsense not when bypass.:
I see the ping go I do not see reply
Pfsense can not pass back what it doesn't get.. Now if you saw the ping go out, and saw the reply in your sniff but your client didn't get it - then that would be super odd.. But sniffing and see sent, and no reply just means you didn't get a reply, and nothing pfsense can do about that.
-
@stephenw10
I think so but will have to double check. I will get back to you -
Very good point, I did check again and results same packet out not not in.
-
@stephenw10
Correct not the same public ip, similar but different ending or host ip. -
Ah, OK. Try spoofing the WAN MAC of the Cisco in the pfSense WAN interface setup. It should then get the same IP and not be blocked.
Steve
-
@stephenw10 another option would be to just flip the interfaces so use the LAN interface as the wan and the wan interface as lan - this will give you different mac and different IP from your isp then the one that is not working.
But just spoofing the mac prob simpler solution to test.
-
It has been a long day so hoping this makes sense, so please bare with me.
I plugged laptop directly into modem and i got public ip different then pfsense was getting, similar but different laptop got 64.x.x.200 pf sense was 64.x.x.35
This kinda makes sense i guess, I would have thought my public was assigned based on the cable modem mac ??So when i plugged into cable modem with laptop this time I didn't get a reply to the 138 problem ip. I know I did last time I tested as I have pic of a tracert completing.
So I did power cycle the cable modem this time, and I'm honestly not sure if I did that before i tested with laptop or after.
So this proves to me that pfsense is not the issue as you said all along.
Now thinking maybe an isp / modem thing I pushed the reset on cable modem, now my wan public ip is 192.248.195.5 so i need to go plug into modem again and see if there is now a local configurable web page or something.
The best part is pfsense must have noticed this private ip as it unchecked the "Block private networks" on the wan interface.I thought I would reconfigure my pfsenses interfaces so the usb nic was now lan and onboard nic now wan, so opposite. Why well just for the sake of change and to see if wan change based on wan nic mac.
so after all of this with pfsense using a 192 as public i can ping the problem 138 and get reply.
packet capture shows the modem replying, so no longer in transparent nat mode i guess.
20:26:23.789157 IP 192.248.195.5 > 192.248.195.1: ICMP echo request, id 53692, seq 14128, length 9
20:26:23.809728 IP 192.248.195.1 > 192.248.195.5: ICMP echo reply, id 53692, seq 14128, length 9I never configured the modem it came in nat mode, it has 1 lan port. This company Citywide resells the local bigger company {eastlink} cable service.
So why my ciscorv042 router never had the issue and pfsense did im not sure i assume something wonkey with the nat on the cable modem? Unless im missing something and that in entirely possible!
Hopefully me next reply will be i reconfigured the cable modem and all is well?...
Thanks again for all the help and pointers.
-
192.248.x.x is not a private IP. It looks like you got a new public IP and it's not blocked.
Probably the game server is running some blacklist blocking and the previous IP pfSense was getting was on one of them.
Steve
-
@stephenw10
ahh right its 192.248... sounds about right then.
thanks everyone for help, I didn't check but was thinking i was double routered there for a min. -
@okjello said in Unable to ping a specific public ip when using pfsense not when bypass.:
192.248
The first half of that network atleast shows in LK, are you in Sri Lanka?
-
Interesting, I’m in Nova Scotia, Canada
