Single Website Blocked
-
I recently moved to a different state and now have a different ISP and discovered I can no longer access a website from inside my network. Wondering if someone might be able to help me out.
Website: https://www.idrive.com/
I don't believe I changed much of anything between after moving to the new home in the pfSense config. I worked with the ISP (Google Fiber) and they sat down with me to tinker a bit and determined it was an issue with my router and nothing they were blocking. I can access the site no problem when I'm connected via VPN, using NordVPN. This is my temporary workaround currently.
Ping times out from my system on the LAN and from the pfSense box. I am able to get a tracert going.
pfSense Version:
Version 2.7.0-RELEASE (amd64)
built on Wed Jun 28 03:53:34 UTC 2023
FreeBSD 14.0-CURRENTpfSense Box CPU:
Intel(R) Celeron(R) CPU J1900 @ 1.99GHz
4 CPUs: 1 package(s) x 4 core(s)
AES-NI CPU Crypto: No
QAT Crypto: NopfSense Box HDD: 50G and only used 1.2G
I have a bunch of packages installed but all where installed prior, including pfBlockerNG-devel. Can't get to the site if this is enabled or disabled.
I followed the Wizard for Traffic Shaping as well.
I know my way around things, but am no expert, especially when it comes to networking. I've had this pfSense system for years and slow add/update it as needed, but haven't really done anything for awhile. Let me know logs or screenshots you may need and how to access them.
Thanks in advance for any help.
-
@kaysersosa said in Single Website Blocked:
https://www.idrive.com/
Loads fine here.. How did they determine it was your router exactly?
That site doesn't answer ping, but it loads just fine.
What does it resolve to for you?
C:\>dig www.idrive.com +short 148.66.234.46 C:\>dig @8.8.8.8 www.idrive.com +short 148.66.234.46So here is the thing.. If it resolves to the correct IP, and you try and open it - pfsense would pass on your SYN to its next hop to open a connection.. Once that syn leaves pfsense, its no longer up to your router if you get a response..
Its possible the site just blocks your IP or network, etc.. Or it could be a routing problem upstream of you with your isp, or even with the peer connection to the rest of the internet from your isp. But once the traffic leaves pfsense wan, getting a response is out of the hands of pfsense.
So do a simple sniff on your wan when you try and go there. If you see the syn, with pfsense wan IP as the source and you do not get an answer - how is that pfsense(your routers) problem?
When you do a trace to that IP do you get past pfsense in the trace? Look in your pfsense state table for that destination IP.. Or as said you could actually do a packet capture in pfsense to validate pfsense is sending on the SYN..
-
===@johnpoz said in Single Website Blocked:
How did they determine it was your router exactly?
Traceroute was the main thing they checked. They did a couple of others things, but don't fully remember, it has been at least a month or more. Don't believe they said it was my router exactly but that they were not blocking anything.
Here is what I get from ping and tracert from my system in my LAN.
C:\WINDOWS\system32>ping www.idrive.com
Pinging www.idrive.com [148.66.234.46] with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.Ping statistics for 148.66.234.46:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),C:\WINDOWS\system32>tracert www.idrive.com
Tracing route to www.idrive.com [148.66.234.46]
over a maximum of 30 hops:1 <1 ms <1 ms <1 ms pfSense-kayserhome.localdomain [10.7.13.1]
2 1 ms 1 ms 1 ms 10.26.0.114
3 * * * Request timed out.
4 1 ms 1 ms 1 ms 23-255-224-203.mci.googlefiber.net [23.255.224.203]
5 2 ms * * e0-61.core2.mci3.he.net [184.105.39.117]
6 2 ms 2 ms 2 ms kanc-b2-link.ip.twelve99.net [213.248.81.53]
7 * * 2 ms kanc-bb2-link.ip.twelve99.net [62.115.138.74]
8 * 12 ms * dls-bb2-link.ip.twelve99.net [62.115.139.189]
9 12 ms 11 ms 12 ms dls-b23-link.ip.twelve99.net [62.115.138.65]
10 21 ms 22 ms 22 ms flexential-ic-350576.ip.twelve99-cust.net [62.115.183.13]
11 57 ms 57 ms 56 ms be24.bbrt02.dal01.flexential.net [148.66.237.226]
12 57 ms 57 ms 57 ms be106.bbrt01.las03.flexential.net [66.51.7.70]
13 57 ms 57 ms 57 ms be10.bbrt02.las03.flexential.net [66.51.7.90]
14 57 ms 56 ms 57 ms be154.bbrt02.lax10.flexential.net [148.66.236.3]
15 57 ms 57 ms 57 ms be10.bbrt01.lax10.flexential.net [148.66.236.4]
16 57 ms 57 ms 57 ms be153.bbrt02.pdx02.flexential.net [148.66.236.0]
17 57 ms 57 ms 57 ms be32.crrt02.pdx02.flexential.net [66.51.6.134]
18 56 ms 57 ms 56 ms v62.rtsw06.viawest.net [66.51.6.122]
19 * * * Request timed out.
20 * * * Request timed out.
21 * * * Request timed out.
22 * * * Request timed out.
23 * * * Request timed out.
24 * * * Request timed out.
25 * * * Request timed out.
26 * * * Request timed out.
27 * * * Request timed out.
28 * * * Request timed out.
29 * * * Request timed out.
30 * * * Request timed out.Trace complete.
-
@kaysersosa said in Single Website Blocked:
So see once you get past your network.. look at hop 4 for example that is inside your isp network, and next hop is past your isp googlefiber network from the name returned.
So you have left your network - the traffic not getting to the destination or return back to you is outside your control.
So how is your router? now traceroute is not going to be sending traffic to port 80 or 443.. Unless you called that out with your traceroute that does tcp.. like that linux it is just tcptraceroute, I think you can do it on windows if you have winpcap library installed.
But you see traffic get past your pfsense in a traceroute then its not pfsense blocking to that IP.. If you do a tcp trace with a port, or do a simple packet capture and see it leave pfsense.. Then its not a pfsense issue..
-
What error do you see when you try to access it from a browser?
Try running a port test to it on 443 from pfSense in Diag > Test Port.
Steve
-
I just remember that when I was on with the Google Fiber tech. He had me unplug my router and connect directly to their network. I was able to access the site without issue.
-
This is the PING and TRACERT from directly connected to the ISP connection.
Trace complete.ISP ping-tracert.txt
-
That appears to be exactly the same as from the pfSense LAN. Neither are good tests because the end server doesn't respond to either icmp or the udp traceroute packets.
Try this:
-
@kaysersosa said in Single Website Blocked:
He had me unplug my router and connect directly to their network. I was able to access the site without issue.
And did this change your IP? With a cable modem that would for sure.. I assume it would because your mac changed and you would get a different IP from the isp..
Clone the mac of your pc, and let pfsense wan grab a new IP via dhcp.. or just alter your mac a bit so it grabs a new IP.
If the traffic leaves pfsense - its not pfsense issue.. There isnt going to be much difference in that test port test.. Other than a way to test to a port without a browser, etc..
-
@stephenw10 I get a Connection failed.
-
Yeah if the site refuses even a syn from your IP it's not pfSense filtering and it's not an MTU issue so check your IP in the two situations. I'd bet it's got onto some blacklist the destination server is filtering.
-
@stephenw10 I show the IP he connects to forum with from googlefiber on these 2 lists.
