pfSense mangling packets?
-
@stephenw10 Can you elaborate? I've changed to MTU settings and left all the boxes empty.
-
@Tueem well pfsense doesn't "mangle" traffic.. And if it was then you would be having way more issues than just this one thing that runs something other than actual https over the standard 443 port.
Not sure what you were doing when you sniffed that - was that during your curl test? But the server sent you a fin, so he told you he was done..
I don't play minecraft, but I guess I could try fire it up.. Do I need to create an account at some specific site so it will talk to this 13.x address? That 13.x address is owned by MS.. Prob some service hosted in azure..
What is the exact error you get when you try and play minecraft? I know my grandkids have played it on their phones while they have been here over my wifi, and they had no issues.
-
@Tueem said in pfSense mangling packets?:
Can you elaborate?
Well it's hard to see from a picture of the pcap text but it looks like it's only seeing small packets. In an established TCP connection I'd expect to see large packets at the path MTU size. So at least 1400 for most connections.
If you do not see that in the full pcap then you might have an MTU issue somewhere.
-
@stephenw10 while I agree when your moving data your packets should get bigger.. But that 13.x box sends a fin right way, all we are seeing there is the handshake.
-
@johnpoz Yeah the tcpdump output was during the curl.
After further investigation I figured out that that 13.x address is the one that minecraft.net resolves to.
I host a paper-1.8 server that runs through a Wireguard VPN and when I try to connect it just tells me that the authentication servers are down. I got the IP by sniffing the firewall logs and looking for IPs my server tried to connect to.
On my PC which doesn't go through the VPN it connects fine. (I can confirm its not an issue of the VPN because if I use the official wireguard client directly it connects just fine.) -
@Tueem said in pfSense mangling packets?:
I can confirm its not an issue of the VPN because if I use the official wireguard client directly it connects just fine.
Like from the server directly?
-
@stephenw10 From my PC directly yes
-
Hmm, same server I assume?
Where did you run the pcap from above?
Does it show a similar failure when actually looking for the traffic to the minecraft auth server?
-
@stephenw10 Yes the same Wireguard endpoint and same IP all the same.
The test above is from tcpdump on the pfsense box using the lan nic.
I've attached the tcpdump on the same interface which happens when i try to connect to the server (not curling)
NOTE: The IP of minecraft.net has changed but the behaviour stays the same
-
@Tueem here he is sending you a reset.. Which is not hey I am done with this conversation (fin).. He is saying GO AWAY I am done talking to you, I don't care if you still want to continue the conversation or not.
-
@Tueem I've attached the traffic of a successfull authentication. I acquired this by routing the server through my usual wan temporarily.
-
Try capturing on the WG interface and make sure it's all passing that way.
-
@stephenw10 Here is the traffic through the wg0 interface:
-
@Tueem and at the end there RESET.. what error are you getting in the client.. does it give an error code?
I tried run it on my pc, but running into something with my ms store account and the account one of my grandkids must of used at one time on my pc..
Is that the error you getting?
I show these connections to ms licensing server - but its not the IP you were talking about
Not exactly sure? why the launcher is not working - even if I don't own the game.. There has got to be some sort of free thing? If I get a chance will fire it up on my phone where I can test like your saying it works when not behind pfsense.
But minecraft is a pretty popular game - if there was something in pfsense out of the box that broke it, I would assume the forums would be on fire about it.
-
@johnpoz No the error I'm getting is this on:
Its the server which can't connect to the mojang authentication servers and thus not being able to verify my username.Could it be some issue with the wireguard client maybe?
I've now tried connecting to another vpn I set up on my own on a vps and the issues are the same.My Client which doesn't run through the VPN works like a charm and even the server if i route it through the WAN.
I would guess its a pretty rare scenario having a home server which you are hosting your own server on and trying to do it through a VPN.
-
@Tueem said in pfSense mangling packets?:
having a home server which you are hosting your own server on and trying to do it through a VPN.
Dude none of this at all mentioned in your OP..
If there is no vpn, and no server your running on your own network - everything works.. Where is your client out on the internet somewhere vpn'd to your pfsense and trying to talk to a server your hosting?
-
Hmm, and it also worked when you ran the WG client on the server directly, passing all traffic across it?
It's possible they don't want traffic using VPNs and have included things to detect it like Netflix etc. Though I'm not sure why they would.
-
@stephenw10 could have some sort of split tunnel thing going on, his sniff on the wan if was routed through a vpn would be seeing traffic to the vpn endpoint, not some MS IP that 13 address from his wan.
Could be its sending reset because hey your IP is different than what it should be for whatever connection is being made from some other IP, etc.
-
@johnpoz Yeah I'm sorry it was pretty weird at first and the connections were also blocked through wan, but this apparently resolved itself. Thats why I brought it up later.
Im gonna try to explain my setup again.
I have a home server and a VPN from a provider which is assigned to a static IP.
That way Im trying to have my server available through that VPN IP and all the traffic from my home server should ONLY get routed through the VPN. It should never hit my WAN so that way the server has no association with my WAN IP.
All other services I tried work. I had game servers for other games to which I could connect fine and web servers also work fine. Its just the Minecraft IP which has problems.
But like stephenw10 said I tried it by using the VPN directly using the official desktop WIN10 Wireguard client and it connected fine, which is why I don't think its any VPN detection or blocking necessarily. -
And just to be clear that WG client is actually running on the same server? The 'server' in this case is a Windows box?
