pfSense mangling packets?
-
@stephenw10 Yes the same Wireguard endpoint and same IP all the same.
The test above is from tcpdump on the pfsense box using the lan nic.
I've attached the tcpdump on the same interface which happens when i try to connect to the server (not curling)
NOTE: The IP of minecraft.net has changed but the behaviour stays the same
-
@Tueem here he is sending you a reset.. Which is not hey I am done with this conversation (fin).. He is saying GO AWAY I am done talking to you, I don't care if you still want to continue the conversation or not.
-
@Tueem I've attached the traffic of a successfull authentication. I acquired this by routing the server through my usual wan temporarily.
-
Try capturing on the WG interface and make sure it's all passing that way.
-
@stephenw10 Here is the traffic through the wg0 interface:
-
@Tueem and at the end there RESET.. what error are you getting in the client.. does it give an error code?
I tried run it on my pc, but running into something with my ms store account and the account one of my grandkids must of used at one time on my pc..
Is that the error you getting?
I show these connections to ms licensing server - but its not the IP you were talking about
Not exactly sure? why the launcher is not working - even if I don't own the game.. There has got to be some sort of free thing? If I get a chance will fire it up on my phone where I can test like your saying it works when not behind pfsense.
But minecraft is a pretty popular game - if there was something in pfsense out of the box that broke it, I would assume the forums would be on fire about it.
-
@johnpoz No the error I'm getting is this on:
Its the server which can't connect to the mojang authentication servers and thus not being able to verify my username.Could it be some issue with the wireguard client maybe?
I've now tried connecting to another vpn I set up on my own on a vps and the issues are the same.My Client which doesn't run through the VPN works like a charm and even the server if i route it through the WAN.
I would guess its a pretty rare scenario having a home server which you are hosting your own server on and trying to do it through a VPN.
-
@Tueem said in pfSense mangling packets?:
having a home server which you are hosting your own server on and trying to do it through a VPN.
Dude none of this at all mentioned in your OP..
If there is no vpn, and no server your running on your own network - everything works.. Where is your client out on the internet somewhere vpn'd to your pfsense and trying to talk to a server your hosting?
-
Hmm, and it also worked when you ran the WG client on the server directly, passing all traffic across it?
It's possible they don't want traffic using VPNs and have included things to detect it like Netflix etc. Though I'm not sure why they would.
-
@stephenw10 could have some sort of split tunnel thing going on, his sniff on the wan if was routed through a vpn would be seeing traffic to the vpn endpoint, not some MS IP that 13 address from his wan.
Could be its sending reset because hey your IP is different than what it should be for whatever connection is being made from some other IP, etc.
-
@johnpoz Yeah I'm sorry it was pretty weird at first and the connections were also blocked through wan, but this apparently resolved itself. Thats why I brought it up later.
Im gonna try to explain my setup again.
I have a home server and a VPN from a provider which is assigned to a static IP.
That way Im trying to have my server available through that VPN IP and all the traffic from my home server should ONLY get routed through the VPN. It should never hit my WAN so that way the server has no association with my WAN IP.
All other services I tried work. I had game servers for other games to which I could connect fine and web servers also work fine. Its just the Minecraft IP which has problems.
But like stephenw10 said I tried it by using the VPN directly using the official desktop WIN10 Wireguard client and it connected fine, which is why I don't think its any VPN detection or blocking necessarily. -
And just to be clear that WG client is actually running on the same server? The 'server' in this case is a Windows box?
-
@stephenw10 if I run it through the server the connection works. But it should run on pfsense and the server should get its traffic policy routed to the vpn. thats where the issues exists
-
Yup I just wanted to be sure you weren't testing that on some other Windows client.
Are you policy routing all traffic from that server over the VPN? Including DNS?
-
@stephenw10 another prime x-y problem example
-
@stephenw10 No DNS is going over pfsense but I've set cloudflare and google dns. But except that all other traffic is routed through vpn
-
@Tueem said in pfSense mangling packets?:
No DNS is going over pfsense
This can cause issues with stuff that is hosted in CDNs.. where you have one part of system pulling a dns from region X dns, and maybe the other end pulling from region Y.. And then for what your trying to do there ends of being a disconnect in who ends up talking to who up in the cloud, or talking from a different region that what is expected, etc.
-
Mmm, when you run the VPN client on the host I imagine it routes all traffic over the VPN and likely resets the host to se the VPN providers DNS. You should be able to check that on the host.
I would try setting the DNS on the server to the same thing the VPN clients sets it to and then policy route all traffic from it over the VPN.
-
@stephenw10 That didn't help unfortunately
-
What might also be interesting is that TLS handshakes with some sites (according to firefox) take very long through the vpn and cause a timeout.
