Verizon CR200a in ip passthrough?
-
Sure so you can specify the size of a ping packet like so:
[24.03-RELEASE][admin@1100-3.stevew.lan]/root: ping -4 -s 1464 pfsense.org PING pfsense.org (208.123.73.68): 1464 data bytes 1472 bytes from 208.123.73.68: icmp_seq=0 ttl=47 time=116.687 ms 1472 bytes from 208.123.73.68: icmp_seq=1 ttl=47 time=116.637 ms 1472 bytes from 208.123.73.68: icmp_seq=2 ttl=47 time=116.924 msThat's actually the largest packet I can send from that device; 1464. That's expected because I have a PPPoE WAN. It does imply something is not passing packet fragments or allowing fragmentation though.
-
@stephenw10 said in Verizon CR200a in ip passthrough?:
root: ping -4 -s 1464 pfsense.org
So when I run that string from an elevated cmd prompt, I get returned:
"Bad value for option -s, valid range is from 1 to 4."
Should I be running this from somewhere other than the typical Windows cmd?EDIT: I figured it out. There was another switch I needed to use in Windows.
Oh, freaky. I can't ping anything above 1400. That may be my issue! Lemme try that...EDIT2: Dang, nope. I forgot to account for the headers, which brought me back to my previous setting of 1428. YouTube still doesn't work. :(
-
Hmm, that still seems quite small. Can you access all sites as expected if you just connect a laptop to the modem directly?
-
@stephenw10 That's what she said. Sorry, too easy. lol
Good Q. I can try in a bit. I'm not sure what will happen, since the modem is in passthrough mode. How will I get an IP address? All other devices (PCs and tablets, laptops, etc..) are all working fine right now, even through the pfsense box and network. It's really only my desktop that appear to be having trouble, I think. I can even spin up a VM that resides on my server, and it connects fine as well.
I went to Vimeo, to see if had anything to do with video streaming in general, and it plays with no problems. It appear to be specifically YouTube.
I'm also noticing problems with the ZeroTier link to my office, when the Verizon ISP is active. If I switch everything back to the old DSL, it all works fine, including YT. -
Hmm, if it's only one LAN host hitting the issue it's probably not anything upstream.
Still feels like it could be an IPv6 issue. Do you see any public IPv6 IPs on the new WAN or on the Windows host?
-
@stephenw10 said in Verizon CR200a in ip passthrough?:
Still feels like it could be an IPv6 issue.
I agree.
@stephenw10 said in Verizon CR200a in ip passthrough?:
Do you see any public IPv6 IPs on the new WAN or on the Windows host?
Where would that be? I checked Status -> DHCPv6 leases and it's empty, but I suspect that's LAN, right? I'm not sure where to look for v6 public IPs.
EDIT: I logged into the modem and totally disabled IPv6. No change. :/
I did notice that the MTU is specified in the modem settings as 1500, but if i try to ping that, I get 100% packet loss. I can't ping above 1400. -
Can you test that ping from any other device?
-
@stephenw10 Sure. I hit it from my wife's desktop, which is connected through the exact same network and everything, with the exception of being wireless LAN. She also can only ping up to 1400 MTU. I also discovered that her machine can't access YouTube either! So it's not just my machine, it does appear to be network-wide, or at least common to windows machines. My iPad doesn't seem to have any trouble playing videos. My Android phone works fine as well.
-
@Elmojo said in Verizon CR200a in ip passthrough?:
That's what she said
Packet size isn't everything.
But I would try adding a policy routing rule for your desktop source IP on LAN via the other WAN. That would rule out any DNS issues. And anything IPv6.
-
@stephenw10 said in Verizon CR200a in ip passthrough?:
But I would try adding a policy routing rule for your desktop source IP on LAN via the other WAN
I love how you toss that out like I have any idea what that means, or how to do it.
-
Well I try not to make it too easy!
But basically add a firewall rule on the LAN above the default pass rule that matches only you test host as source Then on that rule set the old WAN gateway specifically.
https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html
-
Like:
-
@stephenw10 One thing you didn't mention... is this a pass or block rule? Am I trying to allow all traffic specifically from the old DSL WAN, or block it? I'm not clear on the point of this rule, sorry. If I set the WANDHCP (DSL) back to the default routing gateway, then everything works, including YT and my ZeroTier link. If I disable that gateway and use the Verizon one, things go awry. Can you please clarify what this test will tell us? I'm going it now, I just don't fully follow...
-
It's a pass rule. The green tick in the table indicates it's pass.
You are trying to send traffic from only your test desktop machine via the old WAN, whilst all other traffic from LAN hosts uses the default gateway which is the new WAN.
Then if youtube starts working we know it's somehow because of the new WAN. Or the routing to it.
-
@stephenw10 Oh, Duh. I missed the green check.
So while running this rule, I need to have the Verizon gateway set back as default then?EDIT: Confirmed. With the rule in place, and the Verizon gateway set as default, my desktop works...sorta. Youtube videos play, but my ZeroTier tunnel is still broken. I suspect because maybe it's not TCP traffic?
On my wife's desktop, YT does not work, as expected. -
The rule should route all traffic unless you specifically set it for TCP only.
Interesting. Do you see any unexpected blocked traffic in the firewall logs?
-
@stephenw10 Your example showed TCP only, and that's the default, so I assumed that was the correct option. Should I change it to "any"?
@stephenw10 said in Verizon CR200a in ip passthrough?:
Do you see any unexpected blocked traffic in the firewall logs?
I guess it depends on what you mean by 'unexpected'. I have no idea I'm looking at, so it's all unexpected to me. lol
Seriously, though, I have to revert my settings to default back to the DSL between messages, so that my whole network isn't unusable and my wife kills me. ;)
Let me go try it an see what happens and I'll post a screenshot. You can tell me what you see... -
@stephenw10 said in Verizon CR200a in ip passthrough?:
Do you see any unexpected blocked traffic in the firewall logs?
This does look suspicious. It appears to pop up when I attempt to open a ZeroTier session.
I know my IP is visible. There are just too many to redact. :/
-
@Elmojo said in Verizon CR200a in ip passthrough?:
Your example showed TCP only,
Doh! So it did. Yeah set that to any protocol and retest.
-
@stephenw10 I did. The image above is with it set to "any".
