Traceroutes appears to be broken?

gisuck

@stephenw10 from what I can tell, using the mtr package on pfsense and on my windows clients, trace routes do not work. Ping can reach it's destination just fine. Problem exists on both IPv4 and IPv6.

While I did have CoDel installed, I had it disabled and decided to keep it that way since I couldn't account for Speedboost technology from my ISP where my subscription will burst at a higher speed than subscribed for a short period of time.

I still had the rules installed. I just removed those now and still have the problem.

patient0

@stephenw10 for me traceroute -P udp -n 1.1.1.1 does work but traceroute -P icmp -n 1.1.1.1 does not.

No CoDel or any limiters.

Adding a ICMP allow any rule on WAN does make it work (for testing only of course)

Addition: Doesn't work on 2.7.2 CE either without any additional rules. Is it supposed to work? That would also mean that per default the WAN can be pinged from the world, does that make sense?

stephenw10

Ok seeing that here. Digging...

stephenw10

Works fine in 2.7.2 for me. Unless that traffic is going through 25.03.

patient0

@stephenw10 said in Traceroutes appears to be broken?:

Works fine in 2.7.2 for me. Unless that traffic is going through 25.03.

Hehehe, you got a point. The 2.7.2 CE is behind the 25.03 :)

gisuck

So, just to be clear, this does appear to be a problem within 25.03? Just wondering if it was my ISP doing something weird. I thought this worked fine in 24.11, but it's been awhile since I required to do a traceroute to something.

patient0

@gisuck yes it seems to be an issue with 25.03. Works on my prod 24.11 and on a 2.7.2.

The 2.7.2 first was behind the 25.03 and therefore I got the impression it didn't work. But after stephenw10's comment I moved it (behind a VyOS router) and it does work too.

stephenw10

Yup it is. Fix is incoming.

As a test it should work normally in the current public beta is you set 'Firewall State Policy' to Floating States. If it doesn't then you might be hitting something else. Like ISP shenanigans!

patient0

@stephenw10 said in Traceroutes appears to be broken?:

set 'Firewall State Policy' to Floating States

Works excellent if 'Firewall State Policy' is set to 'Floating States'.

Something OT: In the ''Firewall State Policy', in the explanatory paragraph for 'Interface Bound States' are two tiny typo:

" ... If a packet attempts to takes an path through ..."
should be
" ... If a packet attempts to take a path through ..."

Kevin S Pare

This post is deleted!