Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Can't ping the same IP from multiple devices

    Scheduled Pinned Locked Moved General pfSense Questions
    17 Posts 4 Posters 361 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • patient0P
      patient0 @Bob.Dig
      last edited by patient0

      @Bob-Dig said in Can't ping the same IP from multiple devices:

      @patient0 Interesting. Just checked with the OtherSense, it shows this too, but you already gave that away.

      Yes and it still does work with CE 2.7.2/FreeBSD 14. I think the feature/bug got introduced somewhere along FreeBSD 14.1/14.2 (in pf, ipfw doesn’t have the issue)

      1 Reply Last reply Reply Quote 1
      • patient0P
        patient0 @Bob.Dig
        last edited by patient0

        @Bob-Dig said in [Can't ping the same IP from multiple devices]

        Edit: And checked with another Router, FreshTomato: behaved the same.

        Mmh, that odd since it’s Linux based. I did check with VyOS back then and didn’t hit it. Have to recheck later this week.

        Bob.DigB 1 Reply Last reply Reply Quote 0
        • Bob.DigB
          Bob.Dig LAYER 8 @patient0
          last edited by

          @patient0 said in Can't ping the same IP from multiple devices:

          that odd since it’s Linux based

          But the host was Windows, so I guess, it is somewhat expected. It probably was nice of *Sense, that they had a "mitigation" for this Windows behavior.

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            Yeah if you test from something that's not Windows you'll probably find it works fine. For some reason Windows uses the same ID for all pings. So if you have 1:1 NAT (or static ports outbound NAT) then only one internal system can open a unique state. Linux uses incremental IDs. BSD uses random IDs.

            Bob.DigB 1 Reply Last reply Reply Quote 1
            • Bob.DigB
              Bob.Dig LAYER 8 @stephenw10
              last edited by Bob.Dig

              @stephenw10 said in Can't ping the same IP from multiple devices:

              So if you have 1:1 NAT (or static ports outbound NAT)

              It doesn't seem to be related to that. It has worked in the past (according to the thread) and doesn't right now.

              S 1 Reply Last reply Reply Quote 0
              • S
                SteveITS Galactic Empire @SteveITS
                last edited by

                @SteveITS FWIW it's also an issue pinging the outer/building router from our LAN, so doesn't need to go past the second router.

                I suppose, it mostly only matters as a colossal time waster while troubleshooting, if you don't know of the bug, since it's probably uncommon to see it (more common, the larger the company, I suppose).

                My first time, pinging from a Linux VM, then from Windows, the Windows pings failed. After that I can't seem to reproduce that failure.

                At least that implies we maybe can't trigger a false failure on our monitoring if we happen to ping something at the same time as our monitoring software.

                @stephenw10 We did have static outbound set on the outer/building router...the rule is timestamped 2018 so I don't recall now why I set that. :) But turning that off last night did not change the behavior. It was not set on the inner one.

                Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                Upvote 👍 helpful posts!

                1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by stephenw10

                  1:1 NAT implies static ports so if you have that set you would still hit this.

                  S 1 Reply Last reply Reply Quote 0
                  • S
                    SteveITS Galactic Empire @stephenw10
                    last edited by SteveITS

                    @stephenw10 ah ha, did not realize/remember that.

                    Edit: OK so then few would see this. And in theory port forwarding all ports and configuring outbound NAT, for that VIP, would bypass it?

                    Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                    When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                    Upvote 👍 helpful posts!

                    1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by

                      Yes it would. Though it only affects icmp from Windows so.... it mostly doesn't matter. 😉

                      I remember that blowing my mind when I first saw it. Mostly because Linux clients were unaffected. 😵

                      S 1 Reply Last reply Reply Quote 0
                      • S
                        SteveITS Galactic Empire @stephenw10
                        last edited by

                        I seem to use this pic a lot lately.

                        Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                        When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                        Upvote 👍 helpful posts!

                        1 Reply Last reply Reply Quote 1
                        • S
                          SteveITS Galactic Empire @Bob.Dig
                          last edited by SteveITS

                          @Bob-Dig said in Can't ping the same IP from multiple devices:

                          It doesn't seem to be related to that. It has worked in the past (according to the thread) and doesn't right now.

                          Actually I think you are right, as least as worded. I tried from two Windows PCs at home and can repro it there. Automatic outbound NAT, not static, no 1:1.

                          One can see where the first ping expired:

                          Pinging 8.8.4.4 with 32 bytes of data:
                          Request timed out.
                          Request timed out.
                          Request timed out.
                          Request timed out.
                          Request timed out.
                          Request timed out.
                          Reply from 8.8.4.4: bytes=32 time=18ms TTL=116
                          Reply from 8.8.4.4: bytes=32 time=22ms TTL=116
                          Reply from 8.8.4.4: bytes=32 time=19ms TTL=116
                          Reply from 8.8.4.4: bytes=32 time=19ms TTL=116
                          Reply from 8.8.4.4: bytes=32 time=21ms TTL=116
                          Reply from 8.8.4.4: bytes=32 time=21ms TTL=116

                          Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                          When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                          Upvote 👍 helpful posts!

                          Bob.DigB 1 Reply Last reply Reply Quote 1
                          • Bob.DigB
                            Bob.Dig LAYER 8 @SteveITS
                            last edited by

                            @SteveITS said in Can't ping the same IP from multiple devices:

                            I think you are right

                            I tried it with both Senses and with FreshTomato, without any special OutboundNAT, the outcome was every time the same.

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.