Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Strange issue with IPv4 packet fragmentation

    Scheduled Pinned Locked Moved General pfSense Questions
    ipv4fragmentation
    13 Posts 8 Posters 1.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      ChrisJenk @JKnott
      last edited by

      @JKnott I have the same rules and ICMP traffic (v4 and v6) flows freely. The more I think about it the more I think that the Cloudflare test may be somewhat flawed (which would be unusual for them).

      1 Reply Last reply Reply Quote 0
      • S
        Squuiid
        last edited by

        I get the same for both IPv4 and 6…

        ICMP path MTU packet delivery
        ✓ All good! ICMP path MTU message was successfully delivered to you.

        And

        IP fragmented packet delivery
        ✗ The request timed out. Looks like IP fragments failed to be delivered to you.

        C 1 Reply Last reply Reply Quote 0
        • C
          ChrisJenk @Squuiid
          last edited by

          @Squuiid UPDATE: Since changing my ISP several weeks ago (no change to pfSense configuration) both tests now work for me. So whatever may original problem with IPv4 was, it seems it was probably something to do with my ISP's network...

          1 Reply Last reply Reply Quote 1
          • A
            adude42069
            last edited by adude42069

            Got the same issue, except I get the same result on both IPv4 and IPv6.

            I even added the same rule as JKnott

            @JKnott said in Strange issue with IPv4 packet fragmentation:

            0ba8cdde-2104-4a1a-a11f-283f12218e2b-image.png

            but no difference. Is it safe to say it's ISP related? Using their mobile network, the issue could not be reproduced, as all tests succeed. This could also mean their mobile network is configured correctly and their fixed internet is not, idk.

            Firewall was also temporably disabled on the host. The tests were also performed with an android device, exact same issue. First test passes (v4 + v6), second tests fails (v4 + v6).
            It's very weird. Am I missing something, or am I overthinking it? Simply opening ICMP is all that's needed?

            Thank you

            johnpozJ 1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator @adude42069
              last edited by

              @adude42069 You really shouldn't have to open up all of icmp.. I don't have all open, only echo.

              And no rules should be required to be honest.. The required rules for IPv6 are hidden and allowed look in your /tmp/rules.debug to see them.

              You have an isp issue.. Unless you have really jacked up something in the config. Because it should work out of the box for fragmented packets. Have you messed with Firewall Maximum Fragment Entries, in the advanced firewall & nat section?

              I just ran that test and works just fine..

              " All good! IP fragments were successfully delivered to your host."

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              A 1 Reply Last reply Reply Quote 1
              • A
                adude42069 @johnpoz
                last edited by adude42069

                @johnpoz said in Strange issue with IPv4 packet fragmentation:

                @adude42069 You really shouldn't have to open up all of icmp.. I don't have all open, only echo.

                To be more precise, I added that rule temporarely for testing, but removed it afterwards.

                @johnpoz said in Strange issue with IPv4 packet fragmentation:

                And no rules should be required to be honest.. The required rules for IPv6 are hidden and allowed look in your /tmp/rules.debug to see them.

                Did not know they were hidden rules. Will look into that, thanks!

                @johnpoz said in Strange issue with IPv4 packet fragmentation:

                Have you messed with Firewall Maximum Fragment Entries, in the advanced firewall & nat section?

                Not that I know of. I planned to rebuild my config "soon", as it was just upgrade after upgrade from 2.3 or something, but I did not actively change those settings.
                These are the current settings:
                packet processing settings screenshot

                @johnpoz said in Strange issue with IPv4 packet fragmentation:

                " All good! IP fragments were successfully delivered to your host."

                just to confirm, both IPv4 and IPv6? Besides that, thanks for testing.

                johnpozJ 1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @adude42069
                  last edited by johnpoz

                  @adude42069 said in Strange issue with IPv4 packet fragmentation:

                  just to confirm, both IPv4 and IPv6? Besides that, thanks for testing.

                  worksipv6.jpg

                  And I use a HE tunnel for my IPv6

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  A 1 Reply Last reply Reply Quote 1
                  • A
                    adude42069 @johnpoz
                    last edited by

                    @johnpoz said in Strange issue with IPv4 packet fragmentation:

                    And I use a HE tunnel for my IPv6

                    Thank you. I will look into this with my ISP

                    1 Reply Last reply Reply Quote 0
                    • JonathanLeeJ
                      JonathanLee
                      last edited by

                      It will fragment if the MTU is to large

                      Make sure to upvote

                      1 Reply Last reply Reply Quote 0
                      • C
                        chrcoluk
                        last edited by chrcoluk

                        This post is deleted!
                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.