Issues with internet connectivity only for linux systems on a subnet
-
How exactly are you doing that?
i go to the interface as seen in the image below, and without making any changes i click save at the bottom of the page
and this makes the interface "refresh". So basically without making any changes the linux systems are conencted to the internet.
After they regain connectivity what happens to make it fail again?
The linux hosts lose connectivity after this if they are rebooted or their networkmanager is rebooted.
When they are unable to connect what error is shown if, for example, you try to ping pfsense.org?
no error when pinging pfsense.org, it is not even starting in fact (i havent tried that in the past) which means that it cannot find a dns server i guess, while for pinging 8.8.8.8 the ping utility starts but nothing happens.
the next image is after the refresh and no other changes on the vm:
-
If it's unable to resolve it I'd expect some error there but you can confirm by just trying to resolve it:
steve@steve-NUC9i9QNX:~$ host pfsense.org pfsense.org has address 208.123.73.78 pfsense.org has IPv6 address 2610:160:11:11::78 pfsense.org mail is handled by 10 aspmx2.googlemail.com. pfsense.org mail is handled by 1 aspmx.l.google.com. pfsense.org mail is handled by 10 aspmx3.googlemail.com. pfsense.org mail is handled by 5 alt1.aspmx.l.google.com. pfsense.org mail is handled by 5 alt2.aspmx.l.google.com.Do you see anything blocked in the firewall log?
Check the state table in Diag > States when you are trying to ping 8.8.8.8 from a linux client. Do you see the states created? On which interfaces?
If you don't see any states then check a packet capture on the pfSense LAN.
If you see no packets then check the ARP table on the client device. Is it still showing the correct MAC for the pfSense LAN?
If it isn't then you probably have some IP conflict. Though pfSense would normally log that if it can see the arp requests. -
@stephenw10
connection refused before refresh:
Nothing is blocked and I do not see any packets in the packet capture.
The IP and correct mac address are on the ARP table. -
Please confirm that you have not installed pfBlockerng(-devel) and that you are not plan to install it.
Be ware that pfBlockerng will use the same IP for its own need (can be changed) :
Unbound (or dnsmasq) is listening ?
sockstat | grep 'unbound'Btw : "Connection refused" tells me that unbound did get the DNS request, but unbound was informed to 'refuse' it.
Nothing special unbound ACLs ?
Normally, default, ACL isn't used ...
-
@Gertjan i am using unbound and i do not have pfBlockerng
Btw : "Connection refused" tells me that unbound did get the DNS request, but unbound was informed to 'refuse' it.
Nothing special unbound ACLs ?nothing on ACL
-
Check the ARP table.
-
@stephenw10 there is an entry for the system but no internet access. still i am able to ping the pfsense and other systems on the subnet
-
@stephenw10 on the otherside, the firewall cannot ping the same system
-
No check the ARP table in Kali for the 10.10.10.1 address. It seems at least possible something else is using it and sending the wrong MAC.
-
@stephenw10 top is before and bottom is after the refresh.
-
Aha, well there you go. Only one of those MACs is correct. Where is that other MAC coming from?
-
@stephenw10 thank you so much! i found the culprit!
on my proxmox i had setup the switch interface to be on the 10.10.10.1/24 and so I had two interfaces with the same IP... you are a god thank you!
-
Ah, that would do it! Interesting that it only seemed to affect Linux hosts though. I suspect eventually Windows would also have hit it.
-
@stephenw10 who knows... thanks again! I was going crazy for two weeks now until I decided to reach out to this forum! i was asking coworkers and people on mastodon but all i needed to do in the end was arp-scan and see that there was a conflict with two macs on the same IP. Saddly I cannot upvote you because of my low reputation.
For future readers please give stephenw10 an upvote for me <3
