Пропадает доступ к админке

roy

В общем логи говорят такое:

Сбросил настройки pfsense, настройил ip для wan, зашел на ОС через вебморду. Паралельно смотрю на tcpdump.
1. Interfaces –> assign
добавляю 2 интерфейса (помимо уже настройенного wan).
2. System --> General Setup, прописал Hostname, Domain, Time zone, NTP time server. Сохранил изменения.
Сразу в логах полезло:

tcpdump: WARNING: pflog0: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on pflog0, link-type PFLOG (OpenBSD pflog file), capture size 96 bytes
00:00:00.000000 rule 1/0(match): block in on em0: 192.168.139.1.54308 > 192.168.139.129.443: [|tcp]
00:00:00.009695 rule 1/0(match): block in on em0: 192.168.139.1.54309 > 192.168.139.129.443: [|tcp]
00:00:00.001928 rule 1/0(match): block in on em0: 192.168.139.1.54310 > 192.168.139.129.443: [|tcp]
00:00:00.001862 rule 1/0(match): block in on em0: 192.168.139.1.54311 > 192.168.139.129.443: [|tcp]
00:00:00.002224 rule 1/0(match): block in on em0: 192.168.139.1.54312 > 192.168.139.129.443:  tcp 32 [bad hdr length 0 - too short, < 20]
00:00:00.289612 rule 1/0(match): block in on em0: 192.168.139.1.54313 > 192.168.139.129.443: [|tcp]
00:00:00.115112 rule 1/0(match): block in on em0: 192.168.139.1.54314 > 192.168.139.129.443: [|tcp]
00:00:00.000030 rule 1/0(match): block in on em0: 192.168.139.1.54315 > 192.168.139.129.443: [|tcp]
00:00:00.001229 rule 1/0(match): block in on em0: 192.168.139.1.54316 > 192.168.139.129.443: [|tcp]
00:00:00.000017 rule 1/0(match): block in on em0: 192.168.139.1.54317 > 192.168.139.129.443:  tcp 32 [bad hdr length 0 - too short, < 20]
00:00:02.560595 rule 1/0(match): block in on em0: 192.168.139.1.54308 > 192.168.139.129.443: [|tcp]
00:00:00.010131 rule 1/0(match): block in on em0: 192.168.139.1.54309 > 192.168.139.129.443: [|tcp]
00:00:00.004912 rule 1/0(match): block in on em0: 192.168.139.1.54310 > 192.168.139.129.443: [|tcp]
00:00:00.000022 rule 1/0(match): block in on em0: 192.168.139.1.54311 > 192.168.139.129.443: [|tcp]
00:00:00.004916 rule 1/0(match): block in on em0: 192.168.139.1.54312 > 192.168.139.129.443:  tcp 32 [bad hdr length 0 - too short, < 20]
00:00:00.288515 rule 1/0(match): block in on em0: 192.168.139.1.54313 > 192.168.139.129.443: [|tcp]
00:00:00.124514 rule 1/0(match): block in on em0: 192.168.139.1.54315 > 192.168.139.129.443: [|tcp]
00:00:00.000025 rule 1/0(match): block in on em0: 192.168.139.1.54317 > 192.168.139.129.443: [|tcp]
00:00:00.000018 rule 1/0(match): block in on em0: 192.168.139.1.54314 > 192.168.139.129.443: [|tcp]
00:00:00.000016 rule 1/0(match): block in on em0: 192.168.139.1.54316 > 192.168.139.129.443:  tcp 32 [bad hdr length 0 - too short, < 20]
00:00:05.541870 rule 1/0(match): block in on em0: 192.168.139.1.54308 > 192.168.139.129.443: [|tcp]
00:00:00.009979 rule 1/0(match): block in on em0: 192.168.139.1.54309 > 192.168.139.129.443: [|tcp]
00:00:00.001141 rule 1/0(match): block in on em0: 192.168.139.1.54310 > 192.168.139.129.443: [|tcp]
00:00:00.000024 rule 1/0(match): block in on em0: 192.168.139.1.54311 > 192.168.139.129.443: [|tcp]
00:00:00.008785 rule 1/0(match): block in on em0: 192.168.139.1.54312 > 192.168.139.129.443:  tcp 28 [bad hdr length 0 - too short, < 20]
00:00:00.288450 rule 1/0(match): block in on em0: 192.168.139.1.54313 > 192.168.139.129.443: [|tcp]
00:00:00.120854 rule 1/0(match): block in on em0: 192.168.139.1.54315 > 192.168.139.129.443: [|tcp]
00:00:00.000025 rule 1/0(match): block in on em0: 192.168.139.1.54317 > 192.168.139.129.443: [|tcp]
00:00:00.000017 rule 1/0(match): block in on em0: 192.168.139.1.54314 > 192.168.139.129.443: [|tcp]
00:00:00.000015 rule 1/0(match): block in on em0: 192.168.139.1.54316 > 192.168.139.129.443:  tcp 28 [bad hdr length 0 - too short, < 20]
00:00:11.840306 rule 1/0(match): block in on em0: 192.168.139.1.54326 > 192.168.139.129.443: [|tcp]
00:00:00.100565 rule 1/0(match): block in on em0: 192.168.139.1.54327 > 192.168.139.129.443: [|tcp]
00:00:00.004648 rule 1/0(match): block in on em0: 192.168.139.1.54328 > 192.168.139.129.443: [|tcp]
00:00:00.000028 rule 1/0(match): block in on em0: 192.168.139.1.54329 > 192.168.139.129.443: [|tcp]
00:00:00.004027 rule 1/0(match): block in on em0: 192.168.139.1.54330 > 192.168.139.129.443: [|tcp]
00:00:02.874231 rule 1/0(match): block in on em0: 192.168.139.1.54326 > 192.168.139.129.443: [|tcp]
00:00:00.099607 rule 1/0(match): block in on em0: 192.168.139.1.54327 > 192.168.139.129.443: [|tcp]
00:00:00.009971 rule 1/0(match): block in on em0: 192.168.139.1.54328 > 192.168.139.129.443: [|tcp]
00:00:00.000023 rule 1/0(match): block in on em0: 192.168.139.1.54330 > 192.168.139.129.443: [|tcp]
00:00:00.000002 rule 1/0(match): block in on em0: 192.168.139.1.54329 > 192.168.139.129.443: [|tcp]
00:00:05.856535 rule 1/0(match): block in on em0: 192.168.139.1.54326 > 192.168.139.129.443: [|tcp]
00:00:00.099470 rule 1/0(match): block in on em0: 192.168.139.1.54327 > 192.168.139.129.443: [|tcp]
00:00:00.010248 rule 1/0(match): block in on em0: 192.168.139.1.54330 > 192.168.139.129.443: [|tcp]
00:00:00.000034 rule 1/0(match): block in on em0: 192.168.139.1.54328 > 192.168.139.129.443: [|tcp]
00:00:00.000024 rule 1/0(match): block in on em0: 192.168.139.1.54329 > 192.168.139.129.443: [|tcp]
00:00:02.985000 rule 1/0(match): block in on em0: 192.168.139.1.54339 > 192.168.139.129.443: [|tcp]
00:00:00.001242 rule 1/0(match): block in on em0: 192.168.139.1.54340 > 192.168.139.129.443: [|tcp]
00:00:00.000021 rule 1/0(match): block in on em0: 192.168.139.1.54341 > 192.168.139.129.443: [|tcp]
00:00:00.002369 rule 1/0(match): block in on em0: 192.168.139.1.54342 > 192.168.139.129.443: [|tcp]
00:00:00.000018 rule 1/0(match): block in on em0: 192.168.139.1.54343 > 192.168.139.129.443:  tcp 32 [bad hdr length 0 - too short, < 20]
00:00:00.213139 rule 1/0(match): block in on em0: 192.168.139.1.54344 > 192.168.139.129.443: [|tcp]
00:00:00.049859 rule 1/0(match): block in on em0: 192.168.139.1.54345 > 192.168.139.129.443: [|tcp]
00:00:00.023695 rule 1/0(match): block in on em0: 192.168.139.1.54346 > 192.168.139.129.443: [|tcp]
00:00:00.000024 rule 1/0(match): block in on em0: 192.168.139.1.54347 > 192.168.139.129.443: [|tcp]
00:00:00.002289 rule 1/0(match): block in on em0: 192.168.139.1.54348 > 192.168.139.129.443:  tcp 32 [bad hdr length 0 - too short, < 20]
00:00:02.688146 rule 1/0(match): block in on em0: 192.168.139.1.54340 > 192.168.139.129.443: [|tcp]
00:00:00.000033 rule 1/0(match): block in on em0: 192.168.139.1.54339 > 192.168.139.129.443: [|tcp]
00:00:00.009829 rule 1/0(match): block in on em0: 192.168.139.1.54341 > 192.168.139.129.443: [|tcp]
00:00:00.009982 rule 1/0(match): block in on em0: 192.168.139.1.54343 > 192.168.139.129.443: [|tcp]
00:00:00.000027 rule 1/0(match): block in on em0: 192.168.139.1.54342 > 192.168.139.129.443:  tcp 32 [bad hdr length 0 - too short, < 20]
00:00:00.199022 rule 1/0(match): block in on em0: 192.168.139.1.54344 > 192.168.139.129.443: [|tcp]
00:00:00.049768 rule 1/0(match): block in on em0: 192.168.139.1.54345 > 192.168.139.129.443: [|tcp]
00:00:00.037296 rule 1/0(match): block in on em0: 192.168.139.1.54346 > 192.168.139.129.443: [|tcp]
00:00:00.000102 rule 1/0(match): block in on em0: 192.168.139.1.54348 > 192.168.139.129.443: [|tcp]
00:00:00.000030 rule 1/0(match): block in on em0: 192.168.139.1.54347 > 192.168.139.129.443:  tcp 32 [bad hdr length 0 - too short, < 20]
00:00:02.025704 rule 1/0(match): block in on em0: 192.168.139.1.54354 > 192.168.139.129.443: [|tcp]
00:00:00.247875 rule 1/0(match): block in on em0: 192.168.139.1.54355 > 192.168.139.129.443: [|tcp]
00:00:02.739669 rule 1/0(match): block in on em0: 192.168.139.1.54354 > 192.168.139.129.443: [|tcp]
00:00:00.248810 rule 1/0(match): block in on em0: 192.168.139.1.54355 > 192.168.139.129.443: [|tcp]
00:00:00.397875 rule 1/0(match): block in on em0: 192.168.139.1.54340 > 192.168.139.129.443: [|tcp]
00:00:00.001244 rule 1/0(match): block in on em0: 192.168.139.1.54339 > 192.168.139.129.443: [|tcp]
00:00:00.008443 rule 1/0(match): block in on em0: 192.168.139.1.54341 > 192.168.139.129.443: [|tcp]
00:00:00.019587 rule 1/0(match): block in on em0: 192.168.139.1.54343 > 192.168.139.129.443: [|tcp]
00:00:00.000034 rule 1/0(match): block in on em0: 192.168.139.1.54342 > 192.168.139.129.443:  tcp 28 [bad hdr length 0 - too short, < 20]
00:00:00.199561 rule 1/0(match): block in on em0: 192.168.139.1.54344 > 192.168.139.129.443: [|tcp]
00:00:00.049818 rule 1/0(match): block in on em0: 192.168.139.1.54345 > 192.168.139.129.443: [|tcp]
00:00:00.032446 rule 1/0(match): block in on em0: 192.168.139.1.54346 > 192.168.139.129.443: [|tcp]
00:00:00.000030 rule 1/0(match): block in on em0: 192.168.139.1.54348 > 192.168.139.129.443: [|tcp]
00:00:00.000018 rule 1/0(match): block in on em0: 192.168.139.1.54347 > 192.168.139.129.443: [|tcp]
00:00:05.008339 rule 1/0(match): block in on em0: 192.168.139.1.54354 > 192.168.139.129.443: [|tcp]
00:00:00.248708 rule 1/0(match): block in on em0: 192.168.139.1.54355 > 192.168.139.129.443: [|tcp]
00:00:06.387660 rule 1/0(match): block in on em0: 192.168.139.1.54356 > 192.168.139.129.443: [|tcp]
00:00:00.002017 rule 1/0(match): block in on em0: 192.168.139.1.54357 > 192.168.139.129.443: [|tcp]
00:00:00.214290 rule 1/0(match): block in on em0: 192.168.139.1.54358 > 192.168.139.129.443: [|tcp]
00:00:00.034947 rule 1/0(match): block in on em0: 192.168.139.1.54359 > 192.168.139.129.443: [|tcp]
00:00:00.001642 rule 1/0(match): block in on em0: 192.168.139.1.54360 > 192.168.139.129.443: [|tcp]
00:00:00.012690 rule 1/0(match): block in on em0: 192.168.139.1.54361 > 192.168.139.129.443: [|tcp]
00:00:00.025635 rule 1/0(match): block in on em0: 192.168.139.1.54362 > 192.168.139.129.443: [|tcp]
00:00:00.001217 rule 1/0(match): block in on em0: 192.168.139.1.54363 > 192.168.139.129.443: [|tcp]
00:00:00.002579 rule 1/0(match): block in on em0: 192.168.139.1.54364 > 192.168.139.129.443: [|tcp]
00:00:01.406231 rule 1/0(match): block in on em0: 192.168.139.1.54365 > 192.168.139.129.443: [|tcp]
00:00:00.247419 rule 1/0(match): block in on em0: 192.168.139.1.54366 > 192.168.139.129.443: [|tcp]
00:00:01.042595 rule 1/0(match): block in on em0: 192.168.139.1.54356 > 192.168.139.129.443: [|tcp]
00:00:00.000022 rule 1/0(match): block in on em0: 192.168.139.1.54357 > 192.168.139.129.443: [|tcp]
00:00:00.205265 rule 1/0(match): block in on em0: 192.168.139.1.54358 > 192.168.139.129.443: [|tcp]
00:00:00.040003 rule 1/0(match): block in on em0: 192.168.139.1.54359 > 192.168.139.129.443: [|tcp]
00:00:00.003419 rule 1/0(match): block in on em0: 192.168.139.1.54360 > 192.168.139.129.443: [|tcp]
00:00:00.009958 rule 1/0(match): block in on em0: 192.168.139.1.54361 > 192.168.139.129.443: [|tcp]
00:00:00.095966 rule 1/0(match): block in on em0: 192.168.139.1.54362 > 192.168.139.129.443: [|tcp]
00:00:00.000027 rule 1/0(match): block in on em0: 192.168.139.1.54364 > 192.168.139.129.443: [|tcp]
00:00:00.000020 rule 1/0(match): block in on em0: 192.168.139.1.54363 > 192.168.139.129.443: [|tcp]
00:00:01.331908 rule 1/0(match): block in on em0: 192.168.139.1.54365 > 192.168.139.129.443: [|tcp]
00:00:00.263549 rule 1/0(match): block in on em0: 192.168.139.1.54366 > 192.168.139.129.443: [|tcp]
00:00:00.618496 rule 1/0(match): block in on em0: 192.168.139.1.54367 > 192.168.139.129.443: [|tcp]
00:00:02.983311 rule 1/0(match): block in on em0: 192.168.139.1.54367 > 192.168.139.129.443: [|tcp]
00:00:00.418593 rule 1/0(match): block in on em0: 192.168.139.1.54356 > 192.168.139.129.443: [|tcp]
00:00:00.000024 rule 1/0(match): block in on em0: 192.168.139.1.54357 > 192.168.139.129.443: [|tcp]
00:00:00.199714 rule 1/0(match): block in on em0: 192.168.139.1.54369 > 192.168.139.129.443: [|tcp]
00:00:00.009763 rule 1/0(match): block in on em0: 192.168.139.1.54358 > 192.168.139.129.443: [|tcp]
00:00:00.038732 rule 1/0(match): block in on em0: 192.168.139.1.54360 > 192.168.139.129.443: [|tcp]
00:00:00.001027 rule 1/0(match): block in on em0: 192.168.139.1.54359 > 192.168.139.129.443: [|tcp]
00:00:00.008793 rule 1/0(match): block in on em0: 192.168.139.1.54361 > 192.168.139.129.443:  tcp 28 [bad hdr length 0 - too short, < 20]
00:00:00.099663 rule 1/0(match): block in on em0: 192.168.139.1.54362 > 192.168.139.129.443: [|tcp]
00:00:00.001251 rule 1/0(match): block in on em0: 192.168.139.1.54364 > 192.168.139.129.443: [|tcp]
00:00:00.000036 rule 1/0(match): block in on em0: 192.168.139.1.54363 > 192.168.139.129.443: [|tcp]
00:00:00.091651 rule 1/0(match): block in on em0: 192.168.139.1.54370 > 192.168.139.129.443: [|tcp]
00:00:01.237763 rule 1/0(match): block in on em0: 192.168.139.1.54365 > 192.168.139.129.443: [|tcp]
00:00:00.262525 rule 1/0(match): block in on em0: 192.168.139.1.54366 > 192.168.139.129.443: [|tcp]
00:00:01.231106 rule 1/0(match): block in on em0: 192.168.139.1.54369 > 192.168.139.129.443: [|tcp]
00:00:00.258660 rule 1/0(match): block in on em0: 192.168.139.1.54370 > 192.168.139.129.443: [|tcp]
00:00:00.251659 rule 1/0(match): block in on em0: 192.168.139.1.54371 > 192.168.139.129.443: [|tcp]
00:00:00.250099 rule 1/0(match): block in on em0: 192.168.139.1.54372 > 192.168.139.129.443: [|tcp]
00:00:01.607552 rule 1/0(match): block in on em0: 192.168.139.1.54367 > 192.168.139.129.443: [|tcp]
00:00:00.486393 rule 1/0(match): block in on em0: 192.168.139.1.54374 > 192.168.139.129.443: [|tcp]
00:00:00.250641 rule 1/0(match): block in on em0: 192.168.139.1.54375 > 192.168.139.129.443: [|tcp]
00:00:00.393653 rule 1/0(match): block in on em0: 192.168.139.1.54371 > 192.168.139.129.443: [|tcp]
00:00:00.248908 rule 1/0(match): block in on em0: 192.168.139.1.54372 > 192.168.139.129.443: [|tcp]
00:00:02.090500 rule 1/0(match): block in on em0: 192.168.139.1.54374 > 192.168.139.129.443: [|tcp]
00:00:00.129300 rule 1/0(match): block in on em0: 192.168.139.1.54369 > 192.168.139.129.443: [|tcp]
00:00:00.119329 rule 1/0(match): block in on em0: 192.168.139.1.54375 > 192.168.139.129.443: [|tcp]
00:00:00.139330 rule 1/0(match): block in on em0: 192.168.139.1.54370 > 192.168.139.129.443: [|tcp]
00:00:02.774383 rule 1/0(match): block in on em0: 192.168.139.1.54376 > 192.168.139.129.443: [|tcp]
00:00:00.006751 rule 1/0(match): block in on em0: 192.168.139.1.54377 > 192.168.139.129.443: [|tcp]
00:00:00.458814 rule 1/0(match): block in on em0: 192.168.139.1.54371 > 192.168.139.129.443: [|tcp]
00:00:00.248740 rule 1/0(match): block in on em0: 192.168.139.1.54372 > 192.168.139.129.443: [|tcp]
00:00:00.997739 rule 1/0(match): block in on em0: 192.168.139.1.54378 > 192.168.139.129.443: [|tcp]
00:00:00.745264 rule 1/0(match): block in on em0: 192.168.139.1.54379 > 192.168.139.129.443: [|tcp]
00:00:00.250241 rule 1/0(match): block in on em0: 192.168.139.1.54380 > 192.168.139.129.443: [|tcp]
00:00:00.098735 rule 1/0(match): block in on em0: 192.168.139.1.54374 > 192.168.139.129.443: [|tcp]
00:00:00.185242 rule 1/0(match): block in on em0: 192.168.139.1.54376 > 192.168.139.129.443: [|tcp]
00:00:00.019963 rule 1/0(match): block in on em0: 192.168.139.1.54377 > 192.168.139.129.443: [|tcp]
00:00:00.043445 rule 1/0(match): block in on em0: 192.168.139.1.54375 > 192.168.139.129.443: [|tcp]
00:00:01.644279 rule 1/0(match): block in on em0: 192.168.139.1.54378 > 192.168.139.129.443: [|tcp]
^C
143 packets captured
147 packets received by filter
0 packets dropped by kernel

Пару раз перешел по страничкам и вебморда отпала… ssh тоже. Перезагрузка не помогает - только factory default.
Какое совпадение, с каким правилом??? Я же ничего не успел настроить еще... ))
Что скажете?

dvserg

Мне кажется это более важным

tcp 32 [bad hdr length 0 - too short, < 20]

roy

@dvserg:

Мне кажется это более важным

tcp 32 [bad hdr length 0 - too short, < 20]

мне ничего к сожалению это не говорит, плохая длинна заголовка (0) не превышает 20.
192.168.139.1 это типа next hope, 192.168.139.129 - WAN's IP
Прикол в том, что если поменять местами п.1 и п.2 (что писал выше) вроде бы все нормально…

dvserg

А что Вы назначаете в assign ? Вот у человека на виртуалке похожая проблема была. Вроде бы как решил переназначением интерфейса с логического на физический.

http://forums.freebsd.org/archive/index.php/t-9019.html

I changed virtual nic from vlance to e1000 in .vmx host file
and now pf is working correctly.

rubic

В настройках WAN pfSense флажок "Block private networks" часом не стоит?

roy

@dvserg:

А что Вы назначаете в assign ?

У меня 3 интерфейса, 2 - для wan и соответственно 1 LAN. Через начальную настройку назначаю только wan. Через него и захожу на вебку. А потом assign и добавляю в систему уже те 2 интерфейса.
@dvserg:

Вот у человека на виртуалке похожая проблема была. Вроде бы как решил переназначением интерфейса с логического на физический.

http://forums.freebsd.org/archive/index.php/t-9019.html

I changed virtual nic from vlance to e1000 in .vmx host file
and now pf is working correctly.

Спасибо буду скоро смотреть!

roy

@rubic:

В настройках WAN pfSense флажок "Block private networks" часом не стоит?

нет, только "Block bogon networks"

rubic

Ну а вообще, раз уж вы с WAN в админку пытаетесь попасть, 443-й порт на нем открыт?

werter

Версия pfsense - 2-ой финал ? Ни 1-ый, ни бэта 2-ого , ни RC 2-ого ?

P.s. http://forum.pfsense.org/index.php?topic=34719.0

это читал (http://forum.pfsense.org/index.php?topic=12372.0)
ifconfig $interface -tso – не помогло

Возможно , Вам поможет.

Или

Ситуация исправилась толко после сброса настроек PFS на дефолт (через PFS консоль)

roy

@rubic:

Ну а вообще, раз уж вы с WAN в админку пытаетесь попасть, 443-й порт на нем открыт?

Вы меня опередили…
Вот что я увидел вчера вечером:
сбросил настройки опять, зашел в правила firewall - есть всего два правила, одно из которых описывает доступ на WAN по tcp 80 и 443, как только добавил интерфейсы - осталось только одно - с описанием Block bogon networks.
А так быть не должно...

roy

@werter:

Версия pfsense - 2-ой финал ? Ни 1-ый, ни бэта 2-ого , ни RC 2-ого ?

P.s. http://forum.pfsense.org/index.php?topic=34719.0

это читал (http://forum.pfsense.org/index.php?topic=12372.0)
ifconfig $interface -tso – не помогло

Возможно , Вам поможет.

Или

Ситуация исправилась толко после сброса настроек PFS на дефолт (через PFS консоль)

Версия pfsense - 2.0.1

rubic

@roy:

сбросил настройки опять, зашел в правила firewall - есть всего два правила, одно из которых описывает доступ на WAN по tcp 80 и 443, как только добавил интерфейсы - осталось только одно - с описанием Block bogon networks.
А так быть не должно…

С чего вы взяли, что не должно? На WAN по умолчанию запрещено все, все правила для доступа нужно прописывать явно. На LAN - напротив по умолчанию сделано правило разрешающее доступ (Antilockout rule).

roy

@rubic:

С чего вы взяли, что не должно?

Ну вы же не отдаете бензин вечером на заправку, который залили с утра, или электричество на электростанцию, которое уже использовали )))
Я сконфигурировал через мастер интерфейс, ОС согласилась что это ван, и открыла на него доступ по порту 80 и 443. Далее я вспоминаю что у меня есть еще одна сетевая, хочу сделать резервирование каналов и мне нужно добавить ее в систему. Но после добавления - у меня исчезает правило для вана для портов 80 и 443 - и это последовательно и нормально???? я же не конфигурирую ван, не меняю настройки FIREWALL в целом, я только добавляю новый интерфейс
@rubic:

На LAN - напротив по умолчанию сделано правило разрешающее доступ (Antilockout rule).

доступ в какую сторону или в обе?