ICMP pings still timing out despite ICMP traffic being reported as passed

johnpoz

Your issue is not anything like the OP, not you have described it not.

The OP can not ping or traceroute to outside IPs.

Your talking about pinging your wans virtual IPs - not even in the same ballpark. Start your own thread!

axis-frank

My apologies, you're right. I've skimmed so many articles to try and find a solution, I misread this one.

Good luck OP

timthetortoise

@axis-frank:

My apologies, you're right. I've skimmed so many articles to try and find a solution, I misread this one.

Good luck OP

Try adding individual firewall rules for each IP on the interface, that was my fix in your case.

georgeman

I downloaded the utility and ran it, no issues with the polling function behind pfSense. Furthermore, I ran a wireshark capture on its traffic and all it generates is ICMP pings. I really can't see why it wouldn't just work ???

JacktheSmack

I disabled all packet filtering temporarily and despite NAT being completely off, it's still not working. Also I polled a couple of computers on the network just fine, with 0% loss.

So if it's not the firewall that's stopping it, what is?

georgeman

What if you get one of those hops and ping it from a console? Do you get replies?

johnpoz

can we see your wan and lan rules.. And are you nats automatic - and your floating tab is empty?

and you only have wan and lan interfaces on pfsense right?

This should just work out of the box, bing bang zoom.. You have something odd going on that is for sure - but without seeing your wan and lan rules and any nats you might have setup its hard to tell where your issue is.

Please post screen shots of these screens so we can see your full set.

JacktheSmack

@georgeman:

What if you get one of those hops and ping it from a console? Do you get replies?

Yes, pinging the hops individually works fine.

@johnpoz:

can we see your wan and lan rules.. And are you nats automatic - and your floating tab is empty?

and you only have wan and lan interfaces on pfsense right?

This should just work out of the box, bing bang zoom.. You have something odd going on that is for sure - but without seeing your wan and lan rules and any nats you might have setup its hard to tell where your issue is.

Please post screen shots of these screens so we can see your full set.

I've attached all the firewall rules and LAN/WAN settings.

http://imgur.com/a/MM8a8

![firewall nat 1 to 1.PNG](/public/imported_attachments/1/firewall nat 1 to 1.PNG)
![firewall nat 1 to 1.PNG_thumb](/public/imported_attachments/1/firewall nat 1 to 1.PNG_thumb)

johnpoz

Ok why and the hell do you have a 192.168.1.50 address as vip for a 1:1 to your wan?

What do you think that 1:1 nat is doing?

Your LAN rules say if your coming from 192.168.1.50 you can talk to 192.168.1.234?? When would that rule ever come into play? A box on 192.168.1.0/24 ie your lan would never even send a packet to 192.168.1.1 because 192.168.1.234 is its own network. And isn't .50 the vip you created?

I would suggest you remove all that stuff. I would then delete your nat rules since seems your currently set to auto but must at one time set it to manual.. So those should be deleted.

Your best best would be to prob just from the console do a
4) Reset to factory defaults

And then see what happens.

JacktheSmack

Reset to factory defaults, haven't changed a single option, and still getting timeout when I do a Poll.

johnpoz

dude your rules make no sense.. Why do you have rules for lan to lan traffic - you do understand that pfsense has nothing to do with boxes talking to each other on 192.168.1.0/24 – it is a gateway OFF that network..

You clearly created a VIP for a 1:1 - 192.168.1.50

You have setup a 1:1 NAT to what??

Simple just reset to factory and all that nonsense goes away. Then ask how to do what you want to do.. What is the purpose of 192.168.1.50 on your WAN interface in a 1:1 nat? What do you expect to accomplish with that?

JacktheSmack

@johnpoz:

dude your rules make no sense.. Why do you have rules for lan to lan traffic - you do understand that pfsense has nothing to do with boxes talking to each other on 192.168.1.0/24 – it is a gateway OFF that network..

You clearly created a VIP for a 1:1 - 192.168.1.50

You have setup a 1:1 NAT to what??

Simple just reset to factory and all that nonsense goes away. Then ask how to do what you want to do.. What is the purpose of 192.168.1.50 on your WAN interface in a 1:1 nat? What do you expect to accomplish with that?

I just reset, as I have said in my earlier post.

Also I didn't have that rule there 15 minutes before this post, as I was trying to figure out how to do an emulation of an IP address so if a computer requests 192.168.1.50, it will redirect them to 192.168.1.234. This is due to a limitation of Apple Computers where a Hostname cannot be used for a network printer, only an IP address, and every once in a while the IP will change. The only way to change the IP of an installed network printer on a Mac is to reinstall the printer software. It would be ten times easier just to have all the Macs point to a virtual IP, which redirects them to the printer's real IP.

johnpoz

so you have reset or have not reset with out those 1:1 without the manual nat rules showing up?

So your saying if you do ping to those hops from pfsense, or from box behind pfsense they work?

If they do not work from pfsense then its not pfsense causing the problem. If they work from pfsense console, but dont' work behind pfsense then there is something wrong with pfsense.

JacktheSmack

@johnpoz:

so you have reset or have not reset with out those 1:1 without the manual nat rules showing up?

I reset all settings in the entire box. There is no rules, except for the default LAN rules ones that allow networked PCs to communicate. All NAT settings are empty.

@johnpoz:

So your saying if you do ping to those hops from pfsense, or from box behind pfsense they work?

If they do not work from pfsense then its not pfsense causing the problem. If they work from pfsense console, but dont' work behind pfsense then there is something wrong with pfsense.

If I ping them behind pfsense in windows command line, it works. Same with tracert. If I poll them in this tool, I have 100% loss.

If I unplug my pfsense router and connect to my modem directly, I can poll everything just fine.

I can also poll other computers on the same network fine.

Edit: I can also tracert from pfsense fine.

johnpoz

Well that makes absolutely no sense - all the tool is doing is icmp pings.

And you say if you do the same tracert and ping command work from windows directly.

So look here is sniff of the traffic, all its sending is pings in the poll

did you tweak anything in the tool settings.. what is your ping TTL set too?

polling.png_thumb

settings.png_thumb

johnpoz

As to your printer stuff - what are you trying to accomplish. Why would your printers not be discovered with airprint/bonour/mdns/dns-sd?

Seems to be they are the same segment. If not on same segment then you can do look up cross segments support for printers with apple, etc.

I don't have any apple to play with other than my ipad - but I shared out my printer via cups and finds it by name no problem.

dnssd://Samsung%20ML-2570%20Series%20(samsung)._printer._tcp.local/

Trying to setup via IP I agree would be a pain to be sure.. I find it hard to believe you can not setup FQDN when adding a printer to apples? Do you not have normal dns services on your network.. Pfsense can for sure hand out say printer1.somedomain.tld to your network. Then if IP changes just update your host over ride in pfsense to point to new IP, etc.

georgeman

I strongly believe there's something wrong with either your PC or that "pinging software". Did you try from another PC within the same LAN?

BTW, what was the actual problem??? I got lost

JacktheSmack

@georgeman:

I strongly believe there's something wrong with either your PC or that "pinging software". Did you try from another PC within the same LAN?

BTW, what was the actual problem??? I got lost

I just tried it on 2 other laptops in the house. They all had the same exact issue: Trace Route works, but Polling gives a 100% loss. All ICMP traffic in pfsense was marked as "passed" in the firewall logs.

The original issue was that in Battlefield 4 and Battlefield 3 my ping displays as a dash in game. I contacted EA, and they gave me that tool. When I remove my router and directly connect to my mode, that tool and my ping in Battlefield both start working properly, thus leading me to believe both use similar pinging methods, and thus being able to successfully Poll with this tool while behind pfsense will allow me to see pings in BF4.

@johnpoz:

Well that makes absolutely no sense - all the tool is doing is icmp pings.

And you say if you do the same tracert and ping command work from windows directly.

So look here is sniff of the traffic, all its sending is pings in the poll

did you tweak anything in the tool settings.. what is your ping TTL set too?

All the settings in the tool were the same as you posted. I did however do a packet sniff, and it looks like I'm getting the replies.

wireshark.PNG_thumb

georgeman

Did you try turning your firewall off? Maybe it is configuring itself on different "profiles" depending on whether you are connecting directly to your router or not

JacktheSmack

@georgeman:

Did you try turning your firewall off? Maybe it is configuring itself on different "profiles" depending on whether you are connecting directly to your router or not

Windows Firewall service is disabled.