Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Weird client pc behavior

    Off-Topic & Non-Support Discussion
    3
    8
    2.5k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      klajosh2
      last edited by

      Hello,

      Last weekend I deployed a pfsense firewall to a company to protect their internal lan.
      Because they have many sites and in the future they want to use ipsec vpn between them,
      I have to change their internal lan subnet from 192.168.2.0/24 to 192.168.3.0/24 because
      other site uses the 192.168.2.0/24 subnet. And now the weird thing:
      after I put the the firewall in the network and I renumbered the LAN the original computers on LAN
      were not able to browse anyhing on the Internet except the companies mail server web interface (OWA) via https but other https based
      webpages did not come in. (computers getting ip from the correct range)

      My test notebook works well. With that on the same lan I can surf on the internet etc. etc.
      I have this default rule from LAN to WAN: allow any any. So everything should have worked but did not work.

      More weird: original PCs from local lan are able to communicate on other ports like TCP3389, DNS resolution also works, ICMP
      (ping) also works using with hostname or ip address to the WAN. I am suspecting that this is some virus activity but I do not
      know how to find information on the Internet about this.  ??? What I have not tried yet is netsh winsock reset on machines.

      Did anybody have same experience like this? (before ip renumbering everything worked)
      So it is definately not the pfsense what stops the traffic I can see in the logs that it is accepted and respones come back but
      the webpage does not show up in the browser. This happens all the machines in the lan.
      (not many approx. 5 machines: 4 windows xp and 1 windows 2008 server)

      Any help/response appreciated.
      klajosh

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        Windows policy lock down?
        Clients set to use a proxy?

        Could be a number of things.  :-\

        Steve

        1 Reply Last reply Reply Quote 0
        • K
          klajosh2
          last edited by

          I have checked that and there is no proxy setup in the browsers.

          1 Reply Last reply Reply Quote 0
          • K
            klajosh2
            last edited by

            I am still experiencing the same problem. A clean pc with freshly installed windows was brought there and showed the
            same symptoms. (everything worked but surfing on internet). what I tried so far:

            • reduce the MTU on WAN side
            • I checked this option under System: Advanced: Firewall and NAT: Clear invalid DF bits instead of dropping the packets
            • on client machines netsh winsock reset did not help either.

            I can see TCP:S from LAN to WAN what are allowed but nothing else.
            Please if you have any idea share with me.

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              I'm afraid I'm out of ideas.  :(
              Your own laptop works OK but a freshly installed client does not? What's the difference?

              Generally speaking if you aren't seeing anything in the logs then it's usually a routing problem. Re-check your subnets and gateways. That doesn't explain why DNS, for example, works though.

              Do you have a managed switch on this network? Is it doing something odd?

              Steve

              1 Reply Last reply Reply Quote 0
              • K
                klajosh2
                last edited by

                Hi,

                finally I found the problem. The problem was the MTU size on the ISP's backbone.
                They set it to 1434 and web browsing works fine. There is still one concern.
                From some networks I cannot reach the web interface of the pfsense but ssh works.
                I found out if I lower the mtu on WAN interface I can reach the web interface of pfsense
                from networks where I was not able to reach. My question what should I setup on WAN
                side to reach the webinterface of pfsense from everywhere? Or can someone send me
                a link about MTU settings? A good explanation? (now the MTU on WAN has its default
                value (1500).

                Thanks,

                klajosh

                1 Reply Last reply Reply Quote 0
                • K
                  klajosh2
                  last edited by

                  I forgot to tell that the internet link is a Wimax link. There
                  is a cisco 850 router between the pfsense firewall and the
                  whole world.

                  1 Reply Last reply Reply Quote 0
                  • C
                    cmb
                    last edited by

                    If your ISP limits to 1434, set both MTU and MSS to 1434 on that WAN.

                    1 Reply Last reply Reply Quote 0
                    • First post
                      Last post