Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    SSH, Http issues

    Scheduled Pinned Locked Moved General pfSense Questions
    14 Posts 4 Posters 1.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N Offline
      Nevering
      last edited by

      I have pfsense running as a VM on my XenServer. During the upgrade from 2.15 to 2.2 I had problems where I had to use their hourly support… 2 hours $400 ..

      However, I was left with an SSH that didn't work. Not wanting to purchase another 2 hours to get support on the SSH issue, I tried here with no luck, and then proceeded on my own.  I found that after removing their pfblocker addon I was able to get some SSH .

      Now I'm finding that I can't access one IP (that I know of ) through Pfsense . I spent a day thinking it was a server issue, and focused there. But the only thing that resolved the problem and reproduced it. Was removing that one VM from behind the firewall and put it on the Wan port, then back on the Firewalled port... It's on Wan now.

      It doesn't make sense to me that Pfsense would block SSH, http, FTP all pass on the firewall to one IP while allowing to others that have VMs on them.  Perhaps someone else has seen this and can help.

      thanks

      1 Reply Last reply Reply Quote 0
      • johnpozJ Offline
        johnpoz LAYER 8 Global Moderator
        last edited by

        I have no freaking clue to what your talking about..  But agree it doesn't make sense.

        Removing who's pfblocker?  That is something you installed, that is not part of default package.

        And what IP is this that you can not access?

        Are you saying that you can not forward to 1 IP, but others work fine?  And you bothered doing basic troubleshooting, like a simple sniff on the lan side and wan side of pfsense validating the traffic actually gets there and if sent to the IP you want to send it to out the lan?

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • stephenw10S Offline
          stephenw10 Netgate Administrator
          last edited by

          If pfblocker was causing previous issues you should check that it hasn't left any rules behind when you uninstalled it. Pfblocker doesn't block ports though only IPs so it wouldn't affect SSH alone.
          Check to see where this traffic is blocked. Do you see hits in the firewall logs? If not run a packet capture on wan and filter for known incoming traffic, is it there? Do the same on the internal interface, is the traffic there?

          Steve

          1 Reply Last reply Reply Quote 0
          • N Offline
            Nevering
            last edited by

            I removed pfblocker from pfsense. It only used a table to do the blocking, but it didn't work too well . I have been dealing with a failed hard drive on my server, so just now getting back. I'll put the server in question behind the firewall after hours tonight and run some tests.

            1 Reply Last reply Reply Quote 0
            • N Offline
              Nevering
              last edited by

              back behind the firewall and nothing seems to get through. This is a Freebsd mail server and all mail services is down, http services to postfixadmin is down and to Roundcube.
              Nothing is showing up in the logs, and I ghet Operation Timed out on the ssh operation, and Unable to connect remote host on telnet to mail ports and http

              1 Reply Last reply Reply Quote 0
              • johnpozJ Offline
                johnpoz LAYER 8 Global Moderator
                last edited by

                Nothing seems to get through in what direction?  From lan to wan or from wan to lan with a forward?

                Your saying its only 1 IP?  Can not help you without some details..

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • stephenw10S Offline
                  stephenw10 Netgate Administrator
                  last edited by

                  Start from the basics and work up.
                  I assume you have some evidence that it is actually connected at all, to anything!, like a connection UP status somewhere? Can you ping the server from the pfSense LAN IP? Can you ping the pfSense box from the server?
                  Is the server a VM also?

                  Steve

                  1 Reply Last reply Reply Quote 0
                  • N Offline
                    Nevering
                    last edited by

                    @johnpoz:

                    Nothing seems to get through in what direction?  From lan to wan or from wan to lan with a forward?

                    Your saying its only 1 IP?  Can not help you without some details..

                    From wan to lan .. But my lan is setup to pass to public IPs .. This was setup and configured with a Pfsense Support call with their Washington DC office.

                    It's starting to look like it's time to switch to another firewall vendor. They upgrade to 2.2, and tell me after the crash that I should have read the release notes, after 5 years of successful upgrades. $400 later I'm still having problems.

                    It also looks like the firewall is slowing traffic down compared to how it was behaving with 2.15

                    1 Reply Last reply Reply Quote 0
                    • N Offline
                      Nevering
                      last edited by

                      @Nevering:

                      @johnpoz:

                      Nothing seems to get through in what direction?  From lan to wan or from wan to lan with a forward?

                      Your saying its only 1 IP?  Can not help you without some details..

                      From wan to lan .. But my lan is setup to pass to public IPs .. This was setup and configured with a Pfsense Support call with their Washington DC office.

                      It's starting to look like it's time to switch to another firewall vendor. They upgrade to 2.2, and tell me after the crash that I should have read the release notes, after 5 years of successful upgrades. $400 later I'm still having problems.

                      It also looks like the firewall is slowing traffic down compared to how it was behaving with 2.15

                      This is a Xenserver with about 4 VM servers behind the firewall, well 3 now. I'm taking one out from behind today to test the speed issue.  Obviously, all the other servers are working fine, most http, but i can ssh to all telnet to ports, etc. Just not to the one when firewall'd

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S Offline
                        stephenw10 Netgate Administrator
                        last edited by

                        Perhaps I've misunderstood this. So you have one particular server that isn't accessible via any method externally (SSH, http or FTP). Other servers are working though and the problem server can get out OK? is accessible internally? This is also a VM in Xen?

                        Do you see the traffic blocked in the firewall logs? That would be my first suspect.

                        Steve

                        1 Reply Last reply Reply Quote 0
                        • N Offline
                          Nevering
                          last edited by

                          @stephenw10:

                          Perhaps I've misunderstood this. So you have one particular server that isn't accessible via any method externally (SSH, http or FTP). Other servers are working though and the problem server can get out OK? is accessible internally? This is also a VM in Xen?

                          Do you see the traffic blocked in the firewall logs? That would be my first suspect.

                          Steve

                          Yes, one server on a Xenserver. I have access to the machine with XenCenter to the machine and all the VM. Xencenter is a management console for Xenserver.  So access internally was over Xencenter. Changing the network interface for this nice from the Pfsense firewall network to an external Nic to the Wan is the only thing that would fix this problem.
                          Yesterday I installed an external Sonicwall from my hosting provider. Now every server behind the firewall and working as expected. Since this is a rented firewall. I may purchase an Pfsense box and try the same.  I'll probably wait on a couple more upgrades and watch problems.  Remember that Pfsense was also slowing down traffic, especially for website loading.
                          Things are normal now, and just hoping Pfsense addresses this. Like I said this box has been running pfsense successfully for 5 years until the 2.2 release.

                          thanks

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S Offline
                            stephenw10 Netgate Administrator
                            last edited by

                            Hmm, well that's odd.
                            If the other servers were working well but one is not I would first check the firewall logs to see if that traffic is being blocked. If it is then you have some rule blocking traffic that shouldn't be or no rule allowing it where there should be.
                            If there's nothing in the logs then it's probably a routing issue. I'd check the subnetmasks are correct, check the public IP is being routed to the server correctly.
                            If it's non of those things then it could be something that's grabbing the traffic before it gets to the firewall like a VPN or a port forward.

                            How much slowing down was there to the servers. There certainly have been issues with Xen going to 2.2, mostly because it automatically updated the interfaces it presents to pfSense which no VM host should do but there you go. They are known issues at least. There is also this: https://forum.pfsense.org/index.php?topic=88467.0
                            However it doesn't seem like you've hit that because it slows the traffic almost to a crawl.

                            Steve

                            1 Reply Last reply Reply Quote 0
                            • DerelictD Offline
                              Derelict LAYER 8 Netgate
                              last edited by

                              What doesn't sound like the Xen offload issue?

                              If access TO pfSense from either side seems fine but access THROUGH pfSense is slow, that's what it sounds like to me.

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S Offline
                                stephenw10 Netgate Administrator
                                last edited by

                                Well I guess if it's on a separate virtual interface and only that interface has offloading enabled in the host then maybe. The offloading options in pfSense are global though so I would expect it to affect all servers equally. Also the slowing down described here doesn't sound like the 0.4Kbps described in the known symptoms.
                                However since this is a known issue I would definitely be disabling off-loading everywhere anyway, that's why I linked to it.
                                I don't use Xen so I'm completely open to being wrong here.  ;)

                                Steve

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.