Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Packet Tracer function

    Scheduled Pinned Locked Moved General pfSense Questions
    15 Posts 7 Posters 5.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      almabes
      last edited by

      Apologies if this is not the right place to post this…

      Before working with pfSense, I worked with Cisco's ASA product, and previously PIX.

      The ASA has a packet tracer feature that can be used to help troubleshoot why packets get disposed of the way they do by the firewall.  It would allow one to specify the source IP, interface, and port, and the destination IP and port and trace this pretend packet through the firewall, detailing all the rules that affect the final disposition.  It was very useful when dealing with large, complex, almost idiotic rule sets.

      Does this functionality exist in pfSense, or something exactly similar?  ;)

      If not, is this the place to request such a feature, or should I post it elsewhere?

      1 Reply Last reply Reply Quote 0
      • H
        Harvy66
        last edited by

        The firewall log will tell you if a connection got blocked and what rule blocked it, if that's what you're asking.

        1 Reply Last reply Reply Quote 0
        • A
          almabes
          last edited by

          That's close, but not quite.  That will show if a firewall rule blocked or allowed a packet, if the rule has logging turned on.  But no info about NAT, Routing, Egress interface etc.

          Take for example, the situation that cdsJerry is dealing with.  If there was a Diagnostics–Packet tracer feature, one could theoretically input source and destination information, click a button, and have diagnostic report generated that details all the steps and checks the packet encounters as it traverses the firewall.  We could much more easily determine where his configuration is screwed up.

          I have no idea if it's even feasible.  If someone wanted to develop it as a standalone package, I'd contribute some dollars toward that delinquency.

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            cdsjerry's issue is pretty clear - he has a mess of rules most of which are useless and others that are completely wide open.  You don't need a trace to see that ;)

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

            1 Reply Last reply Reply Quote 0
            • DerelictD
              Derelict LAYER 8 Netgate
              last edited by

              No.  Nothing like the packet tracer function in the ASA in pfSense.

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                juniper has the same sort of function as well, you can put in details of traffic like source ip, or dest ip and port, etc.  and what what happens to the traffic.  But that is just because the logging is so horrific if you ask me.

                Pfsense logging tell you exactly what blocked a packet or allowed a packet, etc.  Just log your rules and your good.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                1 Reply Last reply Reply Quote 0
                • A
                  almabes
                  last edited by

                  @johnpoz:

                  cdsjerry's issue is pretty clear - he has a mess of rules most of which are useless and others that are completely wide open.  You don't need a trace to see that ;)

                  Regardless, I salute you, Derelict, and Doktornotor for helping the guy.  That's a convoluted mess if I have EVER seen one.

                  1 Reply Last reply Reply Quote 0
                  • J
                    jgradke
                    last edited by

                    I've come across a customer using Netgate/PFSense recently and I am really impressed by this firewall. I'm familiar with the Cisco packet tracer this user spoke of and agree to its usefulness. I normally use Fortigate's and was wondering how PFSense might compare in functionality and was really hoping it had this packet tracer function. In my numerous Fortinet installations, the rulesets are often complex and relying on logging to quickly validate rulesets is ultimately nonsense. I use FG's "Policy Lookup" feature almost daily and is probably my most used tool built into the platform. Not having this feature eliminates PFSense from being a contender for any of my medium to large installations. It would certainly be an excellent addition to this already impressive firewall. Is there a place to submit feature requests or is this the "right" place?

                    johnpozJ 1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @jgradke
                      last edited by

                      @jgradke feature requests can be put in here

                      https://redmine.pfsense.org/

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                      NollipfSenseN 1 Reply Last reply Reply Quote 0
                      • NollipfSenseN
                        NollipfSense @johnpoz
                        last edited by

                        @johnpoz said in Packet Tracer function:

                        @jgradke feature requests can be put in here

                        https://redmine.pfsense.org/

                        John, who exactly controls: https://redmine.pfsense.org? is there an administrator and their email address?

                        pfSense+ 23.09 Lenovo Thinkcentre M93P SFF Quadcore i7 dual Raid-ZFS 128GB-SSD 32GB-RAM PCI-Intel i350-t4 NIC, -Intel QAT 8950.
                        pfSense+ 23.09 VM-Proxmox, Dell Precision Xeon-W2155 Nvme 500GB-ZFS 128GB-RAM PCIe-Intel i350-t4, Intel QAT-8950, P-cloud.

                        johnpozJ 1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @NollipfSense
                          last edited by johnpoz

                          @NollipfSense

                          redmine.jpg

                          Pretty sure anyone can create an account to put in an issue or feature request.. I don't really recall the details, since have had an account for like 13 years or something ;)

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                          NollipfSenseN 1 Reply Last reply Reply Quote 1
                          • NollipfSenseN
                            NollipfSense @johnpoz
                            last edited by

                            @johnpoz said in Packet Tracer function:

                            Pretty sure anyone can create an account to put in an issue or feature request.. I don't really recall the details, since have had an account for like 13 years or something ;)

                            My problem is I created an account but as I was submitting or clicked submit, I noticed a typo in my email address...it was too late. So, I sent an email to a person in France, who I believed was an administrator but never heard a word. I was hoping to get the error corrected so I could confirmed and activate the account. Was hoping to not have to create a new account again...but that's what it appears I may need to do.

                            pfSense+ 23.09 Lenovo Thinkcentre M93P SFF Quadcore i7 dual Raid-ZFS 128GB-SSD 32GB-RAM PCI-Intel i350-t4 NIC, -Intel QAT 8950.
                            pfSense+ 23.09 VM-Proxmox, Dell Precision Xeon-W2155 Nvme 500GB-ZFS 128GB-RAM PCIe-Intel i350-t4, Intel QAT-8950, P-cloud.

                            1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by stephenw10

                              Send me your account in chat and I'll see what I can do.

                              Though if your email is incorrect you should just be able to create another account with the correct email?

                              Steve

                              NollipfSenseN 1 Reply Last reply Reply Quote 0
                              • J
                                jgradke
                                last edited by

                                For reference I posted it as a feature request:

                                https://redmine.pfsense.org/issues/15189

                                1 Reply Last reply Reply Quote 2
                                • NollipfSenseN
                                  NollipfSense @stephenw10
                                  last edited by

                                  @stephenw10 Okay!

                                  pfSense+ 23.09 Lenovo Thinkcentre M93P SFF Quadcore i7 dual Raid-ZFS 128GB-SSD 32GB-RAM PCI-Intel i350-t4 NIC, -Intel QAT 8950.
                                  pfSense+ 23.09 VM-Proxmox, Dell Precision Xeon-W2155 Nvme 500GB-ZFS 128GB-RAM PCIe-Intel i350-t4, Intel QAT-8950, P-cloud.

                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.