URGENT HELP libvirt kvm
-
Because it hit bridge0 interface and Outbound NAT is not applied and connection Outbound from LAN to WAN that why it show private ip. Secondly LAN subnet is directly connected to pfsense it will never show you in packet capture applied NAT rules. If you sniff traffic on WAN interface and it will be inbound connection then you should see PUBLIC ip's.
-
How does that sniff make sense?? You can see pings from public ip to public IP working - sourced from a 10.x to public IP 8.8.8.8 not working..
That exactly what I am says Bridge0 interface not working !!!!!!!!!!!!!!! PFSense not FORWARDING TRAFFIC FROM PRIVATE SUBNET LAN TO PUBLIC INTERNET
-
By The way Snort fail to start. I just updated to last package. Here the log for Snort start up.
Sep 5 17:34:41 php-fpm[62471]: /snort/snort_interfaces.php: The command '/usr/pbi/snort-amd64/bin/snort -R 64956 -D -q --suppress-config-log -l /var/log/snort/snort_bridge064956 --pid-path /var/run --nolock-pidfile -G 64956 -c /usr/pbi/snort-amd64/etc/snort/snort_64956_bridge0/snort.conf -i bridge0' returned exit code '1', the output was '' Sep 5 13:34:41 snort[40294]: FATAL ERROR: pf.conf => Table snort2c does not exist in packet filter: Invalid argument Sep 5 17:34:41 php-fpm[62471]: /snort/snort_interfaces.php: [Snort] Snort START for WAN_PR01(bridge0)... Sep 5 17:34:41 php-fpm[62471]: /snort/snort_interfaces.php: [Snort] Building new sid-msg.map file for WAN_PR01... Sep 5 17:34:41 php-fpm[62471]: /snort/snort_interfaces.php: [Snort] Enabling any flowbit-required rules for: WAN_PR01... Sep 5 17:34:38 php-fpm[62471]: /snort/snort_interfaces.php: [Snort] Updating rules configuration for: WAN_PR01 ... Sep 5 17:34:38 php-fpm[62471]: /snort/snort_interfaces.php: Toggle (snort starting) for WAN_PR01(bridge0)... Sep 5 17:34:38 -
Dude, when you don't have absolutely basic shit working, why are you mesing with Snort? (Totally OT here in addition.)
-
True Agree. I am focusing on issue of BRIDGE0
-
Here are TCP settings. I disabled offload as was recommended, but result the same.
-
I was thinking what else can be. I did tcpdump on virtual host him self Fedora Server and still see private IP, which I though on this stage I should see only public ip, because pfsense should apply outbound NAT rules. What else I can check.
[root@dedi132 ~]# tcpdump -i any -vvv -nnnn -s 0 icmp 16:32:24.378774 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84) 10.18.130.50 > 8.8.8.8: ICMP echo request, id 40991, seq 641, length 64 16:32:24.378782 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84) 10.18.130.50 > 8.8.8.8: ICMP echo request, id 40991, seq 641, length 64 16:32:24.378900 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP (1), length 84) 10.18.130.50 > 8.8.8.8: ICMP echo request, id 40991, seq 641, length 64 16:32:24.378909 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP (1), length 84) 10.18.130.50 > 8.8.8.8: ICMP echo request, id 40991, seq 641, length 6 -
"Secondly LAN subnet is directly connected to pfsense it will never show you in packet capture applied NAT rules. If you sniff traffic on WAN interface and it will be inbound connection then you should see PUBLIC ip's."
What??
I assume its wan is 198.50.221.177, pretty sure in fact that is your pfsense since when I hit it I get pfsense login! That you have webgui allowed on your wan is just another F'd up thing with this setup that is for sure
why don't you PM me a login and I will take a look directly to what is going on.. What kind of BS setup do you have that devices on the lan side of pfsense would not be natted through pfsense wan?? I can tell you for sure yes you would see natted traffic on the wan and on the lan you would see the non natted traffic. So as you can see here is me pinging you on the lan interface of pfsense where it shows my private address, and there it is going out the wan with my public IP. And you can also see pfsense pinging its gateway every 1 second as it does with default apinger running.
-
Not sure why it working from WAN, I don't see any rules which will allow the access.
-
Look like firewall is not running. Logs are from Sat 5 midnight. That why you can access it.
-
Check screenshot from PFSense where on tcpdump I am capture traffic on BRIDGE0. Server on LAN is send ping, but nothing coming back. look like firewall not running or something like that.
-
show the same capture but on pfsense WAN (not bridge0)
-
BRIDGE0 is the WAN
-
In first my post I have small schema design.
-
ok, just read the thread again. Your setup looks messed up.
no other suggestion apart from restore from backup. :-) -
I think it some thing to do with firewall. Logs in web UI is not writing still from midnight Sep 5.
-
well its not pinging now.
-
I shutdown old unit. And in progress of rebuild to new unit. Left restore firewall rules. Because I need return site online.
So far everything works interfaces same setup as before all the same. And don't have idea what happened, I suspect that some thing happened with firewall, because I tried restore form backup.I am still not back online 100% but,
I want tell Everyone here HUGE THANK YOU FOR SUPPORT.
-
so now do your ping test with 8.8.8.8 on wan.. Does it show you public or private – there just is no freaking way it could work with private IP and no nat.
-
OK I was be able restore firewall and all settings. Site back online 100%. I still be live that on old vm, firewall is broken. On new vm same setup, everything work right now 100%.
Here o new vm when NAT and firewall works. On old one I so on WAN (BRIDGE0) interface private IP which mean something happened with firewall.
Again huge THANK you for help.
17:07:25.409679 IP 198.50.221.189 > 8.8.8.8: ICMP echo request, id 8256, seq 1, length 64 17:07:25.432903 IP 8.8.8.8 > 198.50.221.189 ICMP echo reply, id 8256, seq 1, length 64
