Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Mystery 'Reply From' address

    Scheduled Pinned Locked Moved General pfSense Questions
    16 Posts 3 Posters 3.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ Offline
      johnpoz LAYER 8 Global Moderator
      last edited by

      "My local subnet is 172.16.x.x/24. "

      Why do you think you need to hide rfc1918 space???  Come on really???

      Also why is your dns an outside dns and not pfsense or your AD if your running that?

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      1 Reply Last reply Reply Quote 0
      • C Offline
        cmb
        last edited by

        From the looks of that, 192.168.1.250 is probably your modem. It sounds like it's doing something weird with ICMP traffic that has a TTL that's been decremented by 1 possibly (since from the 2220 itself it doesn't happen). What type of WAN and modem?

        1 Reply Last reply Reply Quote 0
        • C Offline
          Coldaddy
          last edited by

          @johnpoz I'm probably just ignorant, but am trying to learn. I pointed to the outside DNS server as a testing step…just have not set it back to the SG-2220. I got the same behavior with the pfSense firewall set as DNS server.

          Thanks for your help.
          Steve

          1 Reply Last reply Reply Quote 0
          • C Offline
            Coldaddy
            last edited by

            @cmb Cable modem is an ARRIS SURFboard SB6183. Not sure how to answer about the type of WAN…it is Time Warner cable.

            Thanks for your help.
            Steve

            1 Reply Last reply Reply Quote 0
            • C Offline
              cmb
              last edited by

              The modem should just be a bridge in that case. You have a public IP on WAN I presume?

              1 Reply Last reply Reply Quote 0
              • johnpozJ Offline
                johnpoz LAYER 8 Global Moderator
                last edited by

                rfc1918 space is not routable on the public internet.. We are all using it.. There is no reason to try and obfuscate your network that are using this space..  It just make its it harder to help you..

                I use 192.168.9.0/24 for my lan for example… pfsense is at 192.168.9.253 while my box is at 192.168.9.100

                If address space your dealing with is in the private range - there is no reason to hide any parts of this..

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • C Offline
                  Coldaddy
                  last edited by

                  @CMB Yes, WAN interface is set to use DHCP and is getting an address from Time Warner.

                  @johnpoz OK, my internal subnet is 172.16.24.0/24. pfSense firewall is .1. My PC is .55

                  If this is my cable modem I wonder why it is not consistent. I'm also not sure what I could do if it is the modem. Any thoughts on ways to troubleshoot this?

                  Again, thanks to you both for your help.

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ Offline
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    So when you ping something on your own segment

                    Pinging 172.16.x.251 with 32 bytes of data:
                    Reply from 192.168.1.250: bytes=32 time=4ms TTL=255
                    Reply from 172.16.x.251: bytes=32 time<1ms TTL=64
                    Reply from 172.16.x.251: bytes=32 time<1ms TTL=64

                    And you get a response from something else along with the response from the actual device..  Does this device have multiple IPs?  What is this device 172.16.24.251 your pinging for example??

                    And you say you have nothing on your network using 192.168.1.?

                    What happens when you try and ping that 192.168.1. address that you got a reply from?  These are wired and not wireless.. Do you have wireless how is it connected?

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • C Offline
                      Coldaddy
                      last edited by

                      The device I am pinging (.251) is the Wireless Access Point…it is a Wireless Router but is in WAP mode. It is on the same network but not in the connectivity path. It does not have multiple IPs...it gets one from the pfSense DHCP server and the .251 address is reserved for it.

                      Yes, there is no 192.168.1.0 network. There was in the past (a couple of months ago). That network was provided by the Wireless Router when it was in router mode.

                      Pinging the 192.168.1.250 address:
                      PS C:\Windows\system32> ping 192.168.1.250

                      Pinging 192.168.1.250 with 32 bytes of data:
                      Reply from 192.168.1.250: bytes=32 time=4ms TTL=255
                      Reply from 192.168.1.250: bytes=32 time=4ms TTL=255
                      Reply from 192.168.1.250: bytes=32 time=4ms TTL=255
                      Reply from 192.168.1.250: bytes=32 time=4ms TTL=255

                      Ping statistics for 192.168.1.250:
                          Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
                      Approximate round trip times in milli-seconds:
                          Minimum = 4ms, Maximum = 4ms, Average = 4ms

                      Everything I am working with right now is wired. I do have a wireless access point and it just participates in the internal subnet provided by the pfSense firewall. It is 172.16.24.251.

                      Pinging from the WAP:
                      PING www.yahoo.com (98.138.253.109): 56 data bytes
                      64 bytes from 98.138.253.109: seq=0 ttl=44 time=66.914 ms
                      64 bytes from 98.138.253.109: seq=1 ttl=44 time=51.565 ms
                      64 bytes from 98.138.253.109: seq=2 ttl=44 time=80.229 ms
                      64 bytes from 98.138.253.109: seq=3 ttl=44 time=57.837 ms

                      –- www.yahoo.com ping statistics ---
                      4 packets transmitted, 4 packets received, 0% packet loss
                      round-trip min/avg/max = 51.565/64.136/80.229 ms

                      1 Reply Last reply Reply Quote 0
                      • C Offline
                        Coldaddy
                        last edited by

                        Also, pinging 192.168.1.250 from the pfSense firewall fails:
                        PING 192.168.1.250 (192.168.1.250): 56 data bytes

                        –- 192.168.1.250 ping statistics ---
                        3 packets transmitted, 0 packets received, 100.0% packet loss

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ Offline
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          Well yeah pfsense would fail trying to ping that IP since it would send it out its default gateway interface..

                          So you can ping that from your box…  Look in your arp table what is the mac on that 192.168 AP..  What does that equal assuming its your AP..  Which is what exactly??

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • C Offline
                            Coldaddy
                            last edited by

                            It's not in the arp table:

                            PS C:\Windows\system32> ping 192.168.1.250

                            Pinging 192.168.1.250 with 32 bytes of data:
                            Reply from 192.168.1.250: bytes=32 time=4ms TTL=255
                            Reply from 192.168.1.250: bytes=32 time=4ms TTL=255
                            Reply from 192.168.1.250: bytes=32 time=4ms TTL=255
                            Reply from 192.168.1.250: bytes=32 time=4ms TTL=255

                            Ping statistics for 192.168.1.250:
                                Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
                            Approximate round trip times in milli-seconds:
                                Minimum = 4ms, Maximum = 4ms, Average = 4ms
                            PS C:\Windows\system32> arp -a

                            Interface: 172.16.24.55 –- 0x6
                              Internet Address      Physical Address      Type
                              172.16.24.1          00-08-a2-09-c6-69    dynamic
                              172.16.24.4          00-26-b9-88-ac-16    dynamic
                              172.16.24.19          00-11-32-02-e6-4e    dynamic
                              172.16.24.50          ac-3a-7a-a6-98-39    dynamic
                              172.16.24.51          50-1a-c5-ed-33-db    dynamic
                              172.16.24.53          a0-88-69-14-b1-62    dynamic
                              172.16.24.59          7c-1e-52-86-20-cc    dynamic
                              172.16.24.62          5c-ad-cf-8e-bb-9c    dynamic
                              172.16.24.251        1c-b7-2c-d9-95-d0    dynamic
                              172.16.24.255        ff-ff-ff-ff-ff-ff    static
                              224.0.0.2            01-00-5e-00-00-02    static
                              224.0.0.22            01-00-5e-00-00-16    static
                              224.0.0.251          01-00-5e-00-00-fb    static
                              224.0.0.252          01-00-5e-00-00-fc    static
                              224.0.0.253          01-00-5e-00-00-fd    static
                              239.255.255.250      01-00-5e-7f-ff-fa    static
                              255.255.255.255      ff-ff-ff-ff-ff-ff    static

                            This is such a weird issue.

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ Offline
                              johnpoz LAYER 8 Global Moderator
                              last edited by

                              do a traceroute to it..

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • C Offline
                                Coldaddy
                                last edited by

                                PS C:\Windows\system32> tracert 192.168.1.250

                                Tracing route to 192.168.1.250 over a maximum of 30 hops

                                1    <1 ms    <1 ms    <1 ms  172.16.24.1
                                  2    4 ms    5 ms    4 ms  192.168.1.250

                                Trace complete.

                                1 Reply Last reply Reply Quote 0
                                • C Offline
                                  cmb
                                  last edited by

                                  That's almost certainly your modem. 4 ms is too low for it to be traversing the coax and looks to be too consistently 4 ms for that as well.

                                  I haven't heard of anyone else seeing anything like that. Though there is some buggy firmware going around on TWC for SB6183 modems, I'd only heard of it breaking IPv6, not doing stupid things with IPv4. See this thread for instance, and the links to dslreports there.
                                  https://forum.pfsense.org/index.php?topic=108971.0

                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.