TCP:SA getting blocked by Firewall
-
I am seeing that pfSense is blocking TCP:SA packets from network1 –> network2.
net1 is LAN on pfSense and network2 is routed through ospf with a router. pfSense is running Quagga OSPFd.
pfSense is blocking TCP replies to network2 hosts.
I have allowed all internal networks to pass through LAN interface. I have also enabled Bypass firewall rules for traffic on the same interface option located under System > Advanced on the Firewall/NAT tab with no luck.
Need some help with this.
-
Sounds like asymmetrical to me - this for sure will cause out of state traffic. And then blocked.. Draw up your network and we can help you fix it.
-
Thank you for the response.
The host in 192.168.50.0/24 network is trying to establish TCP session with host in 192.168.100.0/24 network. pfSense is blocking TCP replies to .50 network.
HTH
-
Yeah because your host on 192.168.100 is on the transit network..
You do not put hosts on a transit network without having to do host routing on each host.
Connect your downstream router to pfsense via actual transit network and all your problems go away and you will not have asymmetrical… In your setup 50.x wants to talk to 100.x so it hits 50.1 router and that router says oh sure I have 100 directly attached send the SYN.. Your 100.x box gets the syn and says where and the F is 192.168.50.x - send it to my gateway (pfsense).
PFsense you want to talk to where 50.x sure I have a route there but where was the SYN.. Your SYN,ACK (SA) is out of state - I am a stateful firewall = blocked!
Connect your downstream router via a transit.. say 192.168.75/30 and now you have no problem with asymmetrical routing.
-
I know this is a quite old topic but I will put my solution in here just in case someone come across with the same problem.
Usually, the "TCP:SA" gets blocked by the firewall because the package took a different path on its way back. Pfsense being a stateful firewall needs to know the full path before letting the package go in. The package path should be the same to the network destination and from the network destination any discrepancy in the path the firewall will block it.
If you trust on the IP/Network getting blocked you should set up a thing known as asymmetric routing explained here.
This helped me with my issue today. I hope this comment help someone some other day.
-
Thanks a million @peterfranca!
I had been struggling to get my Unifi switch to be adopted by my Unifi controller instance.
pfSense was blocking it with the default IPv4 rule no matter what firewall rule I put in.
The link you provided solved the problem.
Been hitting my head against the wall for days. You are a champ.
IT
