Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    2.4.2 in HA mode NBNS storm kills wan

    Scheduled Pinned Locked Moved General pfSense Questions
    18 Posts 3 Posters 1.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • H
      Heimire
      last edited by

      So here is what I did.

      Tested this and captured on LAN interfaces, then on WAN.
      Those are attached, just remove .txt if you want to view them.

      Turned off the policy route but that made no difference for this problem.

      Then I changed the LAN rule to only accept traffic from our 172.22.22.0/23 network.
      That seems to have fixed it.

      But I still have the policy routes disabled but not sure I really need them.
      I thought I got that from the HA setup but cant recall where and why.

      So I think this is a temporary fix but not sure of the consequence of disabling the rule yet.

      [capture_ fw1_WAN_failure.cap.txt](/public/imported_attachments/1/capture_ fw1_WAN_failure.cap.txt)
      capture_fw2_WAN_failure.cap.txt
      capture_fw1_novpn_no_pr_failure.cap.txt
      capture_fw2_novpn_nopr_failure.cap.txt

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        These MAC addresses are reflecting the bad Src: 172.222.22.92, Dst: 172.222.23.255 traffic that gets irresponsibly put out on WAN back and forth. Fix that and you fix your problem.

        00:a0:d1:ea:eb:f4
        00:26:6c:f1:ff:d0

        Where is this? OVH or something?

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • H
          Heimire
          last edited by

          Thats the VM that we use for this testing.
          Its a Windows 2012 server that we just changed the IP to create this situation.
          It is sitting on the Hyper-V cluster.

          The problem is that if we by accident types in 172.222.x.x instead of 172.22.x.x it creates the storm.
          We discovered that when one of the guys made exactly that mistake.

          It does not happen if we turn off backup firewall, or disable the LAN side of the backup firewall.
          The way we make the storm stop is to correct the IP and disable the WAN NIC on primary firewall.

          I changed the rules for the LAN sections to only allow 172.22.22.x/23, that is the subnet we are using.
          I also removed the policy by pass rule that you see in the image attached before.  Not sure why its there and if its needed.

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            Why is that MAC address in a pcap on WAN then? Seems you have some sorting out to do there. inside MAC addresses should never be on the WAN layer 2.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • H
              Heimire
              last edited by

              @Derelict:

              Why is that MAC address in a pcap on WAN then? Seems you have some sorting out to do there. inside MAC addresses should never be on the WAN layer 2.

              Thats what all of this has been about.
              Trying to sort that out.

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                Hint: It's not pfSense.

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • H
                  Heimire
                  last edited by

                  @Derelict:

                  Hint: It's not pfSense.

                  Please explain how it can't be pfsense.
                  Look at my network drawing.

                  2 dumb switches not connected to each other.
                  2 pfsense boxes
                  1 dumb hub.

                  The switches not connect to each other.
                  pfsense boxes are connected to switches via 2 wan interfaces.
                  pfsense boxes are connected to the dumb hub with 2 lan interfaces.

                  Only other devices involved is a laptop connected to the hub.

                  Since the switches/hub has NO connection between them, how can it not be pfsense?

                  Only thing that connects all the devices together is pfsense boxes.

                  primary pfsense is connected to switch 1 via wan
                  primary pfsense is connected to switch 2 via wan
                  primary pfense is connected to hub via lan.

                  backup pfsense is connected to switch 1 via wan
                  backup pfsense is connected to switch 2 via wan
                  backup pfense is connected to hub via lan.

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    pfSense will not put an inside MAC address on the outside without a bridge interface. period. Check your layer 2.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • H
                      Heimire
                      last edited by

                      There are no physical connection between any of the 3 switches.
                      2 of them is dumb netgear switches I purchased for this testing.
                      The hub is something very old and retired.

                      Only physical connection between them is via pfsense so I am a loss when you are saying its not pfsense.

                      Thank you for all your help, I really appreciate your input even if I am a bit confused.

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        All I can say is check again. It is pretty much impossible to have an inside MAC address on a WAN pcap without some sort of layer 2 connectivity between inside and outside.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.