Odd issue with certain IP addresses not working
-
Yes, your right the top rule could be removed and the other updated to any. Thank you.
Ping does work for just about any other site from the LAN. The ICMP rule is on the WAN.
-
So I am not having any issues pinging this IP.
So you have any weird routing or using a vpn as you default route.. Maybe facebook blocks your vpn connection?
See this all the time where users using some vpn service, and whatever IP their vpn is blocked by where they are trying to go.
Do you have any routing that would send that traffic to the wrong place?
What are you running on tcp port 1 exactly - my curiosity kat only… That port is tcpmux and really I do not recall ever seeing actually used.. ever ;)
the only rule for icmp on your wan would be to allow ping to your wan.. Are you trying to port forward ping inbound? to something behind pfsense?
-
I don't have any custom routing in place. Just the defaults. I can ping most IP's from the LAN. Just having trouble with a few. Including the one I've mentioned. openVPN configured for remote access.
-
well do a traceroute to it.. could be a problem with your ISP or internet from where your at to where that IP is at.. Or could be they are blocking your isp to that IP… Like a bajaillion reasons why... Does pfsense send out the ping out your wan... Do you get an answer... Simple sniff... if your seeing the ping go out, and you don't get a response its not pfsense.. If your not seeing it go out your wan, then you need to figure out why..
-
Finally solved. Improper WAN CIDR IP value. Failing IP's were within the CIDR range specified. So, route outbound was failing.
Thanks for the help!
Do you recommend a particular plugin for logging and reporting? I'd like to set up a log server separately.
-
You mean like you set your wan IP was say 31.x.x.x and you put a /8 on it and then couldn't figure out why you couldn't get to 31.13.x.x?
-
I didn't configure the Firewall, but yep that is pretty much what happened ;D /5 actually.
-
hehehe /5 - wow!!!!
Yeah that would cause all kinds of problem… So since you mention problem going to a 31 IP... Then with a /5 your wan first octet was between 24-31... So yeah large portion of the net would of been unavailable..
Suppose to be /25 maybe?
-
Yeah it through me for a loop. Thanks again for your help. Any experience with any of the logging / reporting plugins that you would recommend?
-
Fire up your fav syslog and send there.. There really is no need for package on pfsense.. It can send to syslog out of the box. Build an ELK stack - all the kool kids are doing it ;)
