Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Pfsense block ICMP echo reply from WAN to OPT1

    Scheduled Pinned Locked Moved Firewalling
    25 Posts 4 Posters 5.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      bhjitsense
      last edited by

      Double NAT works, unless of course it doesn't... I was just pointing that out in case you weren't aware. Have you checked the Cisco router if it's blocking the reply? Try pinging the WAN interface of the Cisco device.

      1 Reply Last reply Reply Quote 0
      • T
        tmedtcom
        last edited by tmedtcom

        LAN interface 172.16.0.11

        WAN interface 172.16.0.12

        OPT1 interface 192.168.10.1

        Virtual machine connected to pfsense have Ip address 192.168.10.99

        The PFSENSE graphical interface accessible from the LAN ip 172.16.0.11

        Also I ping from the pfsense to 8.8.8.8 it passes well through the CISCO router

        1 Reply Last reply Reply Quote 0
        • B
          bhjitsense
          last edited by

          So pfSense can ping 8.8.8.8 but not your device at 192.168.10.99? I'm assuming you have no other connectivity issue from this device - you can browse and stuff? Is there a firewall service running in this VM?

          1 Reply Last reply Reply Quote 0
          • T
            tmedtcom
            last edited by

            Ping from INTERNAL (OPT1) to 8.8.8.8:
            The result:
            0_1543325543441_pfs1.png

            Ping from WAN to 8.8.8.8:
            The result:
            0_1543325622878_pfs2.PNG

            B 1 Reply Last reply Reply Quote 0
            • B
              bhjitsense @tmedtcom
              last edited by

              @tmedtcom
              Interface rules? Floating rules?

              1 Reply Last reply Reply Quote 0
              • T
                tmedtcom
                last edited by

                @bhjitsense said in Pfsense block ICMP echo reply from WAN to OPT1:

                Interface rules
                The interface is INTERNAL (OPT1)
                0_1543326100409_interface rules.PNG
                FLOATING RULES/
                0_1543326172013_FLOATING.PNG

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by johnpoz

                  @tmedtcom said in Pfsense block ICMP echo reply from WAN to OPT1:

                  LAN interface 172.16.0.11
                  WAN interface 172.16.0.12

                  What? Sorry it doesn't work that way you can not have the same network on wan and lan interface..

                  And those rules on your internal are just BORKED..

                  When would internal need to talk to pfsense to talk to other internal?

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  T 1 Reply Last reply Reply Quote 0
                  • T
                    tmedtcom @johnpoz
                    last edited by

                    @johnpoz
                    LAN interface: this interface it is configured to just connecting to pfsense (ssh/web interface) just for admin.
                    WAN interface to allow users to connect to many VMs via NAT.
                    INTERNAL OPT1 this network is reserved to VMs servers on my VMware ESXI HOST.

                    B 1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      And AGAIN you can not have the same network on 2 different interfaces... This basic routing 101... I don't even think pfsense will let you do that..

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • B
                        bhjitsense @tmedtcom
                        last edited by bhjitsense

                        @tmedtcom
                        You don't nee the third rule if you have that first rule. Also, change the first rule to be INTERNAL net > INTERNAL address. Or ANY > INTERNAL address.

                        Also, post your WAN rules.

                        T 1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by johnpoz

                          WAN interface to allow users to connect to many VMs via NAT.

                          Huh? Why would you be natting between local rfc1918 networks or vm networks?

                          I have run pfsense on esxi for many years through multiple versions of esxi going back to 4.. Before that even ran it on the old school vmware server 1 and 2..

                          Please draw up how you have this stuff connected in esxi with your vswitches and connected to pfsense and how your vswitches are connected to your physical network.. Port groups, are you doing any vlan tagging anywhre or different vswitches - are they standard or distributed switches, etc. etc.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          T 1 Reply Last reply Reply Quote 0
                          • B
                            bhjitsense
                            last edited by

                            My bet is on NAT being borked. You are allowing the ICMP traffic out of INTERNAL, but it doesn't know its way back for the reply.

                            T 1 Reply Last reply Reply Quote 0
                            • T
                              tmedtcom @bhjitsense
                              last edited by

                              @bhjitsense said in Pfsense block ICMP echo reply from WAN to OPT1:

                              @tmedtcom
                              You don't nee the third rule if you have that first rule. Also, change the first rule to be INTERNAL net > INTERNAL address. Or ANY > INTERNAL address.

                              Also, post your WAN rules.

                              WAN Rules:
                              0_1543328192521_WAN rules.PNG

                              1 Reply Last reply Reply Quote 0
                              • T
                                tmedtcom @johnpoz
                                last edited by

                                @johnpoz said in Pfsense block ICMP echo reply from WAN to OPT1:

                                Huh? Why would you be natting between local rfc1918 networks or vm networks?

                                In the internal Network I have multiple web servers and in the WAN network I have a users on laptop connected to Cisco for Internet and I would like to allow users to access to my Web servers via NAT on WAN: 172.16.0.12:8080
                                So pfsense it is the intermidiate router between 2 network 172.16.0.0/24 (WAN) and 192.168.10.0/24

                                Also in ESXI 6.5 I have a standard virtual switch with 2 group port:

                                • VM network bridget to phisical card
                                • VLAN 10 => this is my Internal network
                                1 Reply Last reply Reply Quote 0
                                • T
                                  tmedtcom @bhjitsense
                                  last edited by

                                  @bhjitsense said in Pfsense block ICMP echo reply from WAN to OPT1:

                                  My bet is on NAT being borked. You are allowing the ICMP traffic out of INTERNAL, but it doesn't know its way back for the reply.

                                  Yes I also see that there is no return in the logs:
                                  0_1543329183190_state ping ICMP.png
                                  But why and how to solve it?

                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by

                                    well if you want to access from rfc1918 to networks behind pfsense via your going to have to remove that rfc1918 block for starters.

                                    If you want to use pfsense as a downstream network from your cisco then there should be a transit network and nat should only happen then talking to the internet and your cisco should nat all your downstream networks, etc.

                                    Or you should just double nat everything behind pfsense, etc.

                                    Why are you using vlan 10? Are you setting the vlans up in pfsense - what does your vswitch/port group do with the vlan(s) what do you have set on this port group, etc. etc..

                                    But you do NOT put the same network on multiple interfaces... And if your wanting to nat from rfc1918 to rfc1918 you going to have to remove that rfc1918 block.

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    1 Reply Last reply Reply Quote 0
                                    • T
                                      tmedtcom
                                      last edited by

                                      0_1543329526320_VM Network.PNG

                                      0_1543329539231_VLAN10.PNG

                                      1 Reply Last reply Reply Quote 0
                                      • T
                                        tmedtcom
                                        last edited by

                                        I tried to disable the blocking of rfc1918 but here is the error message:
                                        0_1543330335881_rfc.PNG
                                        0_1543330346338_rfc error.PNG

                                        1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by johnpoz

                                          Dude why do you have so many physical interfaces?

                                          And you firewall 2 with how many interfaces? All in the same network?

                                          Then you have all of those same interfaces in firewall 2 also in vlan port group..

                                          Yeah that screams a MESS!!

                                          And yeah told you pfsense shouldn't even let you put overlapping networks on multiple interfaces!!

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          1 Reply Last reply Reply Quote 0
                                          • R
                                            Rupesh
                                            last edited by

                                            I guess you already have a working LAN adapter on pfsense and OPT1 is your additional lan network.
                                            if that is the case then please create a new firewall rule to allow packets to pass(which you told you created already) and then in your newly created firewall rule , try changing/selecting the protocols which should be set as any by default).

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.