Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    I can ping PFSense but PFSense can't ping back

    Scheduled Pinned Locked Moved General pfSense Questions
    42 Posts 7 Posters 13.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator
      last edited by johnpoz

      @striker-0 said in I can ping PFSense but PFSense can't ping back:

      255.255.255.0 > 10.0.100.51:

      That is NOT right it sould be pinging from pfsense IP on that 10.0.100 network..

      re0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
      	options=82098<VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC,LINKSTATE>
      	capabilities=18399b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,TSO4,WOL_UCAST,WOL_MCAST,WOL_MAGIC,LINKSTATE,NETMAP>
      	ether 00:11:09:d7:2b:fa
      	hwaddr 00:11:09:d7:2b:fa
      	inet6 fe80::211:9ff:fed7:2bfa%re0 prefixlen 64 scopeid 0x2
      	inet 10.0.100.1 netmask 0xffffff00 broadcast 10.0.100.255
      	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
      	media: Ethernet autoselect (1000baseT <full-duplex,master>)
      	status: active
      

      That is the IP it should be pinging from 10.0.100.1

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      K 1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate @-striker- 0
        last edited by

        @striker-0 Post a packet capture taken on each interface of pings that work and pings that fail.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        - 1 Reply Last reply Reply Quote 0
        • -
          -striker- 0 @Konstanti
          last edited by

          @konstanti at the moment, my NORDVPN tunnel is down. I see no difference in activity when the tunnel is up or down.

          1 Reply Last reply Reply Quote 0
          • K
            Konstanti @johnpoz
            last edited by Konstanti

            @johnpoz
            All this is very strange, because of the webgui
            pfsense is also forming a command
            / sbin/ping -S 10.0.100.1 -c 3 10.0.100.51 (as seen in the picture)
            and tcpdump shows another

            1 Reply Last reply Reply Quote 0
            • -
              -striker- 0 @Derelict
              last edited by

              @derelict Here is a packet capture from pfsense where I tried to ping 10.0.100.51 on the LAN interface and it failed.

              12:47:22.869939 00:11:09:d7:2b:fa > 00:22:15:9f:4b:51, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 14477, offset 0, flags [none], proto ICMP (1), length 84)
              255.255.255.0 > 10.0.100.51: ICMP echo request, id 49230, seq 0, length 64
              12:47:23.875326 00:11:09:d7:2b:fa > 00:22:15:9f:4b:51, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 41292, offset 0, flags [none], proto ICMP (1), length 84)
              255.255.255.0 > 10.0.100.51: ICMP echo request, id 49230, seq 1, length 64
              12:47:24.877890 00:11:09:d7:2b:fa > 00:22:15:9f:4b:51, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 38991, offset 0, flags [none], proto ICMP (1), length 84)
              255.255.255.0 > 10.0.100.51: ICMP echo request, id 49230, seq 2, length 64

              pfsense packet capture doesn't seem to capture any packets when I ping from my workstation to the server even with the use of promiscuous mode. Any suggestions on a tool to capture the information you are looking for?

              K 1 Reply Last reply Reply Quote 0
              • K
                Konstanti @-striker- 0
                last edited by Konstanti

                @striker-0
                0_1548615129595_f1b4a77b-657e-4585-ae4a-450e95d008d0-image.png

                Need a file that you download after clicking " Download capture"

                - 1 Reply Last reply Reply Quote 0
                • -
                  -striker- 0 @Konstanti
                  last edited by

                  @konstanti capture download attached. Forums wouldn't accept a .cap file, so I zipped it.

                  0_1548615280401_packetcapture(1).zip

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    Great. What are we looking at?

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    K - 2 Replies Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      its pinging from 255.255.255.0 - so no that is never going to work.

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • K
                        Konstanti @Derelict
                        last edited by

                        @derelict
                        0_1548615516334_63c7b4a4-fc6d-4d81-a71a-7fe12ddeb6db-image.png

                        1 Reply Last reply Reply Quote 0
                        • DerelictD
                          Derelict LAYER 8 Netgate
                          last edited by

                          It looks like you have what should be a netmask somewhere that should be an address. As was said earlier, this makes no sense:

                          Source: 255.255.255.0

                          What interface is that capture taken on?

                          The only thing that could do that that I can think of is Outbound NAT on that interface being completely misconfigured. Outbound NAT would also only affect traffic in that direction.

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          - 1 Reply Last reply Reply Quote 0
                          • -
                            -striker- 0 @Derelict
                            last edited by

                            @derelict That is a packet capture taken while performing a ping command from the LAN interface to 10.0.100.51.

                            The packet capture was capturing ICMP IPV4 traffic activity from the LAN interface with the promiscuous setting enabled and set to capture full detail.

                            1 Reply Last reply Reply Quote 0
                            • -
                              -striker- 0 @Derelict
                              last edited by

                              @derelict I do not have any outbound NAT configured against my LAN interface, only WAN.

                              0_1548615917208_Outbound NAT.JPG

                              K 1 Reply Last reply Reply Quote 0
                              • DerelictD
                                Derelict LAYER 8 Netgate
                                last edited by

                                Well you have something configured completely wrong.

                                Navigate here: https://your_firewall_ip/status.php

                                Download the resulting status_output.tgz file

                                Upload it to the nextcloud link I sent to you in chat.

                                Chattanooga, Tennessee, USA
                                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                - 1 Reply Last reply Reply Quote 0
                                • -
                                  -striker- 0 @Derelict
                                  last edited by

                                  @derelict I don't doubt that something is configured wrong, but I can't figure it out for the life of me. I greatly appreciate the assistance everyone has been offering!

                                  File has been uploaded as requested.

                                  1 Reply Last reply Reply Quote 0
                                  • K
                                    Konstanti @-striker- 0
                                    last edited by

                                    @striker-0
                                    Try to reduce the speed of the interface to 100 Mbit. I have a feeling ,that the network card (realtek ) is not working properly

                                    - 1 Reply Last reply Reply Quote 0
                                    • -
                                      -striker- 0 @Konstanti
                                      last edited by

                                      @konstanti Tried bumping it down to 100 full duplex, flow control. Same result. Tried going down to 10 full duplex, still the same result. I have now put it back to the default setting.

                                      1 Reply Last reply Reply Quote 0
                                      • DerelictD
                                        Derelict LAYER 8 Netgate
                                        last edited by Derelict

                                        binat on re0 from any to any -> 255.255.255.0

                                        There's your problem.

                                        Disable this 1:1 NAT:

                                        <onetoone>
                                                    <external>255.255.255.0</external>
                                                    <descr></descr>
                                                    <interface>lan</interface>
                                                    <source>
                                                        <any></any>
                                                    </source>
                                                    <destination>
                                                        <any></any>
                                                    </destination>
                                        </onetoone>
                                        

                                        Chattanooga, Tennessee, USA
                                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                        - 1 Reply Last reply Reply Quote 0
                                        • -
                                          -striker- 0 @Derelict
                                          last edited by

                                          @derelict Found it. It was under the 1:1 NAT mappings. I honestly don't remember ever creating that rule.

                                          Thank you so much!

                                          1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator
                                            last edited by

                                            If I had to guess it was some sort of attempt at allowing wol from wan?

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.