GRC Shields up site: Ping Reply: RECEIVED (FAILED)

KOM

If your modem is routing instead of bridging, then it's possible that your modem is what's replying to SU.

Your captures don't show any ping reply traffic. That Destination unreachable was to Google for whatever reason.

Mosquitor

oh hold on, I just captured packets while testing with vpnserver 2 and got this.

https://pastebin.com/z0dCx9eV

do I have to do the !IP with a different ip for vpn server 2 since its a different gateway ip?

also, I dont have access to my modem because its a wireless ISP LTE radio and they never gave me the password. Im afraid to ask them for it since they've been so good to me so far.

KOM

And no replies. What's what you would expect to see when you're blocking the traffic. They knock on your door but you don't answer. You're fine. If anything is replying to those ping requests from SU, it's not pfSense.

Mosquitor

@KOM

I did the !vpnserver1_IP in the packetcapture and got this
https://pastebin.com/0cxdS32E
still no replies

Ok. Yeah must just be the modem not in bridge mode is what grc is detecting as you said. So you're also saying hackers cant get any information about devices on my network since the requests never make it to my machine because they are blocked by pfsense? Could they get information about my modem though and attack my modem?

KOM

Either that or SU is giving a false positive. It can't be the modem or you would not see the requests at all. So nothing is replying, which makes me believe that SU is wrong.

Yes, you're protected by pfSense. As for your modem, there is nothing you can do about that.

chpalmer

@KOM said in GRC Shields up site: Ping Reply: RECEIVED (FAILED):

Take that site with a grain of salt. Steve Gibson is known to be somewhat of an alarmist.

I wish the GRCsucks.com site was still around..

Mosquitor

@KOM

Ok I understand now. Thank you very much for your help.

johnpoz

@KOM said in GRC Shields up site: Ping Reply: RECEIVED (FAILED):

somewhat of an alarmist.

Hehehe understatement of the week :)

The sky is falling is his moto for sure.. Back in the day raw packets were going to be the death of everything, hehehehe

Out of the box pfsense is "stealth" to use his stupid term..

I specifically allow pings on my wan, so I can actually have outside sites check if up ;) And I even reject the traceroute udp ports so I can get valid traceroute to my IP when remote - where it actually answers..

chpalmer

http://attrition.org/errata/charlatan/steve_gibson/

Don't get me wrong.. I think the guy is smart. To a point.

johnpoz

If you mean smart in selling snake oil to "users" sure ok ;)

chpalmer

@johnpoz said in GRC Shields up site: Ping Reply: RECEIVED (FAILED):

If you mean smart in selling snake oil to "users" sure ok ;)

Yup. :)

KOM

Yes, I remember all his hype back in the day. The sky was always going to fall, everyone ignored him and life went on as usual.

Mosquitor

It turns out, I didnt remove all of the icmp block rules. now that i have, Im having a couple of problems

is that I am seeing ICMP replies
I see my default dns which is google dns but I have dns over tls setup for cloudflare dns so I dont know why im seeing 8.8.8.8 when connected to vpn server2 and Im not sure to to fix that.

https://pastebin.com/GVSVu7BL

KOM

That's you pinging Google DNS and them replying.

Mosquitor

@KOM

ok. can you tell me how to set up a gatway group using 2 vpn servers to both use cloudflare dns over tls ? I might have missed a step while creating the config for the second server. Or should I create a new thread?

KOM

That's a new thread.

Mosquitor

ok