PFSense problem on Openstack/KVM

[roberto.bertucci]

Hello, i just deployed a pfsense in a openstack/KVM environment.
It seems that as soon as traffic to/trough firewall raises, connections are dropped.
For example: ping to firewall interfaces is working, ssh connections freeze and then drop after few commands, web access is simply impossible.

The problem is the same for VM behind pfsense (on LAN network).
Ping to public ips are ok but other protocols (nslookup, http, https) simply don't work.
Ping to PFSense works but https/ssh don't.
I checked rules but at the moment it's a default installation with all traffic enabled from LAN to internet and ssh to firewall enabled.

Is there anyone with a hint/suggestion?

Thank you

[viragomann]

Have you disabled "Hardware Checksum Offloading" in System > Advanced > Networking?

[roberto.bertucci]

Thank you for your answer. I am not able to access to web interface.
Do you know how to disable it by editing xml configuration file?
I looked for that parameter but i wasn't able to find it.

[viragomann]

@roberto-bertucci said in PFSense problem on Openstack/KVM:

I am not able to access to web interface.

Why not?

@roberto-bertucci said in PFSense problem on Openstack/KVM:

Do you know how to disable it by editing xml configuration file?
I looked for that parameter but i wasn't able to find it.

Yeah, you can't find the setting in the XML if the disable option is not checked.

You have to add this line to the 'system' section:

<system>
.
.
.
    <disablechecksumoffloading></disablechecksumoffloading>
</system>

[roberto.bertucci]

@viragomann said in PFSense problem on Openstack/KVM:

@roberto-bertucci said in PFSense problem on Openstack/KVM:

I am not able to access to web interface.

Why not?

This is part of my problems. Simply, web interface is not reponding to connections from LAN or WAN side.
nginx.log says nothing and i am stuck on this first problem (it would be great to have any hint on this too :D ) .
I don't see any correlation with connections dropping and i was trying to solve this before any other issue to be able to connect via ssh and do an easyer debug instead f working in VM console.

BTW, i am going to apply change in config.xmal and will et you know if it worked.

Thank you again

[roberto.bertucci]

Sorry to have left too much time before answering....
The actual status: i disabled Hardware Checksum offloading, but the behaviour is still the same.
I can connect to pfsense via ssh but sistematically, as i try a 'top' command or a 'tail -f' on a file (for example), i get no output and my ssh session closes with timeout reason.

Daoes this sounds familiar to anyone?

[stephenw10]

Not really. But if ping works OK and TCP doesn't asides from any sort of TCP off-loading you might have an asymmetric route somehow.

Steve

[roberto.bertucci]

I don't think so. I have another VM with strongswan vpn server and it is working fine.
I move public IP from strongswan to pfsense and viceversa.

Strongswan does not have any problem but i need to use pfsense because i have the suspect that it is non performig as it is needed.

Thank you,
Roberto

[stephenw10]

Can it connect out? If you run the update from the console (menu option 13) does it successfully check for updates?

Steve

[roberto.bertucci]

Evrey kind of operation i do on WAN side has the problem i wrote about.
If i use LAN connection everithing works fine. Internal client navigation is also fine.

The real problem is that dropping on incoming internet connections does not allow to establish for example VPN tunnels.
Target firewalls see and establish phase1 but when they try to establish phase2 they find closed connection....

[stephenw10]

Ok so that's a change since your first post here when you were not able to SSH to pfSense. What changed?

When you run option 13 from the console does it fail? What error is shown?

Steve

[roberto.bertucci]

If i run it by ssh-ing LAN interface, it works fine. If i run from a ssh WAN session it fails for connection time-out with my client.
It seems that pfsense looses connection on WAN.
I am not sure that the problem is in PFsense firewall.
I suspect in something related to openstack/KVM setup.

[stephenw10]

Could be. But how does it fail outbound? No way to advise further without at least some errors to go on.

Steve

[roberto.bertucci]

Solved! it was a MTU issue. I left the default 1500 on WAN but i need to use 1450.

Now another question: where is the configuration file or the WEB configuratore entry to make MTU persistent through reboots?

It seems that operating system files used are not the standard ones.....

[stephenw10]

In Interfaces > WAN. There is a field for setting the MTU.

Steve

[kiokoman]

it's best not to modify directly the configuration files, most of the times they are overwritten at boot or after an update set the mtu on the gui, here

login-to-view

[roberto.bertucci]

Thank you all, i modified configuration via web configurator and it works perfectly.

Thank you again.

Roberto