Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Can't get to login.microsoft.com

    Scheduled Pinned Locked Moved General pfSense Questions
    24 Posts 6 Posters 3.5k Views 6 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • V Offline
      viragomann
      last edited by

      Are you running pfBlockerNG? Maybe it is blocking the site.

      1 Reply Last reply Reply Quote 0
      • stephenw10S Online
        stephenw10 Netgate Administrator
        last edited by

        Define 'I turn off the firewall'.

        How exactly does it fail when connecting from behind pfSense? Timeout? Can't resolve?

        Steve

        1 Reply Last reply Reply Quote 0
        • D Offline
          dcihon
          last edited by

          I am on the pfsense now.
          Let me start off by saying I know little about this system.
          How do I know if I have pfBlokerNG?
          Turn off the firewall means this.
          I have a wired connection that is behind the firewall.
          That is when it doesn't work. It just never connects to the site.
          When I disconnect the ethernet and go wireless it connects to the site just fine.
          Thanks
          Dan

          stephenw10S 1 Reply Last reply Reply Quote 0
          • stephenw10S Online
            stephenw10 Netgate Administrator @dcihon
            last edited by

            @dcihon said in Can't get to login.microsoft.com:

            How do I know if I have pfBlockerNG?

            When you connect to the pfSense webgui it would be shown in the Firewall menu.

            Check the firewall logs in Status > System Logs > Firewall tab. Do you see any blocked traffic from your client when you try to access it?

            Try to resolve login.microsoft.com from Diagnostics > DNS Lookup. Do you see a real IP?
            Can you resolve it directly fro your client behind the firewall?

            Steve

            1 Reply Last reply Reply Quote 0
            • D Offline
              dcihon
              last edited by

              I don't have pFBlockerBG installed.
              I found that out.
              The DNS lookup finds several IP addresses for login.microsoft.com
              I can not ping or tracert to it.
              It does not show up in the firewall as blocked that I can see. Not sure if I am looking at the correct place.
              I can not resolve it directly behind the firewall.
              What can I try next.

              1 Reply Last reply Reply Quote 0
              • stephenw10S Online
                stephenw10 Netgate Administrator
                last edited by

                Ok, so pfSense can resolve it. Does it show a reply from all the DNS servers listed there?
                I could imagine external server resolve it but localhost (127.0.0.1) does not perhaps?

                Check Services > DNS Resolver. Is it enabled? If not check the DNS Forwarder instead.
                In whichever is enabled look for host or domain overrides for *.microsoft.com.
                Remove them if there are any.

                If not then make sure your client is actually using pfSense for DNS.

                Steve

                1 Reply Last reply Reply Quote 0
                • D Offline
                  dcihon
                  last edited by

                  When I do ipconfig /all it shows 127.0.0.1 for dns
                  I have turned DNS Resolver on and off. I have turned DNS Forwarder on and off.
                  None of it seems to make a difference.
                  I don't see any *.microsoft.com listed anywhere. That doesn't mean it's not there.

                  How should I have this set up?
                  Use DNS Resolver or DNS Forwarder or both or none?
                  Looking for guidance here. I appreciate the help.
                  I am not opposed to someone taking over my machine and taking a look at this with me if that would help.

                  What should I do next?

                  1 Reply Last reply Reply Quote 0
                  • provelsP Online
                    provels
                    last edited by

                    Can you traceroute (or tracert in Windows) to login.microsoft.com? Could be an ISP or backbone issue.

                    Peder

                    MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
                    BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

                    1 Reply Last reply Reply Quote 0
                    • D Offline
                      dcihon
                      last edited by

                      C:\WINDOWS\system32>tracert login.microsoft.com

                      Tracing route to san.current.a.prd.aadg.akadns.net [40.126.0.70]
                      over a maximum of 30 hops:

                      1 <1 ms <1 ms <1 ms pfsense.eaglestl.com [192.168.1.1]
                      2 * * * Request timed out.
                      3 * * * Request timed out.
                      4 * * * Request timed out.
                      5 * * * Request timed out.
                      6 * * * Request timed out.
                      7 * * * Request timed out.
                      8 * * * Request timed out.
                      9 * * * Request timed out.
                      10 * * * Request timed out.
                      11 * * * Request timed out.
                      12 * * * Request timed out.
                      13 * * * Request timed out.
                      14 * * * Request timed out.
                      15 * * * Request timed out.
                      16 * * * Request timed out.
                      17 * * * Request timed out.
                      18 * * * Request timed out.
                      19 * * * Request timed out.
                      20 * * * Request timed out.
                      21 * * * Request timed out.
                      22 * * * Request timed out.
                      23 * * * Request timed out.
                      24 * * * Request timed out.
                      25 * * * Request timed out.
                      26 * * * Request timed out.
                      27 * * * Request timed out.
                      28 * * * Request timed out.
                      29 * * * Request timed out.
                      30 * * * Request timed out.

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S Online
                        stephenw10 Netgate Administrator
                        last edited by

                        Ok, so the client also resolves it but that cannot reach it.
                        By default the DNS resolver should be enabled and pfSense will hand it's internal interface IP to client to use for DNS.

                        Does pfSense also fail when trying to traceroute at every step like that?

                        If so it's either blocked somewhere upstream or you have a bad route somewhere.
                        Check Diag > Routes, do you have any subnets defined containing that IP?

                        Steve

                        1 Reply Last reply Reply Quote 0
                        • GertjanG Offline
                          Gertjan
                          last edited by

                          Probably an upstream router that blocks all ICMP requests.
                          That explains the total absence of replies.

                          No "help me" PM's please. Use the forum, the community will thank you.
                          Edit : and where are the logs ??

                          1 Reply Last reply Reply Quote 0
                          • D Offline
                            dcihon
                            last edited by

                            This is what I get when I do a tracert from pfsense.
                            1 * * *
                            2 * *traceroute: wrote www.tm.a.prd.aadg.trafficmanager.net 40 chars, ret=-1
                            *
                            3 traceroute: wrote www.tm.a.prd.aadg.trafficmanager.net 40 chars, ret=-1
                            *traceroute: wrote www.tm.a.prd.aadg.trafficmanager.net 40 chars, ret=-1
                            *traceroute: wrote www.tm.a.prd.aadg.trafficmanager.net 40 chars, ret=-1
                            *
                            4 traceroute: wrote www.tm.a.prd.aadg.trafficmanager.net 40 chars, ret=-1
                            *traceroute: wrote www.tm.a.prd.aadg.trafficmanager.net 40 chars, ret=-1
                            *traceroute: wrote www.tm.a.prd.aadg.trafficmanager.net 40 chars, ret=-1
                            *

                            This is from the routing table.

                            code_textdefault	47.47.60.89	UGS	66550	1500	bce0	
                            40.0.0.0/5	link#3	U	2827313	1500	bce1	
                            40.139.91.18	link#3	UHS	0	16384	lo0	
                            47.47.60.88/29	link#1	U	2593273	1500	bce0	
                            47.47.60.90	link#1	UHS	0	16384	lo0	
                            66.148.187.136/29	link#3	U	2603986	1500	bce1	
                            66.148.187.139	link#3	UHS	0	16384	lo0	
                            66.148.187.139/32	link#3	U	0	1500	bce1	
                            66.148.187.140	link#3	UHS	0	16384	lo0	
                            127.0.0.1	link#7	UH	604	16384	lo0	
                            172.16.1.0/24	192.168.1.5	UGS	0	1500	re0	
                            192.168.1.0/24	link#2	U	37862400	1500	re0	
                            192.168.1.1	link#2	UHS	0	16384	lo0	
                            208.67.220.220	47.47.60.89	UGHS	16413	1500	bce0	
                            208.67.222.222	47.47.60.89	UGHS	16530	1500	bce0	
                            IPv6 Routes
                            Destination	Gateway	Flags	Use	Mtu	Netif	Expire
                            ::1	link#7	UH	0	16384	lo0	
                            fe80::%bce0/64	link#1	U	0	1500	bce0	
                            fe80::219:b9ff:fede:bb5d%bce0	link#1	UHS	0	16384	lo0	
                            fe80::%re0/64	link#2	U	0	1500	re0	
                            fe80::ca3a:35ff:fede:f20d%re0	link#2	UHS	0	16384	lo0	
                            fe80::%bce1/64	link#3	U	0	1500	bce1	
                            fe80::219:b9ff:fede:bb5b%bce1	link#3	UHS	0	16384	lo0	
                            fe80::%lo0/64	link#7	U	0	16384	lo0	
                            fe80::1%lo0	link#7	UHS	0	16384	lo0	
                            ff01::%bce0/32	fe80::219:b9ff:fede:bb5d%bce0	U	0	1500	bce0	
                            ff01::%re0/32	fe80::ca3a:35ff:fede:f20d%re0	U	0	1500	re0	
                            ff01::%bce1/32	fe80::219:b9ff:fede:bb5b%bce1	U	0	1500	bce1	
                            ff01::%lo0/32	::1	U	0	16384	lo0	
                            ff02::%bce0/32	fe80::219:b9ff:fede:bb5d%bce0	U	0	1500	bce0	
                            ff02::%re0/32	fe80::ca3a:35ff:fede:f20d%re0	U	0	1500	re0	
                            ff02::%bce1/32	fe80::219:b9ff:fede:bb5b%bce1	U	0	1500	bce1	
                            ff02::%lo0/32	::1	U	0	16384	lo0	
                            
                            pfSense is © 2004 - 2019 by Rubicon Communications, LLC (Netgate). All Rights Reserved. [view license] 
                            
                            1 Reply Last reply Reply Quote 0
                            • johnpozJ Offline
                              johnpoz LAYER 8 Global Moderator
                              last edited by johnpoz

                              @dcihon said in Can't get to login.microsoft.com:

                              C:\WINDOWS\system32>tracert login.microsoft.com
                              Tracing route to san.current.a.prd.aadg.akadns.net [40.126.0.70]

                              So notice the 40.126 address... Now notice his routing table...

                              40.0.0.0/5	link#3	U	2827313	1500	bce1	
                              

                              No shit he can not get there ;)

                              I take it there is a shit ton of stuff he can not get to - and this is just 1 has noticed.

                              40.0.0.0 - 47.255.255.255

                              That is a LOT Of addresses... He thinks are directly attacked to his link#3 ;)

                              Someone has a typo on their mask would be my guess.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 25.07 | Lab VMs 2.8, 25.07

                              1 Reply Last reply Reply Quote 0
                              • D Offline
                                dcihon
                                last edited by

                                So can you give me some help on how to fix this?
                                Where do I go in pfsense to change it so it doesn't route there or whatever I should do to fix this.

                                1 Reply Last reply Reply Quote 0
                                • GertjanG Offline
                                  Gertjan
                                  last edited by Gertjan

                                  @dcihon said in Can't get to login.microsoft.com:

                                  So can you give me some help on how to fix this?

                                  What is your WAN IP / LAN IP ?
                                  WAN is static ? DHCP ?

                                  No "help me" PM's please. Use the forum, the community will thank you.
                                  Edit : and where are the logs ??

                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ Offline
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by johnpoz

                                    Looks like maybe someone pulled some IP range out of their you know what and said lets use this..

                                    What network is connected to bce1?

                                    Looks like the default route is on that /29 network on bce0

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 25.07 | Lab VMs 2.8, 25.07

                                    1 Reply Last reply Reply Quote 0
                                    • D Offline
                                      dcihon
                                      last edited by

                                      My WAN IP is : 47.47.60.90
                                      There are 2 internet connections at this office .
                                      Lan IP is 192.168.1.60
                                      WAN is static.
                                      DHCP coming from pfsense LAN interface.

                                      GertjanG 1 Reply Last reply Reply Quote 0
                                      • GertjanG Offline
                                        Gertjan @dcihon
                                        last edited by

                                        More info about this one :
                                        @dcihon said in Can't get to login.microsoft.com:

                                        My WAN IP is : 47.47.60.90

                                        Where did it came from ? Mask ?

                                        ( @johnpoz : let's get ready for the ROFL )

                                        No "help me" PM's please. Use the forum, the community will thank you.
                                        Edit : and where are the logs ??

                                        1 Reply Last reply Reply Quote 0
                                        • D Offline
                                          dcihon
                                          last edited by

                                          Not sure how to answer these questions.
                                          Does this help.
                                          Windstream WINDSTREAMWAN 66.148.187.137 66.148.187.137 Windstream Gateway
                                          WSvlan1GWE LAN 192.168.1.5 192.168.1.5 vlan1 IP on WS Router
                                          WindstreamWANGW WINDSTREAMWAN 40.139.91.17 40.139.91.17
                                          CharterWANGW (default) CHARTERWAN 47.47.60.89 47.47.60.89 Charter

                                          1 Reply Last reply Reply Quote 0
                                          • johnpozJ Offline
                                            johnpoz LAYER 8 Global Moderator
                                            last edited by johnpoz

                                            @dcihon said in Can't get to login.microsoft.com:

                                            40.0.0.0/5 link#3 U 2827313 1500 bce1
                                            40.139.91.18 link#3 UHS 0 16384 lo0

                                            Where did that come from... Looks someone put a 40.139.91.18 address on pfsense with a mask of /5

                                            WindstreamWANGW WINDSTREAMWAN 40.139.91.17 40.139.91.17

                                            That is not suppose to be a /5 that is for sure ;)

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 25.07 | Lab VMs 2.8, 25.07

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.