PFSense problem on Openstack/KVM
-
Sorry to have left too much time before answering....
The actual status: i disabled Hardware Checksum offloading, but the behaviour is still the same.
I can connect to pfsense via ssh but sistematically, as i try a 'top' command or a 'tail -f' on a file (for example), i get no output and my ssh session closes with timeout reason.Daoes this sounds familiar to anyone?
-
Not really. But if ping works OK and TCP doesn't asides from any sort of TCP off-loading you might have an asymmetric route somehow.
Steve
-
I don't think so. I have another VM with strongswan vpn server and it is working fine.
I move public IP from strongswan to pfsense and viceversa.Strongswan does not have any problem but i need to use pfsense because i have the suspect that it is non performig as it is needed.
Thank you,
Roberto -
Can it connect out? If you run the update from the console (menu option 13) does it successfully check for updates?
Steve
-
Evrey kind of operation i do on WAN side has the problem i wrote about.
If i use LAN connection everithing works fine. Internal client navigation is also fine.The real problem is that dropping on incoming internet connections does not allow to establish for example VPN tunnels.
Target firewalls see and establish phase1 but when they try to establish phase2 they find closed connection.... -
Ok so that's a change since your first post here when you were not able to SSH to pfSense. What changed?
When you run option 13 from the console does it fail? What error is shown?
Steve
-
If i run it by ssh-ing LAN interface, it works fine. If i run from a ssh WAN session it fails for connection time-out with my client.
It seems that pfsense looses connection on WAN.
I am not sure that the problem is in PFsense firewall.
I suspect in something related to openstack/KVM setup. -
Could be. But how does it fail outbound? No way to advise further without at least some errors to go on.
Steve
-
Solved! it was a MTU issue. I left the default 1500 on WAN but i need to use 1450.
Now another question: where is the configuration file or the WEB configuratore entry to make MTU persistent through reboots?
It seems that operating system files used are not the standard ones.....
-
In Interfaces > WAN. There is a field for setting the MTU.
Steve
-
it's best not to modify directly the configuration files, most of the times they are overwritten at boot or after an update set the mtu on the gui, here
-
Thank you all, i modified configuration via web configurator and it works perfectly.
Thank you again.
Roberto
