Strange VLAN icmp thing on hyper-v (only pfsense not replying)
-
Do you have spanning tree protocol enabled on (edit) the passthrough interfaces? Edit, sorry is late over here for me and a headache. The hyper v virtual switch as well before I edited it the first time
-
@sparkyMcpenguin
Spanning tree has nothing to do with ICMP or ARP. In fact, it has nothing to do with IP. It's a layer 2 protocol for avoiding loops.
-
i can't help with hyper-v but maybe if you show us your firewall rules we can "quadruple" check if they are good
-
@JKnott I mentioned STP only because in my network environment with vlan traffic, I needed to leave it enabled on my physical switch otherwise I would eventually encounter.. loops.. it broke network connectivity until reenabling STP (I attribute this more to unifi controller software for the time being, considering renaming the alias of each port also completely borked the install. I just went through this 3 days ago
-
@kiokoman said in Strange VLAN icmp thing on hyper-v (only pfsense not replying):
i can't help with hyper-v but maybe if you show us your firewall rules we can "quadruple" check if they are good
-
well the first rule permit everything
-
@nblazincic First one should do it right ?
Don't know how dhcp is working but ping not. -
maybe there is a solution here ? https://serverfault.com/questions/805167/hyper-v-cannot-ping-vm-from-host
-
@nblazincic said in Strange VLAN icmp thing on hyper-v (only pfsense not replying):
@nblazincic First one should do it right ?
Don't know how dhcp is working but ping not.Is the virtual switch an"external switch"? Is the host OS passing vlan traffic? Is the host OS routing through the (if external) switch as well?
By host OS I also mean the hypervisor
-
@sparkyMcpenguin said in Strange VLAN icmp thing on hyper-v (only pfsense not replying):
@nblazincic said in Strange VLAN icmp thing on hyper-v (only pfsense not replying):
@nblazincic First one should do it right ?
By host OS I also mean the hypervisor
Sorry, referring to your (host2)
-
@nblazincic said in Strange VLAN icmp thing on hyper-v (only pfsense not replying):
@nblazincic First one should do it right ?
Don't know how dhcp is working but ping not.Also by default, windows firewall blocks icmp. Check windows firewall settings (hyperv)
-
@nblazincic
on your host2 if ICMP is blocked by the host firewall (windows firewall hyperv - this specific case i do not experience personally because the windows clients on my network don't use windows firewall, but a third party av solution. with that solution, it completely disables windows firewall, allowing ICMP traffic, but blocking excessive ICMP or other things (bitdefender av with ips enabled)from my experience and training with hyperv, more so with server2016, if that's the firewall on the hypervisor, you need to check ICMP settings on its firewall. your pfsense seems fine IMO
edit additional: hyperv is a type1 hypervisor, so once enabled even the host os is now a vm (just a tid bit probably not exactly helpful)
-
@sparkyMcpenguin
You only need STP to prevent loops, as you experienced. Otherwise, it has absolutely no effect. It also has nothing to do with VLANs. Does the OP have any loops? Bottom line, it should be enabled, but I doubt it has anything to do with the problem. If loops were the issue, there would be a lot of traffic going around the loop and hogging the bandwidth.
-
@sparkyMcpenguin said in Strange VLAN icmp thing on hyper-v (only pfsense not replying):
@nblazincic
on your host2 if ICMP is blocked by the host firewall (windows firewall hyperv - this specific case i do not experience personally because the windows clients on my network don't use windows firewall, but a third party av solution. with that solution, it completely disables windows firewall, allowing ICMP traffic, but blocking excessive ICMP or other things (bitdefender av with ips enabled)from my experience and training with hyperv, more so with server2016, if that's the firewall on the hypervisor, you need to check ICMP settings on its firewall. your pfsense seems fine IMO
edit additional: hyperv is a type1 hypervisor, so once enabled even the host os is now a vm (just a tid bit probably not exactly helpful)
Firewall is disabled, but host machine is treated the same way as VM. So no firewall rules on host2 can prevent vm from comunicatting. Host is pluged in VM switch as any other VM (simple setup, one vm-switch, host and vm's are using same switch).
Additionally, if I migrate VM from host1 to host2, that same VM also can not ping its gateway. Same thing happens on native VLAN.
What is intersting, if do a packet capture on pfsense interface, I dont even get packet to it, but DHCP services functions normally.
I already tried to recreate vswitch, remove host from networking. Will try to update host2 to see if that helps.
-
@nblazincic you also said "directly connected", I assume this to mean machine to machine, no switch.
You also said static, is it possibly a gateway IP configuration issue in the adapter settings for each machine? (I assume this is set up properly or not needed to be set up as well) just trying to rule out things not mentioned
-
i just saw this, maybe related?:
@kiokoman said in Allowing ICMP/Ping From WAN to Machine On LAN for Ptunnel:
i tested it and it work for me, what machine is it? windows?
if it's windows maybe you need to do this
https://forum.netgate.com/post/895254
