pfSense Rewrites Source IP for ICMP Errors Breaking Traceroute

Alex Atkin UK

@miki725 Is it the same problem documented here? https://redmine.pfsense.org/issues/9263

Gertjan

You're using traffic (ICMP) shaping ?

johnpoz

Sure looks like that is his problem... @Alex-Atkin-UK

miki725

@Alex-Atkin-UK

ooooh. I forgot about the limiter:

can confirm that when I disabled floating rule with the queue, traceroute works as expected inside LAN.

Thank a lot for linking to that. Now would be curious why a limiter would have that affect.

johnpoz

@miki725 said in pfSense Rewrites Source IP for ICMP Errors Breaking Traceroute:

Now would be curious why a limiter would have that affect.

It shouldn't - therefore the bug report ;)

You should of brought up the limiter, when asked doing anything odd on lan side rules (floating would be considered lan side) hehehe.. I will make sure to always mention floating rules going forward..

miki725

@johnpoz said in pfSense Rewrites Source IP for ICMP Errors Breaking Traceroute:

You should of brought up the limiter, when asked doing anything odd on lan side rules (floating would be considered lan side) hehehe.. I will make sure to always mention floating rules going forward..

My apologies. Forgot about them. Makes perfect sense that they are as legitimate LAN side rule as any other.

Thanks everyone for helping even with limited provided information. Really appreciate everyones time and effort. Stay safe!

Alex Atkin UK

@miki725 I remembered it as I had the same problem.

As I recall you have to add a Pass floating rule for the WAN interface at the top of the list for echo reply/requests with Quick ticked, so it bypasses the limiter rule.

Gertjan

@Alex-Atkin-UK : Thanks.

That were those for :

( bottom two rules )

miki725

Thanks for the suggestion. Didnt even think of bypassing it.

Where is a standard place to add limiter rules? Mine is currently is a floating rule. Even with the ICMP bypass rule with Quick above it, traceroute is still impacted:

I tried removing the Quick from the limiter rule but that does not seem to help. Only thing which helps is disabling the limiter altogether. Im probably not doing something correctly if this works for you.

Gertjan

Like me, you added floating rules to do something about buffer bloat.

These are all my floating rules :

You're missing one IPv4 rule : the "direction : IN" rule.
You have the "Out" rule, the one with the gateway (WAN_DHCP).

I also use IPv6 - so that adds 3 more rules.

bobbenheim

In your ICMP rule setting direction: out, interface: WAN and change default to your actual gateway in advanced > Gateway
should do the job.

jamesonp

This got me today. I can confirm the floating rule for ICMP solves the issue.