Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    LAN Interface not replying to ICMP Request from WAN Network

    Scheduled Pinned Locked Moved Firewalling
    34 Posts 5 Posters 3.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      TgWaKu
      last edited by

      Hello,

      i've having an issue whereby i cannot ping my pfsense box from my WAN network.

      My topology is as follows:

      1d25b292-a65f-4416-8d07-9eda8b50a434-image.png

      im trying to ping from 192.168.1.112 to 10.0.0.1

      I can ping from 10.0.0.100 to 192.168.1.1
      i can ping from 10.0.0.100 to 192.168.1.112
      i can ping from 192.168.1.112 to 192.168.1.199
      however:
      i cannot ping from 192.168.1.112 to 10.0.0.1

      Packet capture shows that ICMP request is reaching the IP 10.0.0.1 but there is no reply from 10.0.0.1.
      5641166d-338c-41e3-92ef-cc7546bc634a-image.png
      Firewall rules are as follows:
      WAN
      bd6ed8b0-7cbc-430d-96b8-332148bea338-image.png
      LAN
      37b4e656-29a5-482d-a98e-d09f0d66b316-image.png

      I have a static route setup on the 192.168.1.1 router to route traffic to 10.0.0.0/24 subnet to 192.168.1.199 gateway
      9ad5a7ab-e0fe-4a6b-9d0a-9ecd5d6fa3e6-image.png

      I cannot figure out why 10.0.0.1 will not reply to the ICMP request.

      further more: if i connect into the pfSense router via my OpenVPN network (172.16.0.0/24) - i am able to ping 10.0.0.1 successfully.

      Automatic outbound NAT is enabled.

      Your help and expertise is greatly appreciated!

      NogBadTheBadN 1 Reply Last reply Reply Quote 0
      • NogBadTheBadN
        NogBadTheBad @TgWaKu
        last edited by NogBadTheBad

        @tgwaku Any reason why you’re running NAT on your pfSense device, all the addresses are RFC1918?

        It means you need to port forward on the pfSense device.

        Andy

        1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

        T 1 Reply Last reply Reply Quote 0
        • T
          TgWaKu @NogBadTheBad
          last edited by

          @nogbadthebad

          I probably have Outbound NAT enabled due to a lack of understanding of how NAT works :(

          i think in a previous confiuration i was unable to make my topology work without auto NAT enabled - but i've turned it off now and my internet seems to be working on the 10.0.0.0/24 network so i will leave it disabled, thanks :)

          I have port forwarded anything that i can think of to try and get the pinging to work but still not working :(
          674da9f0-5b29-4411-9a44-ea3bdac94c64-image.png

          still no ICMP reply atempts showing packet capture:
          ea41143a-701f-4d9c-8358-0bac1bfcb6a7-image.png

          NogBadTheBadN 1 Reply Last reply Reply Quote 0
          • NogBadTheBadN
            NogBadTheBad @TgWaKu
            last edited by

            @tgwaku Do a packet capture on the pfSense LAN interface, filter on ICMP.

            Do you see ICMP packets when you ping 10.0.0.100 from 192.168.1.112.

            It could be 10.0.0.100 is blocking ICMP from any non local subnet.

            Andy

            1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

            T 1 Reply Last reply Reply Quote 0
            • T
              TgWaKu @NogBadTheBad
              last edited by

              @nogbadthebad

              Packet capture on LAN interface with ICMP Protocol filter
              Not seeing ICMP packets when pinging 10.0.0.100 from 192.168.1.112 - (Packets Captured is blank)
              32bc3f17-4620-41e3-bcba-5980c3e35bf4-image.png

              On WAN interface packet capture ping from 192.168.1.112 to 10.0.0.100 yields no reply attempt again. (only echo request)
              a2e481da-fff2-4b96-988e-0508640d6f17-image.png

              There is definitely a firewall rule in windows that only allows ICMP request on the Local Subnet for Private and Public network profiles. Looks like domain profile connections can traverse subnets?
              44829f25-b4f3-42bf-9032-bc6885468c3f-image.png

              NogBadTheBadN 1 Reply Last reply Reply Quote 0
              • NogBadTheBadN
                NogBadTheBad @TgWaKu
                last edited by

                @tgwaku

                So outbound nat is disabled and the port forwards have been deleted ?

                Screenshot 2021-01-12 at 12.15.29.png

                If so it should work as 192.168.1.0/24 and 10.0.0.0/24 are directly connected.

                Andy

                1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                T 2 Replies Last reply Reply Quote 0
                • T
                  TgWaKu @NogBadTheBad
                  last edited by

                  @nogbadthebad

                  Yep, Port forwards have been removed:
                  67021c00-51c3-4b34-8ba4-63cbd8c1ef90-image.png

                  NAT is disabled:
                  b101fe40-7ff4-46a1-9aa4-0ee8fd1fbf22-image.png

                  But still cannot receive reply from 10.0.0.1 (or 10.0.0.100) from 192.168.1.112

                  1 Reply Last reply Reply Quote 0
                  • T
                    TgWaKu @NogBadTheBad
                    last edited by

                    @nogbadthebad

                    Also, with NAT disabled my 192.168.1.1 router page gives:
                    4c4e4d5d-2ddd-45d7-a7cf-f50bdfca0754-image.png

                    NogBadTheBadN 1 Reply Last reply Reply Quote 0
                    • NogBadTheBadN
                      NogBadTheBad @TgWaKu
                      last edited by

                      @tgwaku

                      It's talking to your router:-

                      The HTTP 403 is a HTTP status code meaning access to the requested resource is forbidden. The server understood the request, but will not fulfill it due to client-related issues. IIS defines non standard "sub-status" error codes that provide a more specific reason for responding with the 403 status code.

                      Andy

                      1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                      T 1 Reply Last reply Reply Quote 0
                      • T
                        TgWaKu @NogBadTheBad
                        last edited by

                        @nogbadthebad

                        I have a feeling the 403 error is because the router doesn't like to accept connections from ip's on a different subnet. with auto nat on it connect to the router page under the gateway ip of 192.168.1.199 which is accepted. or at least this is my best guess at what is going on there.

                        still unable to ping my setup however :(

                        N 1 Reply Last reply Reply Quote 0
                        • N
                          netblues @TgWaKu
                          last edited by

                          @tgwaku Its not a feeling, its reality
                          Shitty isp routers only accept connections from connected lans.
                          It might be possible to allow access, if the settings permit, and you will also need a static route on the isp router pointing at the pfsense gw for your pf lan space

                          Not always the case that you can do that.
                          For the scenario at hand, all nat sessions are handled by the isp router, which usually becomes problematic whith many sessions.
                          Also inbound filtering is limited to the capabilities of the isp router.

                          Consider putting the isp router in bridge mode
                          and also eliminate the wireless connection to pf, for gods shake. :)

                          NogBadTheBadN 1 Reply Last reply Reply Quote 1
                          • NogBadTheBadN
                            NogBadTheBad @netblues
                            last edited by

                            @netblues said in LAN Interface not replying to ICMP Request from WAN Network:

                            @tgwaku Its not a feeling, its reality
                            Shitty isp routers only accept connections from connected lans.
                            It might be possible to allow access, if the settings permit, and you will also need a static route on the isp router pointing at the pfsense gw for your pf lan space

                            Not always the case that you can do that.
                            For the scenario at hand, all nat sessions are handled by the isp router, which usually becomes problematic whith many sessions.
                            Also inbound filtering is limited to the capabilities of the isp router.

                            Consider putting the isp router in bridge mode
                            and also eliminate the wireless connection to pf, for gods shake. :)

                            ^^ This

                            Andy

                            1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                            1 Reply Last reply Reply Quote 0
                            • T
                              TgWaKu
                              last edited by

                              So basically, my setup is trash and i need to rethink my topology?

                              fair enough.

                              Ideally I would never have had it set up this way but I'm in a share house and it seemed like the most anti-social way to do it so i didn't have to have a conversation with my house mates about messing with their ISP router 😅

                              NogBadTheBadN N johnpozJ 3 Replies Last reply Reply Quote 0
                              • NogBadTheBadN
                                NogBadTheBad @TgWaKu
                                last edited by NogBadTheBad

                                @tgwaku Enable nat and pop an access-point behind your pfSense router.

                                You may have problems with double nat, but all your equipment would be on the same lan segment.

                                You could get rid of the WiFi bridge using two ethernet over power gadgets.

                                Andy

                                1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                                1 Reply Last reply Reply Quote 0
                                • N
                                  netblues @TgWaKu
                                  last edited by

                                  @tgwaku If you know what you are doing, your housemates will love you about the performance...

                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator @TgWaKu
                                    last edited by

                                    @tgwaku said in LAN Interface not replying to ICMP Request from WAN Network:

                                    it seemed like the most anti-social way to do it so i didn't have to have a conversation with my house mates about messing with their ISP router

                                    You can for sure do it that way.. With the AP as a client bridge wireless connection to the house network.

                                    But you need to give pfsense wan an IP on this network, just use dhcp should be your best choice there. Let the house dhcp server give it an IP on that 192.168.1 network.

                                    Yes double nat, leave pfsense default for nat (auto). Then setup pfsense lan to be something other than 192.168.1 or anything that over laps that, 10.0.0/24 would be fine for you pfsense lan.

                                    This isolates you from the house network. If you do want to get access to something behind pfsense to the lan, then you would need to setup a port forward.

                                    But I concur I would classify such a setup with a wireless connection like that as "trash" no offense ;) But yeah sometimes you have to work with what you have.

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                    T 1 Reply Last reply Reply Quote 0
                                    • T
                                      TgWaKu @johnpoz
                                      last edited by

                                      @johnpoz

                                      Thank you John for giving me to confidence to keep persevering with this issue! I am not one to give up easy, so after adding every firewall rule under the sun.. Trying hybird nat with manual rules, port forwarding everything i could think of... Nothing was working..

                                      Then I just started trying random things. and one of those things was to delete the ARP Cache entries for a few ip's (can't remember which one's, probably for 192.168.1.112). I deleted on both the pfSense router and on the ISP TP Link router ARP Tables. Then tried to ping again from 192.168.1.112 to 10.0.0.1...... and it... worked... 😕

                                      Does this make any sense why that would fix the issue? is it a thing like, arp cache gets too full or something and ping requests get dropped in one direction?

                                      Full head scratcher!!! but it's working now which is good. I'm gambling that in a week it may break again so I will put a reminder on my phone to test the ping, and if it's not working I'll delete the ARP Table entries again (this time paying more attention) so i can confirm that this was indeed the nail in the coffin.

                                      Thanks everyone for your help troubleshooting! @NogBadTheBad @netblues @johnpoz

                                      johnpozJ L 2 Replies Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator @TgWaKu
                                        last edited by

                                        At a complete and utter loss to why you think you should be able to ping the lan IP of pfsense from such a setup..

                                        Your .112 client has no clue how to get to 10.0.0.1, so it would send it to its gateway. That router has no clue how to get to some 10 network, so best case it would just drop the traffic because its rfc1918 - but it would most likely send it onto the isp gateway.

                                        I have no idea what you think is going on, or what you have actually clicked or configured. But as drawn - there is NO Possible way for .112 to be able to ping 10.x -- unless you setup a route on it?? To point to pfsense wan IP to get to 10.x network..

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                        T 1 Reply Last reply Reply Quote 0
                                        • T
                                          TgWaKu @johnpoz
                                          last edited by

                                          @johnpoz

                                          Correct, there is a static router on the ISP TP Link Router:

                                          f9a6f47e-14bb-4884-af70-8029c96eeb33-image.png

                                          johnpozJ 1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator @TgWaKu
                                            last edited by johnpoz

                                            That is a asymmetrical mess.. And your going to have nothing but problems with it. For a downstream router you would need a transit network. Or is asymmetrical.. If you were going to route then it would be done on the .112 box directly not the isp router.. To make sure the traffic is not asymmetrical.

                                            Dude - double nat, and port forward for whatever services you want something on the 192.168.1 network to get to behind pfsense.

                                            I gave you the solution to how to do this.. And pinging behind a nat is problematic, and your only ever going to setup 1 port forward for icmp if you wanted to ping pfsense lan IP or something behind pfsense.

                                            Just ping pfsense wan IP to validate connectivity..

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.