Blocked my internal lan but I dont see where
-
Disable any IDS/IPS packages like Snort, Suricata, pfBlocker and try again. Any time there is weirdness that belies the rules, I make sure these specific packages are disabled.
btw it's much easier for us to read screenshots of your rules & logs than the raw dumps.
-
Hi , all IDS tools were uninstalled and the device rebooted once or twice since so there should be nothing held over from pfblockerng install
- and thanks for the screenshot tip :)
-
I'm not sure why it's blocking traffic from 192.168.1.230 to 192.168.1.109 since it's local and shouldn't even hit the firewall. The client and server are on the same VLAN? There isn't something weird going on with your setup?
-
So it appears I must redesign my network somewhat as i am getting some asymmetric routing , which is why i guess pfsense blocks it.
:-[
-
" as i am getting some asymmetric routing"
How is that? Do you have downstream routers without using transit networks?
-
No , no more downstream routers left
ISP===> cablemodem ig2 => pfsense appliance ig1 => cisco 3750 (vlans tagged on switch , no routing) vlan 3= > esx host
ig0 => vlan 4=> esx hostgateway is set to be the pf box.
anything that does not go near the esx seems to be fine , direct subnets no issues , vm to vm traffic gets blocked same vlan or notif i pcap my outgoing lan networks , I see packets from my esx vm's , these are then blocked by default rules.
So slight change , I do see where it's getting blocked , I have yet to figure out why ….
-
Well if no downstream routing how would you be getting asymmetrical.. How you would you possible have more than 1 route to somewhere? Do you have multihomed devices that have nic in more than 1 vlan?
"vm to vm traffic gets blocked same vlan or not"
How exactly would traffic on the same vlan get blocked? Vlan traffic to same vlan has ZERO to do with pfsense. If I had to guess your prob running multiple layer 3 over the same layer 2, which is just BORKED, etc..
Do a real drawing of your network - break out the crayons if you have to and label what networks/vlans and what is plugged into what at layer 1. And your switch config for these ports..
-
Ok point taken about the diagram , attached should be a slight improvement
I would largely agree traffic on the same vlan should have zero to do with pfsense , yet the logs show the block and the traffic is well .. blocked.
-
Your issue is in ESXi somewhere.
Traffic between 192.168.0.3 and 192.168.0.230 should all be handled in the vswitch and should never be sent to the router.
Your problem is not in the firewall.
-
if you have devices in esxi on the same vswitch that can not talk to each other and your seeing this traffic go to pfsense, my guess would be you have a mask wrong somewhere on one of the vms. So the 1 vm sends him syn and he answers back syn,ack to pfsense because from his mask the IP talking to him is on a different network.
