TCP:SA getting blocked by Firewall



  • I am seeing that pfSense is blocking TCP:SA packets from network1 –> network2.

    net1 is LAN on pfSense and network2 is routed through ospf with a router. pfSense is running Quagga OSPFd.

    pfSense is blocking TCP replies to network2 hosts.

    I have allowed all internal networks to pass through LAN interface. I have also enabled Bypass firewall rules for traffic on the same interface option located under System > Advanced on the Firewall/NAT tab with no luck.

    Need some help with this.


  • LAYER 8 Global Moderator

    Sounds like asymmetrical to me - this for sure will cause out of state traffic.  And then blocked.. Draw up your network and we can help you fix it.



  • Thank you for the response.

    The host in 192.168.50.0/24 network is trying to establish TCP session with host in 192.168.100.0/24 network. pfSense is blocking TCP replies to .50 network.

    HTH



  • LAYER 8 Global Moderator

    Yeah because your host on 192.168.100 is on the transit network..

    You do not put hosts on a transit network without having to do host routing on each host.

    Connect your downstream router to pfsense via actual transit network and all your problems go away and you will not have asymmetrical… In your setup  50.x wants to talk to 100.x so it hits 50.1 router and that router says oh sure I have 100 directly attached send the SYN..  Your 100.x box gets the syn and says where and the F is 192.168.50.x - send it to my gateway (pfsense).

    PFsense you want to talk to where 50.x sure I have a route there but where was the SYN.. Your SYN,ACK (SA) is out of state - I am a stateful firewall = blocked!

    Connect your downstream router via a transit.. say 192.168.75/30 and now you have no problem with asymmetrical routing.



Log in to reply