Odd issue with certain IP addresses not working
-
Hello,
I'm seeing "connection timeout" issues with certain IP addresses. Even when I ping them from diagnostics and the various source addresses, no packets are received. I've created specific rules for the source to IP. The log on these rules show passed or allowed traffic. Here's one example 31.13.67.35 which is a valid facebook.com IP address.Any suggestions on how to resolve this issue?
Thanks,
Joschi -
Are you certain those addresses exist? If ping fails, then they might not. You don't need rules to ping out on the Internet.
-
Any suggestions on how to resolve this issue?
Post screens of your LAN rules and your ping output. If you've been playing around with rules then there's no telling what you may have done.
-
The IP does work off the offending network. I don't have physical access. So, I can't say for sure if its the ISP. It would seem unlikely. Since most sites are working fine.
Attached are screen shots of the ping and lan rules.
-
who says that ip is going to answer ping?
Not like every IP on the internet answer ping.. Shoot out of the box pfsense will not answer a ping to its wan.
What exactly are you allowing on port 1 as a destination? tcpmux.. Nobody uses that… Wasn't it deprecated years ago?
You allow everything to the DMZ, and then you allow NOT DMZ... So at a loss to how that is not an any any rule.. Why would you not just leave the any any default rule in place. And your not allowing ping.. (icmp)
Derelict mentions issues with ! rules and why he doesn't like them... And where you have an allow for tcp/udp to dmz net, and then a not rule dmz.. This might be the weirdness he brings up why he doesn't like them.
But because a site does not answer ping doesn't mean its offline that is for sure or being blocked.... facebook.com is going going to be hosted off a HUGE CDN.. So depending on where your at in the world you will be seeing different IPs that will change all the time vs someone else in a different region, etc.
-
Port 1 is used for a custom DMZ to LAN connection needed.
I've verified pinging the IP address from a remote location.
-
Yes, your right the top rule could be removed and the other updated to any. Thank you.
Ping does work for just about any other site from the LAN. The ICMP rule is on the WAN.
-
So I am not having any issues pinging this IP.
So you have any weird routing or using a vpn as you default route.. Maybe facebook blocks your vpn connection?
See this all the time where users using some vpn service, and whatever IP their vpn is blocked by where they are trying to go.
Do you have any routing that would send that traffic to the wrong place?
What are you running on tcp port 1 exactly - my curiosity kat only… That port is tcpmux and really I do not recall ever seeing actually used.. ever ;)
the only rule for icmp on your wan would be to allow ping to your wan.. Are you trying to port forward ping inbound? to something behind pfsense?
-
I don't have any custom routing in place. Just the defaults. I can ping most IP's from the LAN. Just having trouble with a few. Including the one I've mentioned. openVPN configured for remote access.
-
well do a traceroute to it.. could be a problem with your ISP or internet from where your at to where that IP is at.. Or could be they are blocking your isp to that IP… Like a bajaillion reasons why... Does pfsense send out the ping out your wan... Do you get an answer... Simple sniff... if your seeing the ping go out, and you don't get a response its not pfsense.. If your not seeing it go out your wan, then you need to figure out why..
-
Finally solved. Improper WAN CIDR IP value. Failing IP's were within the CIDR range specified. So, route outbound was failing.
Thanks for the help!
Do you recommend a particular plugin for logging and reporting? I'd like to set up a log server separately.
-
You mean like you set your wan IP was say 31.x.x.x and you put a /8 on it and then couldn't figure out why you couldn't get to 31.13.x.x?
-
I didn't configure the Firewall, but yep that is pretty much what happened ;D /5 actually.
-
hehehe /5 - wow!!!!
Yeah that would cause all kinds of problem… So since you mention problem going to a 31 IP... Then with a /5 your wan first octet was between 24-31... So yeah large portion of the net would of been unavailable..
Suppose to be /25 maybe?
-
Yeah it through me for a loop. Thanks again for your help. Any experience with any of the logging / reporting plugins that you would recommend?
-
Fire up your fav syslog and send there.. There really is no need for package on pfsense.. It can send to syslog out of the box. Build an ELK stack - all the kool kids are doing it ;)
