[SOLVED] Can't reach Web configurator (sort of)

dekket

Hello.

I am new to pfSense (used to be well-versed in IP Tables though) and pretty knowledgeable when it comes to networking in general - and I can't access my frickin' pfSense box's Web UI from one specific IP on the LAN - my main box.

I can ping the pfSense box just fine, btw. And I can SSH into it just fine.
And I can reach the internet, no problem.

There are no rules preventing access to the box from within LAN.
I've cleared the ARP table on both my main box and the Cisco switch that every client is connected to, no change.
I've tried different browsers, no change.

If I had hair, I would be tearing it out right about now.

Since I can access it through SSH but not through any browser, my thought is that there's something wrong on my main box. Does anyone have any idea what it could be? Because I'm at a loss. Browsers are not my forté…

Thanks.

Edit: I realize now that this just might be outside of the scope of this forum...

Edit2: Renamed this to [SOLVED].

johnpoz

Is your box using a proxy? Not able to get to the web gui from IP on your lan has zero to do with pfsense.

dekket

Nope, no proxy in sight.

I'm able to reach other IP's/hosts on my network though, so it's just the pfsense box that's unreachable - from one box.

I'll try asking elsewhere.

johnpoz

Simple sniff is what I would do.. You say you can ping and ssh to pfsense. And other clients on the same lan can access the gui. Unless you are blocking that IP in the rules? And had disabled the antilock out rules on lan then it should be able to get to the gui.

Do a simple sniff.. Is your browser actually sending Syn to pfsense IP? What does pfsense answer back..

dekket

I finally found what the issue was. It was the MTU.
I had set it to 9000 (jumbo frames), not realizing that my iMac did not have that capability.

This explains why a ping works, however I find it weird that SSH worked just fine?

If someone could enlighten me on that, I'd greatly appreciate it.

Thanks.

johnpoz

ssh data is going to be very small, more than likely under the standard mtu of 1500.

Why do people mess with stuff that makes not sense to mess with… Where did you get the idea that you should change the mtu to jumbo? Are you on 10ge? Does everything on that layer 2 support jumbo?

Derelict

Yeah if you were to do something like scp from the node it would have fallen apart due to the large packets. typie typie rarely generates > 1460B segments.