I can ping PFSense but PFSense can't ping back
-
Hello,
I have tried googling and searching these forums, but I have not been able to find an issue that seems similar to mine. My apologies if this has already been answered, but i'm honestly at a loss here.
My PFSense LAN IP is 10.0.100.1
I have numerous devices on my LAN with static IP's in the 10.0.100.2 - 10.0.100.99 range and dynamic IP's in the 10.0.100.100-10.0.100.200 range.
All of my LAN devices can access the internet without issue. All of my LAN devices can ping each other and the LAN IP of the PFSense box. However, my PFSense box cannot ping any of my LAN devices. I noticed the other day that my port forward was no longer working properly so I started investigating. I haven't changed anything with my PFSense box since the last time that this port forward worked. I think the port forward not working is related to the fact that PFSense can't ping my LAN devices, but I have no idea why that would be.
I have included screenshots showing that PFSense cannot ping on its LAN to 10.0.100.51 yet from a workstation on my network I can ping both 10.0.100.51 and 10.0.100.1.
Can anyone offer any insight or possible troubleshooting options that I could try?
Thanks!
-
Hi,
LAN interface settings and firewall rules ?
-
Nothing terribly special in either of those as far as I can tell. Screenshots are below. The "US_VPN_Client_IP's" is an alias for IP addresses ranged through 10.0.100.90 - 10.0.100.94. The blocking firewall rule only applies to those IP's to prevent them from accessing the WAN as I only want them to exit PFSense via the VPN tunnel established for them.
-
well do a sniff on your lan when you do your ping test from pfsense.. Does it send the ping? And is the ping going to the correct mac address?
Do you have any floating rules?
-
I do not have any floating rules defined.
The MAC address for 10.0.100.51 is: 00:22:15:9f:4b:51 which I see in the sniff results below as the destination of the ping, so the ping is being sent, but it is not reaching the destination or it is not being replied to.
As I can ping 10.0.100.51 from other machines on the network and receive a response, it seems like the ping is being blocked from leaving PFSense, but i'm not sure how or why that would occur.
Results from the sniff show:
09:50:01.664068 00:11:09:d7:2b:fa > 00:22:15:9f:4b:51, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 7165, offset 0, flags [none], proto ICMP (1), length 84, bad cksum 0 (->f178)!)
255.255.255.0 > 10.0.100.51: ICMP echo request, id 16367, seq 0, length 64
09:50:02.671776 00:11:09:d7:2b:fa > 00:22:15:9f:4b:51, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 1980, offset 0, flags [none], proto ICMP (1), length 84, bad cksum 0 (->5ba)!)
255.255.255.0 > 10.0.100.51: ICMP echo request, id 16367, seq 1, length 64
09:50:03.673660 00:11:09:d7:2b:fa > 00:22:15:9f:4b:51, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 39043, offset 0, flags [none], proto ICMP (1), length 84, bad cksum 0 (->74f2)!)
255.255.255.0 > 10.0.100.51: ICMP echo request, id 16367, seq 2, length 64 -
Well pfsense put it on the wire to the correct mac.. So the problem has nothing to do with pfsense.
Wrong network masks on the client? What is between pfsense and the client? Switch I assume - any vlans setup on the switch, is the switch dumb?
-
@striker-0 said in I can ping PFSense but PFSense can't ping back:
00:11:09:d7:2b:fa
Hey
Try so
System/Advanced/Networking -
The client is assigned its IP through a static DHCP mapping from pfsense so I don't think it is a wrong network mask. Additionally, pfsense cannot ping any LAN client, i'm just focusing on this one as this is the one I care about pfsense being able to port forward to.
There are two dumb switches between pfsense and the client in question. They have both been rebooted several times to clear anything they might be retaining internally.
There are no vlans setup in my environment.
-
@striker-0
try check " Disable hardware checksum offloading" in System/Advanced/Networking -
@konstanti I gave that a try, Thank You for the suggest! Rebooted pfsense to ensure it was applied. Same results on a ping test.
-
@striker-0
Show the output of the command
ifconfig -m
and arp -a -
@konstanti The forums are being weird and telling me that the content is flagged as spam. I've attached the requested results as a text file.0_1548526770045_Results.txt
-
@striker-0
So in a whole, all looks decently
What you can try- Change the LAN - re0 interface speed (e.g. media 100baseTX mediaopt full-duplex)
- Check the lan re0 - switch cable
- Connect any device directly to PFSense and try to ping .
- check the subnet mask in dhcp server settings and devices that have permanent ip addresses (255.255.255.0)
-
Client firewalls? If you changed anything such as your LAN subnet your desktops will change to "public" and block everything.
Even changing an interface on your router could trigger that.
https://www.netgate.com/docs/pfsense/nat/port-forward-troubleshooting.html
As you eluded to in your first post- once you figure out why your port forward does not work you will most likely also fix the ping.
-
If you can ping one way and not the other it is almost certainly a firewall on the device you cannot ping blocking it. One way ping success proves two-way traffic, routing (for the most part in most cases), and layer 2 are correct.
-
-
I would prefer not to change my link speed. It is currently running at 1000. If I switch it down to 10 or 100, I would be limiting my access to my internet as my internet connection is currently rated for 300. Additionally, this was working previously under the current link state, so I would be surprised if this would resolve anything. What is your rationale for checking this?
-
Tried a different cable, no change in results.
-
Tried connecting a device directly to pfsense. No change in results.
-
Subnet Mask is set to 255.255.255.0 in DHCP and aligns with the client.
-
-
@chpalmer I thought it could be client side firewall too. I normally leave those disabled on my internal LAN as they just cause unnecessary trouble. I have confirmed and they are still off.
-
Then you'll have to packet capture to see the pings going out and nothing coming back, look at the MAC addresses, etc.
-
@striker-0
Reducing the connection speed is just a test
I am very confused by the line in ping test
255.255.255.0 > 10.0.100.51: ICMP echo request, id 16367, seq 0, length 64
( I don't know what's the subnet mask )Should be so
length 98: 192.168.1.1 > 192.168.1.230: ICMP echo request, id 30542, seq 0, length 64
length 98: 192.168.1.230 > 192.168.1.1: ICMP echo reply, id 30542, seq 0, length 64
length 98: 192.168.1.1 > 192.168.1.230: ICMP echo request, id 30542, seq 1, length 64
length 98: 192.168.1.230 > 192.168.1.1: ICMP echo reply, id 30542, seq 1, length 64Can you put the packet capture file here ?
-
@derelict I have confirmed the firewall is off. This issue occurs across all devices on my network, the only constant is pfsense. Additionally, within my network other devices can ping each other and I can connect to the port I am trying to forward. Something is going on with pfsense or the hardware it resides on.
-
@striker-0
And another question - how much do you have active NORDVPN tunnels ?
if you turn them off, will anything change ? -
@striker-0 said in I can ping PFSense but PFSense can't ping back:
255.255.255.0 > 10.0.100.51:
That is NOT right it sould be pinging from pfsense IP on that 10.0.100 network..
re0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500 options=82098<VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC,LINKSTATE> capabilities=18399b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,TSO4,WOL_UCAST,WOL_MCAST,WOL_MAGIC,LINKSTATE,NETMAP> ether 00:11:09:d7:2b:fa hwaddr 00:11:09:d7:2b:fa inet6 fe80::211:9ff:fed7:2bfa%re0 prefixlen 64 scopeid 0x2 inet 10.0.100.1 netmask 0xffffff00 broadcast 10.0.100.255 nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> media: Ethernet autoselect (1000baseT <full-duplex,master>) status: active
That is the IP it should be pinging from 10.0.100.1
-
@striker-0 Post a packet capture taken on each interface of pings that work and pings that fail.
-
@konstanti at the moment, my NORDVPN tunnel is down. I see no difference in activity when the tunnel is up or down.
-
@johnpoz
All this is very strange, because of the webgui
pfsense is also forming a command
/ sbin/ping -S 10.0.100.1 -c 3 10.0.100.51 (as seen in the picture)
and tcpdump shows another -
@derelict Here is a packet capture from pfsense where I tried to ping 10.0.100.51 on the LAN interface and it failed.
12:47:22.869939 00:11:09:d7:2b:fa > 00:22:15:9f:4b:51, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 14477, offset 0, flags [none], proto ICMP (1), length 84)
255.255.255.0 > 10.0.100.51: ICMP echo request, id 49230, seq 0, length 64
12:47:23.875326 00:11:09:d7:2b:fa > 00:22:15:9f:4b:51, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 41292, offset 0, flags [none], proto ICMP (1), length 84)
255.255.255.0 > 10.0.100.51: ICMP echo request, id 49230, seq 1, length 64
12:47:24.877890 00:11:09:d7:2b:fa > 00:22:15:9f:4b:51, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 38991, offset 0, flags [none], proto ICMP (1), length 84)
255.255.255.0 > 10.0.100.51: ICMP echo request, id 49230, seq 2, length 64pfsense packet capture doesn't seem to capture any packets when I ping from my workstation to the server even with the use of promiscuous mode. Any suggestions on a tool to capture the information you are looking for?
-
Need a file that you download after clicking " Download capture"
-
@konstanti capture download attached. Forums wouldn't accept a .cap file, so I zipped it.
-
Great. What are we looking at?
-
its pinging from 255.255.255.0 - so no that is never going to work.
-
-
It looks like you have what should be a netmask somewhere that should be an address. As was said earlier, this makes no sense:
Source: 255.255.255.0
What interface is that capture taken on?
The only thing that could do that that I can think of is Outbound NAT on that interface being completely misconfigured. Outbound NAT would also only affect traffic in that direction.
-
@derelict That is a packet capture taken while performing a ping command from the LAN interface to 10.0.100.51.
The packet capture was capturing ICMP IPV4 traffic activity from the LAN interface with the promiscuous setting enabled and set to capture full detail.
-
@derelict I do not have any outbound NAT configured against my LAN interface, only WAN.
-
Well you have something configured completely wrong.
Navigate here: https://your_firewall_ip/status.php
Download the resulting status_output.tgz file
Upload it to the nextcloud link I sent to you in chat.
-
@derelict I don't doubt that something is configured wrong, but I can't figure it out for the life of me. I greatly appreciate the assistance everyone has been offering!
File has been uploaded as requested.
-
@striker-0
Try to reduce the speed of the interface to 100 Mbit. I have a feeling ,that the network card (realtek ) is not working properly -
@konstanti Tried bumping it down to 100 full duplex, flow control. Same result. Tried going down to 10 full duplex, still the same result. I have now put it back to the default setting.
-
binat on re0 from any to any -> 255.255.255.0
There's your problem.
Disable this 1:1 NAT:
<onetoone> <external>255.255.255.0</external> <descr></descr> <interface>lan</interface> <source> <any></any> </source> <destination> <any></any> </destination> </onetoone>
-
@derelict Found it. It was under the 1:1 NAT mappings. I honestly don't remember ever creating that rule.
Thank you so much!