I can ping PFSense but PFSense can't ping back

[-striker- 0]

@derelict Here is a packet capture from pfsense where I tried to ping 10.0.100.51 on the LAN interface and it failed.

12:47:22.869939 00:11:09:d7:2b:fa > 00:22:15:9f:4b:51, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 14477, offset 0, flags [none], proto ICMP (1), length 84)
255.255.255.0 > 10.0.100.51: ICMP echo request, id 49230, seq 0, length 64
12:47:23.875326 00:11:09:d7:2b:fa > 00:22:15:9f:4b:51, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 41292, offset 0, flags [none], proto ICMP (1), length 84)
255.255.255.0 > 10.0.100.51: ICMP echo request, id 49230, seq 1, length 64
12:47:24.877890 00:11:09:d7:2b:fa > 00:22:15:9f:4b:51, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 38991, offset 0, flags [none], proto ICMP (1), length 84)
255.255.255.0 > 10.0.100.51: ICMP echo request, id 49230, seq 2, length 64

pfsense packet capture doesn't seem to capture any packets when I ping from my workstation to the server even with the use of promiscuous mode. Any suggestions on a tool to capture the information you are looking for?

[Konstanti]

@striker-0

Need a file that you download after clicking " Download capture"

[-striker- 0]

@konstanti capture download attached. Forums wouldn't accept a .cap file, so I zipped it.

0_1548615280401_packetcapture(1).zip

[Derelict]

Great. What are we looking at?

[johnpoz]

its pinging from 255.255.255.0 - so no that is never going to work.

[Konstanti]

@derelict

[Derelict]

It looks like you have what should be a netmask somewhere that should be an address. As was said earlier, this makes no sense:

Source: 255.255.255.0

What interface is that capture taken on?

The only thing that could do that that I can think of is Outbound NAT on that interface being completely misconfigured. Outbound NAT would also only affect traffic in that direction.

[-striker- 0]

@derelict That is a packet capture taken while performing a ping command from the LAN interface to 10.0.100.51.

The packet capture was capturing ICMP IPV4 traffic activity from the LAN interface with the promiscuous setting enabled and set to capture full detail.

[-striker- 0]

@derelict I do not have any outbound NAT configured against my LAN interface, only WAN.

[Derelict]

Well you have something configured completely wrong.

Navigate here: https://your_firewall_ip/status.php

Download the resulting status_output.tgz file

Upload it to the nextcloud link I sent to you in chat.

[-striker- 0]

@derelict I don't doubt that something is configured wrong, but I can't figure it out for the life of me. I greatly appreciate the assistance everyone has been offering!

File has been uploaded as requested.

[Konstanti]

@striker-0
Try to reduce the speed of the interface to 100 Mbit. I have a feeling ,that the network card (realtek ) is not working properly

[-striker- 0]

@konstanti Tried bumping it down to 100 full duplex, flow control. Same result. Tried going down to 10 full duplex, still the same result. I have now put it back to the default setting.

[Derelict]

binat on re0 from any to any -> 255.255.255.0

There's your problem.

Disable this 1:1 NAT:

<onetoone>
            <external>255.255.255.0</external>
            <descr></descr>
            <interface>lan</interface>
            <source>
                <any></any>
            </source>
            <destination>
                <any></any>
            </destination>
</onetoone>

[-striker- 0]

@derelict Found it. It was under the 1:1 NAT mappings. I honestly don't remember ever creating that rule.

Thank you so much!

[johnpoz]

If I had to guess it was some sort of attempt at allowing wol from wan?

[mrexodia]

I know this topic is quite old, but it was the only one I could find that had my exact issue. In my case I accidentally enabled the Proxmox firewall on the VM I was trying to ping, so make sure to double check if you enabled a firewall, it could have saved my multiple hours of headache...