Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    How can I find out, why pfSense is blocking an internal IP?

    Firewalling
    firewall
    3
    9
    1185
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • H
      highc last edited by

      Hi, I‘m having a strange problem: On a subnet, there is one specific IP that pfSense is blocking: The subnet is my wifi. Any device tested an assigned this IP to via dhcp or manually can ping the AP and the switch in between, but not pfSense (2.4.4-2).

      I tested opening the firewall (a pass-all rule at the top) for that VLAN on pfSense (even though all blocking rules have logging enables and there is no trace in the logs). I also tried

      cat /conf/config.xml | grep <IP>
      

      but that also showed no trace of anything related to this IP in pfSense‘s.

      Anything else I could check to see if there is anything in pfSense‘s config about this IP?

      pfSense 2.4.5p1 on Netgate SG-2440 - just upgraded to 2.5.2
      pfSense 2.4.5p1 on Super Micro 5018D-FN4T - just upgraded to 2.5.2

      1 Reply Last reply Reply Quote 0
      • KOM
        KOM last edited by

        Post a screenshot of your firewall rules for the interface with the problem.

        1 Reply Last reply Reply Quote 0
        • johnpoz
          johnpoz LAYER 8 Global Moderator last edited by

          So can we have some actual IPs to work with here..

          So your saying for example

          Pfsense interface IP 192.168.1.1
          client on 192.168.1/24 say .14 or .231 can ping .1
          But this IP 192.168.1.52 can not ping .1, no matter what device gets or uses this .52 address?

          Is that what your saying??

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

          H 1 Reply Last reply Reply Quote 0
          • H
            highc @johnpoz last edited by

            @johnpoz: Yes. that’s what I‘m trying to say.

            pfSense interface IP is 192.168.5.1 with clients on 192.168.5.0/24. 192.168.5.27 can’t ping pfSense or anything behind pfSense, independent of which device has been assigned this IP. With other IPs (e.g. 192.168.5.28), the same devices can ping pfSense and IPs behind pfSense.

            I haven’t experienced this issue with any other IP yet. Trying to find out what I may have misconfigured.

            Firewall rules screenshot is a bit difficult from mobile devices, but maybe this is sufficient already:

            screen shot

            pfSense 2.4.5p1 on Netgate SG-2440 - just upgraded to 2.5.2
            pfSense 2.4.5p1 on Super Micro 5018D-FN4T - just upgraded to 2.5.2

            1 Reply Last reply Reply Quote 0
            • johnpoz
              johnpoz LAYER 8 Global Moderator last edited by

              So you double check same mask on both pfsense and client.

              What are you firewall rules? Any floating rules?

              So on your client, when you try and ping pfsense on 192.168.5.1, you see his mac in your arp table after you try and ping... And this mac address is correct, ie matches up with pfsense mac address.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

              H 1 Reply Last reply Reply Quote 1
              • H
                highc @johnpoz last edited by

                @johnpoz : The arp table was an excellent hint. After playing around with it and making sure it is ok, everything is working - with all devices.

                Thanks!

                pfSense 2.4.5p1 on Netgate SG-2440 - just upgraded to 2.5.2
                pfSense 2.4.5p1 on Super Micro 5018D-FN4T - just upgraded to 2.5.2

                1 Reply Last reply Reply Quote 0
                • johnpoz
                  johnpoz LAYER 8 Global Moderator last edited by

                  So what was wrong in the arp table? Was there a static arp set on pfsense?

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                  1 Reply Last reply Reply Quote 0
                  • H
                    highc last edited by

                    There was an entry for the IP, yes. Don't know where it came from, and after deletion, I couldn't make it appear again - only temporary ones, which kept changing as I changed devices with that IP.

                    In any case, the ARP table was the correct pointer, thanks again!

                    pfSense 2.4.5p1 on Netgate SG-2440 - just upgraded to 2.5.2
                    pfSense 2.4.5p1 on Super Micro 5018D-FN4T - just upgraded to 2.5.2

                    1 Reply Last reply Reply Quote 1
                    • johnpoz
                      johnpoz LAYER 8 Global Moderator last edited by

                      NP - glad you got it sorted..

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                      1 Reply Last reply Reply Quote 0
                      • First post
                        Last post