PFSense problem on Openstack/KVM

roberto.bertucci · Oct 22, 2019, 9:27 PM

Hello, i just deployed a pfsense in a openstack/KVM environment.
It seems that as soon as traffic to/trough firewall raises, connections are dropped.
For example: ping to firewall interfaces is working, ssh connections freeze and then drop after few commands, web access is simply impossible.

The problem is the same for VM behind pfsense (on LAN network).
Ping to public ips are ok but other protocols (nslookup, http, https) simply don't work.
Ping to PFSense works but https/ssh don't.
I checked rules but at the moment it's a default installation with all traffic enabled from LAN to internet and ssh to firewall enabled.

Is there anyone with a hint/suggestion?

Thank you

viragomann · Oct 22, 2019, 10:20 PM

Have you disabled "Hardware Checksum Offloading" in System > Advanced > Networking?

roberto.bertucci · Oct 23, 2019, 4:48 AM

Thank you for your answer. I am not able to access to web interface.
Do you know how to disable it by editing xml configuration file?
I looked for that parameter but i wasn't able to find it.

viragomann · Oct 23, 2019, 7:38 AM

@roberto-bertucci said in PFSense problem on Openstack/KVM:

I am not able to access to web interface.

Why not?

@roberto-bertucci said in PFSense problem on Openstack/KVM:

Do you know how to disable it by editing xml configuration file?
I looked for that parameter but i wasn't able to find it.

Yeah, you can't find the setting in the XML if the disable option is not checked.

You have to add this line to the 'system' section:

<system>
.
.
.
    <disablechecksumoffloading></disablechecksumoffloading>
</system>

roberto.bertucci · Oct 23, 2019, 7:46 AM

@viragomann said in PFSense problem on Openstack/KVM:

@roberto-bertucci said in PFSense problem on Openstack/KVM:

I am not able to access to web interface.

Why not?

This is part of my problems. Simply, web interface is not reponding to connections from LAN or WAN side.
nginx.log says nothing and i am stuck on this first problem (it would be great to have any hint on this too :D ) .
I don't see any correlation with connections dropping and i was trying to solve this before any other issue to be able to connect via ssh and do an easyer debug instead f working in VM console.

BTW, i am going to apply change in config.xmal and will et you know if it worked.

Thank you again

roberto.bertucci · Feb 15, 2020, 10:58 AM

Sorry to have left too much time before answering....
The actual status: i disabled Hardware Checksum offloading, but the behaviour is still the same.
I can connect to pfsense via ssh but sistematically, as i try a 'top' command or a 'tail -f' on a file (for example), i get no output and my ssh session closes with timeout reason.

Daoes this sounds familiar to anyone?

stephenw10 · Feb 15, 2020, 2:43 PM

Not really. But if ping works OK and TCP doesn't asides from any sort of TCP off-loading you might have an asymmetric route somehow.

Steve

roberto.bertucci · Feb 15, 2020, 5:31 PM

I don't think so. I have another VM with strongswan vpn server and it is working fine.
I move public IP from strongswan to pfsense and viceversa.

Strongswan does not have any problem but i need to use pfsense because i have the suspect that it is non performig as it is needed.

Thank you,
Roberto

stephenw10 · Feb 15, 2020, 5:56 PM

Can it connect out? If you run the update from the console (menu option 13) does it successfully check for updates?

Steve

roberto.bertucci · Feb 16, 2020, 9:59 AM

Evrey kind of operation i do on WAN side has the problem i wrote about.
If i use LAN connection everithing works fine. Internal client navigation is also fine.

The real problem is that dropping on incoming internet connections does not allow to establish for example VPN tunnels.
Target firewalls see and establish phase1 but when they try to establish phase2 they find closed connection....

stephenw10 · Feb 16, 2020, 12:10 PM

Ok so that's a change since your first post here when you were not able to SSH to pfSense. What changed?

When you run option 13 from the console does it fail? What error is shown?

Steve

roberto.bertucci · Feb 16, 2020, 1:50 PM

If i run it by ssh-ing LAN interface, it works fine. If i run from a ssh WAN session it fails for connection time-out with my client.
It seems that pfsense looses connection on WAN.
I am not sure that the problem is in PFsense firewall.
I suspect in something related to openstack/KVM setup.

stephenw10 · Feb 16, 2020, 2:21 PM

Could be. But how does it fail outbound? No way to advise further without at least some errors to go on.

Steve

roberto.bertucci · Feb 17, 2020, 3:32 PM

Solved! it was a MTU issue. I left the default 1500 on WAN but i need to use 1450.

Now another question: where is the configuration file or the WEB configuratore entry to make MTU persistent through reboots?

It seems that operating system files used are not the standard ones.....

stephenw10 · Feb 17, 2020, 3:49 PM

In Interfaces > WAN. There is a field for setting the MTU.

Steve

kiokoman · Feb 17, 2020, 6:18 PM

it's best not to modify directly the configuration files, most of the times they are overwritten at boot or after an update set the mtu on the gui, here

roberto.bertucci · Feb 17, 2020, 6:23 PM

Thank you all, i modified configuration via web configurator and it works perfectly.

Thank you again.

Roberto