Can't get to login.microsoft.com
-
I have a pfSense firewall and some setting must be set that I cannot find. Whenever I try to go to login.microsoft.com it won't connect to that site. As soon as I turn off the firewall I can connect.
I don't know much about this firewall so any help is appreciated.
Thanks
Dan -
Are you running pfBlockerNG? Maybe it is blocking the site.
-
Define 'I turn off the firewall'.
How exactly does it fail when connecting from behind pfSense? Timeout? Can't resolve?
Steve
-
I am on the pfsense now.
Let me start off by saying I know little about this system.
How do I know if I have pfBlokerNG?
Turn off the firewall means this.
I have a wired connection that is behind the firewall.
That is when it doesn't work. It just never connects to the site.
When I disconnect the ethernet and go wireless it connects to the site just fine.
Thanks
Dan -
@dcihon said in Can't get to login.microsoft.com:
How do I know if I have pfBlockerNG?
When you connect to the pfSense webgui it would be shown in the Firewall menu.
Check the firewall logs in Status > System Logs > Firewall tab. Do you see any blocked traffic from your client when you try to access it?
Try to resolve login.microsoft.com from Diagnostics > DNS Lookup. Do you see a real IP?
Can you resolve it directly fro your client behind the firewall?Steve
-
I don't have pFBlockerBG installed.
I found that out.
The DNS lookup finds several IP addresses for login.microsoft.com
I can not ping or tracert to it.
It does not show up in the firewall as blocked that I can see. Not sure if I am looking at the correct place.
I can not resolve it directly behind the firewall.
What can I try next. -
Ok, so pfSense can resolve it. Does it show a reply from all the DNS servers listed there?
I could imagine external server resolve it but localhost (127.0.0.1) does not perhaps?Check Services > DNS Resolver. Is it enabled? If not check the DNS Forwarder instead.
In whichever is enabled look for host or domain overrides for *.microsoft.com.
Remove them if there are any.If not then make sure your client is actually using pfSense for DNS.
Steve
-
When I do ipconfig /all it shows 127.0.0.1 for dns
I have turned DNS Resolver on and off. I have turned DNS Forwarder on and off.
None of it seems to make a difference.
I don't see any *.microsoft.com listed anywhere. That doesn't mean it's not there.How should I have this set up?
Use DNS Resolver or DNS Forwarder or both or none?
Looking for guidance here. I appreciate the help.
I am not opposed to someone taking over my machine and taking a look at this with me if that would help.What should I do next?
-
Can you traceroute (or tracert in Windows) to login.microsoft.com? Could be an ISP or backbone issue.
-
C:\WINDOWS\system32>tracert login.microsoft.com
Tracing route to san.current.a.prd.aadg.akadns.net [40.126.0.70]
over a maximum of 30 hops:1 <1 ms <1 ms <1 ms pfsense.eaglestl.com [192.168.1.1]
2 * * * Request timed out.
3 * * * Request timed out.
4 * * * Request timed out.
5 * * * Request timed out.
6 * * * Request timed out.
7 * * * Request timed out.
8 * * * Request timed out.
9 * * * Request timed out.
10 * * * Request timed out.
11 * * * Request timed out.
12 * * * Request timed out.
13 * * * Request timed out.
14 * * * Request timed out.
15 * * * Request timed out.
16 * * * Request timed out.
17 * * * Request timed out.
18 * * * Request timed out.
19 * * * Request timed out.
20 * * * Request timed out.
21 * * * Request timed out.
22 * * * Request timed out.
23 * * * Request timed out.
24 * * * Request timed out.
25 * * * Request timed out.
26 * * * Request timed out.
27 * * * Request timed out.
28 * * * Request timed out.
29 * * * Request timed out.
30 * * * Request timed out. -
Ok, so the client also resolves it but that cannot reach it.
By default the DNS resolver should be enabled and pfSense will hand it's internal interface IP to client to use for DNS.Does pfSense also fail when trying to traceroute at every step like that?
If so it's either blocked somewhere upstream or you have a bad route somewhere.
Check Diag > Routes, do you have any subnets defined containing that IP?Steve
-
Probably an upstream router that blocks all ICMP requests.
That explains the total absence of replies. -
This is what I get when I do a tracert from pfsense.
1 * * *
2 * *traceroute: wrote www.tm.a.prd.aadg.trafficmanager.net 40 chars, ret=-1
*
3 traceroute: wrote www.tm.a.prd.aadg.trafficmanager.net 40 chars, ret=-1
*traceroute: wrote www.tm.a.prd.aadg.trafficmanager.net 40 chars, ret=-1
*traceroute: wrote www.tm.a.prd.aadg.trafficmanager.net 40 chars, ret=-1
*
4 traceroute: wrote www.tm.a.prd.aadg.trafficmanager.net 40 chars, ret=-1
*traceroute: wrote www.tm.a.prd.aadg.trafficmanager.net 40 chars, ret=-1
*traceroute: wrote www.tm.a.prd.aadg.trafficmanager.net 40 chars, ret=-1
*This is from the routing table.
code_textdefault 47.47.60.89 UGS 66550 1500 bce0 40.0.0.0/5 link#3 U 2827313 1500 bce1 40.139.91.18 link#3 UHS 0 16384 lo0 47.47.60.88/29 link#1 U 2593273 1500 bce0 47.47.60.90 link#1 UHS 0 16384 lo0 66.148.187.136/29 link#3 U 2603986 1500 bce1 66.148.187.139 link#3 UHS 0 16384 lo0 66.148.187.139/32 link#3 U 0 1500 bce1 66.148.187.140 link#3 UHS 0 16384 lo0 127.0.0.1 link#7 UH 604 16384 lo0 172.16.1.0/24 192.168.1.5 UGS 0 1500 re0 192.168.1.0/24 link#2 U 37862400 1500 re0 192.168.1.1 link#2 UHS 0 16384 lo0 208.67.220.220 47.47.60.89 UGHS 16413 1500 bce0 208.67.222.222 47.47.60.89 UGHS 16530 1500 bce0 IPv6 Routes Destination Gateway Flags Use Mtu Netif Expire ::1 link#7 UH 0 16384 lo0 fe80::%bce0/64 link#1 U 0 1500 bce0 fe80::219:b9ff:fede:bb5d%bce0 link#1 UHS 0 16384 lo0 fe80::%re0/64 link#2 U 0 1500 re0 fe80::ca3a:35ff:fede:f20d%re0 link#2 UHS 0 16384 lo0 fe80::%bce1/64 link#3 U 0 1500 bce1 fe80::219:b9ff:fede:bb5b%bce1 link#3 UHS 0 16384 lo0 fe80::%lo0/64 link#7 U 0 16384 lo0 fe80::1%lo0 link#7 UHS 0 16384 lo0 ff01::%bce0/32 fe80::219:b9ff:fede:bb5d%bce0 U 0 1500 bce0 ff01::%re0/32 fe80::ca3a:35ff:fede:f20d%re0 U 0 1500 re0 ff01::%bce1/32 fe80::219:b9ff:fede:bb5b%bce1 U 0 1500 bce1 ff01::%lo0/32 ::1 U 0 16384 lo0 ff02::%bce0/32 fe80::219:b9ff:fede:bb5d%bce0 U 0 1500 bce0 ff02::%re0/32 fe80::ca3a:35ff:fede:f20d%re0 U 0 1500 re0 ff02::%bce1/32 fe80::219:b9ff:fede:bb5b%bce1 U 0 1500 bce1 ff02::%lo0/32 ::1 U 0 16384 lo0 pfSense is © 2004 - 2019 by Rubicon Communications, LLC (Netgate). All Rights Reserved. [view license] -
@dcihon said in Can't get to login.microsoft.com:
C:\WINDOWS\system32>tracert login.microsoft.com
Tracing route to san.current.a.prd.aadg.akadns.net [40.126.0.70]So notice the 40.126 address... Now notice his routing table...
40.0.0.0/5 link#3 U 2827313 1500 bce1No shit he can not get there ;)
I take it there is a shit ton of stuff he can not get to - and this is just 1 has noticed.
40.0.0.0 - 47.255.255.255
That is a LOT Of addresses... He thinks are directly attacked to his link#3 ;)
Someone has a typo on their mask would be my guess.
-
So can you give me some help on how to fix this?
Where do I go in pfsense to change it so it doesn't route there or whatever I should do to fix this. -
@dcihon said in Can't get to login.microsoft.com:
So can you give me some help on how to fix this?
What is your WAN IP / LAN IP ?
WAN is static ? DHCP ? -
Looks like maybe someone pulled some IP range out of their you know what and said lets use this..
What network is connected to bce1?
Looks like the default route is on that /29 network on bce0
-
My WAN IP is : 47.47.60.90
There are 2 internet connections at this office .
Lan IP is 192.168.1.60
WAN is static.
DHCP coming from pfsense LAN interface. -
More info about this one :
@dcihon said in Can't get to login.microsoft.com:My WAN IP is : 47.47.60.90
Where did it came from ? Mask ?
( @johnpoz : let's get ready for the ROFL )
-
Not sure how to answer these questions.
Does this help.
Windstream WINDSTREAMWAN 66.148.187.137 66.148.187.137 Windstream Gateway
WSvlan1GWE LAN 192.168.1.5 192.168.1.5 vlan1 IP on WS Router
WindstreamWANGW WINDSTREAMWAN 40.139.91.17 40.139.91.17
CharterWANGW (default) CHARTERWAN 47.47.60.89 47.47.60.89 Charter -
@dcihon said in Can't get to login.microsoft.com:
40.0.0.0/5 link#3 U 2827313 1500 bce1
40.139.91.18 link#3 UHS 0 16384 lo0Where did that come from... Looks someone put a 40.139.91.18 address on pfsense with a mask of /5
WindstreamWANGW WINDSTREAMWAN 40.139.91.17 40.139.91.17
That is not suppose to be a /5 that is for sure ;)
-
It was already here when I got here.
There are 2 ISP's coming in.
I am going to get rid of one of them but I can't yet.
It is running their phone system and I can't get rid of it yet.
It is the 40. address I believe.
I know the 47. ISP is the one I want for Internet traffic. -
40.139.91.18 address on pfsense with a mask of /5
I changed this to /24 and it fixed the problem.
Not sure if I caused some other problem.
Thanks for everyone's help. -
You need to check to see what the mask is actually suppose to be - a /24 seems large as well.. See the other one you have with a /29 that is more realistic for IP space an ISP would give you, etc.
I would check with ISP what the settings should be!!!
What I can tell you for sure though - is not suppose to be a /5 ;) That is a freaking HUGE!!!!!! 134 Million addresses!!!
If I had to make an educated guess if that address is assigned to you I would guess either a /30 or /29 would be the most logical.. Those or maybe a /28 would put the wire at .16 and would make sense for your .17 gateway and .18 address.
With that /5 you wouldn't of been able to access any internet site using any of those 134 some million addresses..
