Dropped SYN packet

[eshartle]

I work for a Audio/Video conferencing provider. We have a pfsense firewall between our lab(s) subnets, and our main LAN. Our engineers are seeing a strange problem that only occurs on the FIRST attempt at making a connection. We've confirmed the problem does not exist when the client and server are on the same subnet.

Here is the engineers details:

**Problem:
a) Usually the SYN from embeddedTcpClient doesn't get through to embeddedTcpServer the first time:
LEFT SIDE RIGHT SIDE
embeddedTcpClient ----> firewall ---> embeddedTcpServer (ipAddress:50000)
b) Without the firewall, we haven't ever seen a problem:
embeddedTcpClient ----> embeddedTcpServer (ipAddress:50000)

Details:
We're trying to connect embeddedTcpClient via TCP to port 50000 to an embeddedTcpServer.

1. The SYNs from embeddedTcpClient are being sent, but they aren't being seen by embeddedTcpServer.
   a. We used wireshark on separate computer to confirm SYN is leaving embeddedTcpClient and is present on "LEFT" side of firewall.
   b. Used wireshark on embeddedTcpServer to confirm embeddedTcpServer does not see SYN.
   We see exponential backoff occurring because embeddedTcpServer isn't responding to the SYN, which causes the connection to take a long time to fail.
2. The next connect attempt works by embeddedTcpClient usually works just fine and establishes the connection.**

Any ideas what to check? I have removed all traffic filters - it is basically just a router at the moment (allow-all IPV4 traffic on all interfaces).

Thanks!

[johnpoz]

@eshartle said in Dropped SYN packet:

Any ideas what to check?

For starters... Lets see the firewall rules.

And simple sniff on pfsense to validate the syn gets to pfsense in the first place.
And then just sniff to see if pfsense sends the packet on.

How do you have this setup exactly? And how is stuff being routed? You have it between your lan segments? So clients don't point to pfsense as there gateway? Or these 2 networks are lan segments on pfsense, etc.