Diagnostic - Unable to ping a LAN address
-
I'm not sure how to find logs in this situation / diagnose.
I have a single IP address on the LAN that PFsense box will not talk to.
- Firewall logs do not show an error
- Systems logs do not show error
- Snort logs do not show an error
- Unable to Ping
- Unable to connect (curl -V or curl -G http://LAN:80/ping)
- Packet captures only tell me that things are being dropped
-There are no Firewall rules (no floating) with that IP address
PFSense --> a single lan address get's dropped
All other LAN ip's can talk to eachother as expected.
The LAN address that PFsense is dropping I can ping back to the PFsense, SSH to the PFsense. So it's only one direction.
My question is where else can I look to see what is being triggered to block a LAN ip address?
-
@speedracer said in Diagnostic - Unable to ping a LAN address:
Packet captures only tell me that things are being dropped
Where are you taking the packet capture? You trying to ping this IP that is what? 192.168.?.? 10.?.?.? 172.16-31.?.? ???
All other LAN ip's can talk to eachother as expected.
Pfsense has nothing to do with lan device A talking to another lan device B..
Step 1 would be to show us this packet capture you saying that is showing dropped? On the client, on pfsense?
If you can ping pfsense IP on your lan from this device, but pfsense can not ping it - screams firewall on this device!!
-
I agree it is something firewall. I'm just not sure where to look for logs..
When I look at the firewall logs (Status /System Logs) there is nothing in the logs that show the client
Packet Captue is only 1 way.
- PFsense to Client I can capture
- Client to Pfsense nothing is captured
Pfsense to Client
[2.4.5-RELEASE][ad77@gw]/root: ping 192.168.77.60
PING 192.168.77.60 (192.168.77.60): 56 data bytes
^C
--- 192.168.77.60 ping statistics ---
37 packets transmitted, 0 packets received, 100.0% packet lossClient to Pfsense
gizmo@192.168.77.60:~$ ping 192.168.77.1
--- 192.168.77.1 ping statistics ---
473 packets transmitted, 473 received, 0% packet loss, time 472006ms
rtt min/avg/max/mdev = 0.044/0.056/0.132/0.011 ms
pfsense to 60.pcap
Change client ipaddress and things work as expected
- Pfsense to Client - ok
- Packet captures show correctly on both directions
-
Hi,
Nothing on the floating firewall rule tab that drops ICMP returned packets ?
-
@speedracer said in Diagnostic - Unable to ping a LAN address:
Client to Pfsense nothing is captured
Then your not pinging pfsense.. Your pinging something else... Validate the arp tables on pfsense and client reflect the correct mac for pfsense and the client.
-
@Gertjan said in Diagnostic - Unable to ping a LAN address:
Hi,
Nothing on the floating firewall rule tab that drops ICMP returned packets ?
Nothing in Floating
@johnpoz said in Diagnostic - Unable to ping a LAN address:
@speedracer said in Diagnostic - Unable to ping a LAN address:
Client to Pfsense nothing is captured
Then your not pinging pfsense.. Your pinging something else... Validate the arp tables on pfsense and client reflect the correct mac for pfsense and the client.
ARPing --> PFsense to Client and Client to PFsense --> MAC reflects each other
replies in both situationsI'm stuck at where to find logs that show the packets are being dropped in PFsense.
-
Client to Pfsense nothing is captured
Here is the thing - you could have everything blocked in every firewall rule.. Doesn't matter even if pfsense doesn't answer you would still see the traffic in a sniff.. A sniff sees the traffic before it even moves up the stack to the firewall!!
If your not seeing pings to pfsense, then your not pinging pfsense IP or you sniffing on the wrong interface!
If pfsense doesn't "see" the ping - how could it ever answer... doesn't matter what possible firewall rules you have in place.. Pfsense has to know its being pinged to answer - your not seeing the pings in a sniff, then pfsense is not seeing them, and will not answer something it never sees.
Other thing that could cause an issue would be say wrong mask on client or pfsense (mismatch).. Is this client dhcp or static? I take it static because you say you change the IP and it works.
I assume your using /24 (255.255.255.0) mask for this 192.168.77 network?
