Can't no access to some websites
-
Good morning
I recently have problems accessing some websites,
I have pfsense version 2.4.5_1
the problem occurs intermittently
I have disabled all blocking rules and contacted my ISP ...
Nothing seems to work.
it seems to be a firewall problemcan someone help me?
-
@EmanueleILTK said in Can't no access to some websites:
it seems to be a firewall problem
Seems ? You want to protect your source ?
When you install pfSense, it has one firewall rule **.
It's on the LAN interface.
It says : allow all traffic from any source, to any destination, using any protocol using any ports.
It's a pass-all rule.So, if there is a firewall issue, it isn't pfSense. It would be upstream - or down stream.
Easy to proof, as you can take pfSense out of your network, and you still won't be able to visit these sites ....@EmanueleILTK said in Can't no access to some websites:
I have disabled all blocking rules
Why would you block yourself to go somewhere ?
If you don't wana go, don't go.** there are other, hidden firewall rules, like a list with IPv4 and IPv6 addresses that are not routable / non existent IP's etc.
edit : just to be sure - and to make a long story short :
Do not enable this :
Services > DNS Resolver > General Settings >
For the 'why' part, read the forum, the DNS.DHCP forum.
-
@Gertjan said in Can't no access to some websites:
Why would you block yourself to go somewhere ?
If you don't wana go, don't go.
** there are other, hidden firewall rules, like a list with IPv4 and IPv6 addresses that are not routable / non existent IP's etc.
edit : just to be sure - and to make a long story short :
Do not enable this :
Services > DNS Resolver > General Settings >eliminating the firewall this problem does not exist
i also disabled all blocking rules
at the moment this problem occurs on vimeo.com -
@EmanueleILTK said in Can't no access to some websites:
eliminating the firewall this problem does not exist
And how exactly did you do that? And how exactly are you setup?
Pfsense (the firewall) doesn't give 2 shits where you go.. Out of the box.. It blocks nothing.. It sure can not tell the difference between siteX.com and siteY.com
If your having issues accessing a specific site. Then the problem is most likely dns related, or your filtering with IPS, pfblocker, proxy?
As already mentioned out of the box the outbound rules are any any... Pfsense become a go between.. You send it something that says want to go to 1.2.3.4.. Pfsense says I don't know where that is - send it to my gateway (your isp).. Doesn't care what it is, doesn't know what it is.. With the out of the box setup, pfsense doesn't really even "firewall" other than keeping track of states to know that the return traffic for where you sent something is allowed back and to send it back to you. It keeps track of the states and nat.. But where you go it doesn't care, nor does it block.. If you are having issues with some specific site, then either your isp has an issue getting there, or you just not connected at all. Or your having problems even resolving what IP to go to from the name.. But "firewalling" is not going to be the problem with the default rules.
I would suggest you validate that you can actually resolve where your trying to do.. nslookup, dig, host, shoot even a ping to the name.. Do you get a response with the correct ip?
C:\>ping vimeo.com Pinging vimeo.com [151.101.64.217] with 32 bytes of data: Reply from 151.101.64.217: bytes=32 time=10ms TTL=57 Reply from 151.101.64.217: bytes=32 time=11ms TTL=57When you have a problem access this site, from you machine was does the ping command show you?
-
@EmanueleILTK said in Can't no access to some websites:
at the moment this problem occurs on vimeo.com
Is it a DNS issue ?
( you, as a person, uses "vimeo.com" to go to vimeo.com, but comptures don't understand "vimeo.com", they convert it to 151.101.128.217 first - this is called 'DNS' )Does your device (phone, pc etc) converts vimeo.com to an IP ?
You could receive another IP, as I do a 'DNS' from Europe.
Not significant, but can you ping that IP ?
( I can )edit : Well, what @johnpoz said ;)
-
For all we know your using a VPN? Are you using the default unbound setup, did you setup forwarding. Is your client using doh for dns - what browser are you using..
Would love to help you.. But to the details have you have given pretty much is car doesn't work.
User: So my red car sometimes doesn't start.
Mech: Like doesn't start when? When its cold, when its out of gas.. When you forget to turn the key? Does it make any sounds? Do the lights come on and you turn the key and what? But then it does start other times???
User: The blue car starts..
Mech: <rolleyes> Ugghhhh! -
from shell of firewall server
the problem suddenly appears from nothing, was working perfectly fine till two days ago, but sometimes the site it's working
if it was related to the rules of the firewall it would have never worked -
I don't use a vpn and the problem is on every browser
-
Are you using vip on your wan? Did you wan IP change? Can you ping loopback? 127.0.0.1, when this happens.. Your saying that you can not ping just this IP, but every other IP works 1.1.1.1, 4.2.2.2 (other public dns).. Other sites works.. So you can ping say www.netgate.com, but then not vimeo.com, and then www.cnn.com works?
This is hardware pfsense, this is not a virtual instance of pfsense?
Lets see your routing table? Do you have more than one gateway setup for pfsense?
Your not running any sort of IPS, like snort or suricata.. In your log do you see the firewall rules reloaded or loading?
-
@EmanueleILTK said in Can't no access to some websites:
I have pfsense version 2.4.5_1
The first post states the latest version but your CLI prompt says 2.4.4. Is it a VM which is swapping between versions?
-
^ good catch ;)
-
Failed to reboot after upgrade perhaps?
-
@Raffi_ said in Can't no access to some websites:
The first post states the latest version but your CLI prompt says 2.4.4. Is it a VM which is swapping between versions?
sorry, i have the 2.4.4 version
i have 3 wan, the problem is in all of them,
This is hardware pfsense, i dont use a VIP -
Upgrade. You're not even on 2.4.4p3.
-
Routing tables
Internet:
Destination Gateway Flags Netif Expire
default 192.168.1.1 UGS re0
dns.google 192.168.1.129 UGHS re2
10.0.8.0/24 10.0.8.2 UGS ovpns2
10.0.8.1 link#36 UHS lo0
10.0.8.2 link#36 UH ovpns2
10.0.14.0/24 ILTK1Winzozz UGS ovpns1
10.0.14.1 link#35 UHS lo0
ILTK1Winzozz link#35 UH ovpns1
10.0.15.0/24 10.0.15.2 UGS ovpns5
10.0.15.1 link#40 UHS lo0
10.0.15.2 link#40 UH ovpns5
10.0.16.0/24 10.0.16.2 UGS ovpns4
10.0.16.1 link#38 UHS lo0
10.0.16.2 link#38 UH ovpns4
10.0.38.0/24 10.0.38.2 UGS ovpns3
10.0.38.1 link#37 UHS lo0
10.0.38.2 link#37 UH ovpns3
10.0.39.0/24 10.0.39.2 UGS ovpns9
10.0.39.1 link#42 UHS lo0
10.0.39.2 link#42 UH ovpns9
ec2-52-59-2-112.eu 192.168.1.1 UGHS re0
ec2-52-59-118-197. 192.168.1.1 UGHS re0
dnsunico.welcomeit 192.168.1.1 UGHS re0
localhost link#9 UH lo0
172.21.3.0/24 link#20 U re3.113
172.21.3.254 link#20 UHS lo0
192.168.1.0/25 link#1 U re0
192.168.1.102 link#1 UHS lo0
192.168.1.128/25 link#4 U re2
192.168.1.130 link#4 UHS lo0
192.168.2.0/24 link#23 U re3.2
fw link#23 UHS lo0
192.168.3.0/24 link#17 U re4.3
192.168.3.254 link#17 UHS lo0
192.168.4.192/26 link#18 U xl0.4
192.168.4.254 link#18 UHS lo0
192.168.5.0/29 link#19 U xl0.5
192.168.5.6 link#19 UHS lo0
192.168.6.0/24 link#21 U re4.6
192.168.6.254 link#21 UHS lo0
192.168.8.0/24 link#6 U re3
wpad link#6 UHS lo0
192.168.9.0/24 link#14 U xl0.9
192.168.9.254 link#14 UHS lo0
192.168.10.0/24 link#12 U xl0.10
192.168.10.254 link#12 UHS lo0
192.168.11.0/24 link#15 U re3.11
192.168.11.254 link#15 UHS lo0
192.168.12.0/24 link#16 U xl0.12
192.168.12.254 link#16 UHS lo0
192.168.13.240/28 link#32 U xl0.13
iPhone-di-Ester link#32 UHS lo0
192.168.14.192/26 link#24 U xl0.14
192.168.14.254 link#24 UHS lo0
192.168.15.240/28 link#27 U re4.15
192.168.15.254 link#27 UHS lo0
192.168.16.0/24 link#28 U re4.16
192.168.16.254 link#28 UHS lo0
192.168.17.0/24 link#29 U re4.17
192.168.17.254 link#29 UHS lo0
192.168.18.0/24 link#33 U re3.18
192.168.18.254 link#33 UHS lo0
192.168.19.224/27 link#30 U re4.19
192.168.19.254 link#30 UHS lo0
192.168.20.0/24 link#31 U xl0.20
fw link#31 UHS lo0
192.168.112.0/24 link#34 U re3.112
192.168.112.254 link#34 UHS lo0
192.168.114.0/24 link#22 U re3.114
192.168.114.254 link#22 UHS lo0
192.168.200.248/29 link#25 U xl0.200
192.168.200.254 link#25 UHS lo0
192.168.201.0/24 link#26 U xl0.201
192.168.201.254 link#26 UHS lo0
resolver2-fs.opend 213-182-68-41.ip.w UGHS re1
resolver2.opendns. 213-182-68-41.ip.w UGHS re1
resolver1.opendns. 192.168.1.1 UGHS re0
213.182.68.40/29 link#3 U re1
213-182-68-42.ip.w link#3 UHS lo0
213-182-68-43.ip.w link#3 UHS lo0
213-182-68-44.ip.w link#3 UHS lo0
213-182-68-45.ip.w link#3 UHS lo0
213-182-68-46.ip.w link#3 UHS lo0
any-in-2678.1e100. 213-182-68-41.ip.w UGHS re1Internet6:
Destination Gateway Flags Netif Expire
localhost link#9 UH lo0
fe80::%re0/64 link#1 U re0
fe80::eade:27ff:fe link#1 UHS lo0
fe80::%re1/64 link#3 U re1
fe80::221:27ff:fec link#3 UHS lo0
fe80::%re2/64 link#4 U re2
fe80::eade:27ff:fe link#4 UHS lo0
fe80::%xl0/64 link#5 U xl0
fe80::20a:5eff:fe7 link#5 UHS lo0
fe80::%re3/64 link#6 U re3
fe80::eade:27ff:fe link#6 UHS lo0
fe80::%re4/64 link#7 U re4
fe80::eade:27ff:fe link#7 UHS lo0
fe80::%lo0/64 link#9 U lo0
fe80::1%lo0 link#9 UHS lo0
fe80::%xl0.10/64 link#12 U xl0.10
fe80::20a:5eff:fe7 link#12 UHS lo0
fe80::%re3.8/64 link#13 U re3.8
fe80::eade:27ff:fe link#13 UHS lo0
fe80::%xl0.9/64 link#14 U xl0.9
fe80::20a:5eff:fe7 link#14 UHS lo0
fe80::%re3.11/64 link#15 U re3.11
fe80::eade:27ff:fe link#15 UHS lo0
fe80::%xl0.12/64 link#16 U xl0.12
fe80::20a:5eff:fe7 link#16 UHS lo0
fe80::%re4.3/64 link#17 U re4.3
fe80::eade:27ff:fe link#17 UHS lo0
fe80::%xl0.4/64 link#18 U xl0.4
fe80::20a:5eff:fe7 link#18 UHS lo0
fe80::%xl0.5/64 link#19 U xl0.5
fe80::20a:5eff:fe7 link#19 UHS lo0
fe80::%re3.113/64 link#20 U re3.113
fe80::eade:27ff:fe link#20 UHS lo0
fe80::%re4.6/64 link#21 U re4.6
fe80::eade:27ff:fe link#21 UHS lo0
fe80::%re3.114/64 link#22 U re3.114
fe80::eade:27ff:fe link#22 UHS lo0
fe80::%re3.2/64 link#23 U re3.2
fe80::eade:27ff:fe link#23 UHS lo0
fe80::%xl0.14/64 link#24 U xl0.14
fe80::20a:5eff:fe7 link#24 UHS lo0
fe80::%xl0.200/64 link#25 U xl0.200
fe80::20a:5eff:fe7 link#25 UHS lo0
fe80::%xl0.201/64 link#26 U xl0.201
fe80::20a:5eff:fe7 link#26 UHS lo0
fe80::%re4.15/64 link#27 U re4.15
fe80::eade:27ff:fe link#27 UHS lo0
fe80::%re4.16/64 link#28 U re4.16
fe80::eade:27ff:fe link#28 UHS lo0
fe80::%re4.17/64 link#29 U re4.17
fe80::eade:27ff:fe link#29 UHS lo0
fe80::%re4.19/64 link#30 U re4.19
fe80::eade:27ff:fe link#30 UHS lo0
fe80::%xl0.20/64 link#31 U xl0.20
fe80::20a:5eff:fe7 link#31 UHS lo0
fe80::%xl0.13/64 link#32 U xl0.13
fe80::20a:5eff:fe7 link#32 UHS lo0
fe80::%re3.18/64 link#33 U re3.18
fe80::eade:27ff:fe link#33 UHS lo0
fe80::%re3.112/64 link#34 U re3.112
fe80::eade:27ff:fe link#34 UHS lo0
fe80::%ovpns1/64 link#35 U ovpns1
fe80::eade:27ff:fe link#35 UHS lo0
fe80::%ovpns2/64 link#36 U ovpns2
fe80::eade:27ff:fe link#36 UHS lo0
fe80::%ovpns3/64 link#37 U ovpns3
fe80::eade:27ff:fe link#37 UHS lo0
fe80::%ovpns4/64 link#38 U ovpns4
fe80::eade:27ff:fe link#38 UHS lo0
fe80::%ovpns6/64 link#39 U ovpns6
fe80::eade:27ff:fe link#39 UHS lo0
fe80::%ovpns5/64 link#40 U ovpns5
fe80::eade:27ff:fe link#40 UHS lo0
fe80::%ovpns7/64 link#41 U ovpns7
fe80::eade:27ff:fe link#41 UHS lo0
fe80::%ovpns9/64 link#42 U ovpns9
fe80::eade:27ff:fe link#42 UHS lo0
fe80::%ovpnc8/64 link#43 U ovpnc8
fe80::eade:27ff:fe link#43 UHS lo0 -
I really don't know what to do, do you advise me to update the system?
-
@EmanueleILTK said in Can't no access to some websites:
default 192.168.1.1 UGS re0
dns.google 192.168.1.129 UGHS re2Well from that.. looks like your sending traffic to google or 8.8.8.8 out a different gateway then what your normal gateway (default) is.
; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;8.8.8.8.in-addr.arpa. IN PTR ;; ANSWER SECTION: 8.8.8.8.in-addr.arpa. 86294 IN PTR dns.google. ;; Query time: 5 msec ;; SERVER: 192.168.3.10#53(192.168.3.10) ;; WHEN: Wed Nov 04 08:57:01 Central Standard Time 2020 ;; MSG SIZE rcvd: 73So if you can still ping google, but not other stuff.. Points to an issue with your normal gateway.
-
This post is deleted! -
this is my getways
-
And since your using a different gateway for 8.8.8.8 and it works, but something to normal gateway fails.. It shows an issue with your default gateway..
Again what does your log say... If your having issues with a gateway it should be logged..
