Virtualized PFsense - host (linux) cannot ping Pfsense Wan Interface (and vice-versa) - Not rule related

spyshagg

@viragomann said in Virtualized PFsense - host (linux) cannot ping Pfsense Wan Interface (and vice-versa) - Not rule related:

@spyshagg
Possibly there is something blocking the traffic in the hypervisor.

Sniff the traffic on pfSense WAN interface (Diagnistic > Packet Capture) to ensure that the packets are even arriving on the interface.

The packet capture tells me the ping requests are not arriving on the interface. Strange.

But the same happens in Virtualbox and KVM, two different VM platforms. It suggest its not the hypervisor?

spyshagg

@viragomann

Ping fails but traceroute succeeds

alt text

Edit: nevermind, both fail. I misread the result.

viragomann

@spyshagg
When there are no packets on the WAN interface, there is not really much you can do from the view of pfSense, except the VM configuration.

Did you obey the set up instruction for virtualized platforms from the pfSense docs?

spyshagg

@viragomann said in Virtualized PFsense - host (linux) cannot ping Pfsense Wan Interface (and vice-versa) - Not rule related:

@spyshagg
When there are no packets on the WAN interface, there is not really much you can do from the view of pfSense, except the VM configuration.

Did you obey the set up instruction for virtualized platforms from the pfSense docs?

Yes.

But its odd that ping works on the LAN interface but not on WAN, when both interfaces are setup the same on KVM/Virtualbox.

Patch

@spyshagg said in Virtualized PFsense - host (linux) cannot ping Pfsense Wan Interface (and vice-versa) - Not rule related:

The host and the guest also share the same LAN interface (bridged)

Hypervisor access from the lan sounds normal to me. It also sounds like this is working.

@spyshagg said in Virtualized PFsense - host (linux) cannot ping Pfsense Wan Interface (and vice-versa) - Not rule related:

The host and the guest share the same WAN interface (bridged)

Why are you doing that. Most setups want the hypervisor only directly accessible from the lan interface and often only the lan management interface. If you need hypervisor access from the internet then via vpn on your router makes more sense to me.

I suspect your hypervisor is blocking wan access by default.

viragomann

@spyshagg said in Virtualized PFsense - host (linux) cannot ping Pfsense Wan Interface (and vice-versa) - Not rule related:

But its odd that ping works on the LAN interface but not on WAN

Indeed. Are both networks configured properly on all involved devices?

Also ensure that the packets on the host are going out on the correct interface by sniffing the traffic.

spyshagg

@patch said in Virtualized PFsense - host (linux) cannot ping Pfsense Wan Interface (and vice-versa) - Not rule related:

Why are you doing that. Most setups want the hypervisor only directly accessible from the lan interface and often only the lan management interface. If you need hypervisor access from the internet then via vpn on your router makes more sense to me.

I suspect your hypervisor is blocking wan access by default.

Its a last desperate measure. Sometimes one of the virtual nics stops passing traffic into Pfsense. Sometimes Wan, sometimes Lan.
I am building a watchdog that runs on the host to ping both pfsense interfaces and reset the VM if they fail.

viragomann

@spyshagg said in Virtualized PFsense - host (linux) cannot ping Pfsense Wan Interface (and vice-versa) - Not rule related:

Sometimes one of the virtual nics stops passing traffic into Pfsense. Sometimes Wan, sometimes Lan.
I am building a watchdog that runs on the host to ping both pfsense interfaces and reset the VM if they fail.

It would be better to eliminate the real reason for this than doing a workaround by restarting the VM.

spyshagg

@viragomann said in Virtualized PFsense - host (linux) cannot ping Pfsense Wan Interface (and vice-versa) - Not rule related:

@spyshagg said in Virtualized PFsense - host (linux) cannot ping Pfsense Wan Interface (and vice-versa) - Not rule related:

Sometimes one of the virtual nics stops passing traffic into Pfsense. Sometimes Wan, sometimes Lan.
I am building a watchdog that runs on the host to ping both pfsense interfaces and reset the VM if they fail.

It would be better to eliminate the real reason for this than doing a workaround by restarting the VM.

sadly its not physically possible.

Patch

@spyshagg
Yuk

As a desperate measure I would prefer:

using pass through NICs for pfsense.
Monitoring the interfaces within pfsense and
resetting them via an pfsense watchdog / interface monitor if required.

But whatever works

spyshagg

@patch said in Virtualized PFsense - host (linux) cannot ping Pfsense Wan Interface (and vice-versa) - Not rule related:

@spyshagg
Yuk

As a desperate measure I would prefer:

using pass through NICs for pfsense.

Monitoring the interfaces within pfsense and

resetting them via an pfsense watchdog / interface monitor if required.

But whatever works

Hardware and software configuration are not possible at this point. The problem manifested itself 3 full weeks after deployment and not in the 2 weeks of internal testing prior to deployment.

A simple reset does not fix the issue. The vm must be shutdown and restarted.

It appears the problem is indeed with the hypervisor blocking packets.

thank guys