Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    windows clients can only ping gateway

    General pfSense Questions
    4
    20
    1.6k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • E
      elliopitas
      last edited by

      @stephenw10 said in windows clients can only ping gateway:

      So the pfSense LAN interface address only?

      yes

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        What error do you see if you try to ping some other device on the local subnet?

        E 1 Reply Last reply Reply Quote 0
        • E
          elliopitas @stephenw10
          last edited by

          @stephenw10 said in windows clients can only ping gateway:

          What error do you see if you try to ping some other device on the local subnet?

          hmm I seen to fixed the local network somehow but i still get a timeout if i ping my other lan or the internet
          here's also the routing table
          alt text

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            Do you see that traffic arriving and being passed by pfSense?

            Start a continuous ping to, say, 8.8.8.8. Them check the pfSense state table in Diag > States. Filter it by 8.8.8.8 and make sure there are WAN and LAN states.

            If there are no states then either that traffic is being blocked (should be in the firewall log) or it never arrives.

            A common thing that can present like this is a rogue dhcp server on your network providing a bad gateway. Make sure pfSense shows your test client in the dhcp leases.

            Steve

            E 1 Reply Last reply Reply Quote 0
            • E
              elliopitas @stephenw10
              last edited by

              @stephenw10 said in windows clients can only ping gateway:

              Do you see that traffic arriving and being passed by pfSense?

              Start a continuous ping to, say, 8.8.8.8. Them check the pfSense state table in Diag > States. Filter it by 8.8.8.8 and make sure there are WAN and LAN states.

              If there are no states then either that traffic is being blocked (should be in the firewall log) or it never arrives.

              A common thing that can present like this is a rogue dhcp server on your network providing a bad gateway. Make sure pfSense shows your test client in the dhcp leases.

              Steve
              I can see that the device is leased a DHCP address from the server from DHCP leases tab. there are no states or any traffic from the specific client blocked but I did notice some strange entries but they ware there before this issue

              b7dc1fbd-a705-4aab-972a-3463135041e6-image.png
              I have no clue who 192.168.2.1 client is. and that address doesn't belong to any of my home networks
              I only have 192.168.0.0/24 and 192.168.1.0/24

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                Check the ARP table if it's locally attached. It really wants to use UPnP though. 😉

                If there are no states or blocked traffic from a test client and the error it shows is a timeout where is it sending pings?

                You might have something blocking it and not logging like Snort or Suricata maybe?

                E 1 Reply Last reply Reply Quote 1
                • E
                  elliopitas @stephenw10
                  last edited by

                  @stephenw10 said in windows clients can only ping gateway:

                  Check the ARP table if it's locally attached. It really wants to use UPnP though. 😉

                  If there are no states or blocked traffic from a test client and the error it shows is a timeout where is it sending pings?

                  You might have something blocking it and not logging like Snort or Suricata maybe?

                  it's not in the arp table.
                  i don't have anything like that. my LAN consists of 2 pfsense routers 4 ubiquity aps, 1 ap and unifi controller running on a raspberry pi

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    Run a pcap. What MAC address is it coming from? If that's another router check there to see where it's being routed from.

                    Steve

                    E 1 Reply Last reply Reply Quote 0
                    • E
                      elliopitas @stephenw10
                      last edited by

                      @stephenw10 said in windows clients can only ping gateway:

                      Run a pcap. What MAC address is it coming from? If that's another router check there to see where it's being routed from.

                      Steve

                      I get

                      11:24:12.375776 c8:3a:35:f1:9f:08 > 01:00:5e:7f:ff:fa, ethertype IPv4 (0x0800), length 440: (tos 0x0, ttl 4, id 0, offset 0, flags [DF], proto UDP (17), length 426)
    192.168.2.1.3213 > 239.255.255.250.1900: [udp sum ok] UDP, length 398
11:24:12.483271 c8:3a:35:f1:9f:08 > 01:00:5e:7f:ff:fa, ethertype IPv4 (0x0800), length 440: (tos 0x0, ttl 4, id 0, offset 0, flags [DF], proto UDP (17), length 426)
    192.168.2.1.3213 > 239.255.255.250.1900: [udp sum ok] UDP, length 398

                      so the mac of the device is c8:3a:35:f1:9f:08 and the mac of the interface its trying to reach is 01:00:5e:7f:ff:fa right?
                      i cant find any device or interface in my arp and DHCP tables. checked manually some devices too to see if it was them and i can't find a device that matches this mac

                      johnpozJ 1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator @elliopitas
                        last edited by johnpoz

                        @elliopitas said in windows clients can only ping gateway:

                        01:00:5e

                        Is a multicast mac your not going to find that in your arp table. But the other one c8:3a:35 is Tenda company, they make networking gear. https://www.tendacn.com/us/default.html

                        
MAC Address Details

Company
    Tenda Technology Co., Ltd.
Address
    Shenzhen Guandong 518057
    CHINA
Range
    C8:3A:35:00:00:00 - C8:3A:35:FF:FF:FF
Type
    IEEE MA-L

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.03 | Lab VMs 2.7.2, 24.03

                        E 1 Reply Last reply Reply Quote 0
                        • E
                          elliopitas @johnpoz
                          last edited by

                          @johnpoz said in windows clients can only ping gateway:

                          @elliopitas said in windows clients can only ping gateway:

                          01:00:5e

                          Is a multicast mac your not going to find that in your arp table. But the other one c8:3a:35 is Tenda company, they make networking gear. https://www.tendacn.com/us/default.html

                          
MAC Address Details

Company
    Tenda Technology Co., Ltd.
Address
    Shenzhen Guandong 518057
    CHINA
Range
    C8:3A:35:00:00:00 - C8:3A:35:FF:FF:FF
Type
    IEEE MA-L

                          ok found the device and fixed it. but still the problem persists

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            If everything is configured with the same subnet size then your problem is probably in the switch. That traffic should be going directly between clients. If it's using wifi then check client isolation.

                            Steve

                            E 1 Reply Last reply Reply Quote 0
                            • E
                              elliopitas @stephenw10
                              last edited by

                              @stephenw10 said in windows clients can only ping gateway:

                              If everything is configured with the same subnet size then your problem is probably in the switch. That traffic should be going directly between clients. If it's using wifi then check client isolation.

                              Steve

                              Wi-Fi isolation is not enabled, the clients can ping each other on Wi-Fi, and the switch is working fine since the printer and my linux laptop that are also connected to the same switch have no problems.
                              i will back up configuration and reset the router I cant figure out what else to do

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                I wouldn't expect that to make any difference since that traffic doesn't go through the router at all.

                                If other devices can ping them then they are able to reply. It's almost certainly some Windows issue locally.

                                Steve

                                1 Reply Last reply Reply Quote 0
                                • E
                                  elliopitas
                                  last edited by

                                  ok so i solved the problem...
                                  idk why I didn't do this earlier but I checked the arp table of the computers that were not working and the mac didn't match my router.
                                  turns out that my brother's switch killed itself and decided to give itself statically the same IP as the router, arp poisoning the network so the computers could only access devices in the same subnet.
                                  idk why this affected only Windows devices

                                  1 Reply Last reply Reply Quote 2
                                  • First post
                                    Last post