Can I disable packet filtering while still keeping NAT to white list countries?
-
@johnpoz said in Can I disable packet filtering while still keeping NAT to white list countries?:
@paul2019 and your saying that was working.. So what changed?
If you disable nat and pfsense has a public IP lets say 1.2.3.4 on its wan.. And you disable nat, then it would send traffic from whatever the IP of your device is - say 192.168.1.X -- and your isp device is natting this also your public IP?
Before changing to hybrid and adding that entry it was "partially" working, some phones had audio issues and such (mute), after they added that entry above pointing to the VOIP unit local address (FO100E is an alias) the audio related issues were all solved.
We have Verizon fiber and I'm not positive how their device works, I have never logged in to it, don't even know if I can, but pfsense does have a public static ip address assigned to its WAN interface and the gateway is also a public static ip address, not a local address, this was supplied by Verizon.
-
@paul2019 I am asking what changed since they setup that no nat thing - has it been half working this whole time.. Or did something else change in your setup?
-
@johnpoz said in Can I disable packet filtering while still keeping NAT to white list countries?:
@paul2019 I am asking what changed since they setup that no nat thing - has it been half working this whole time.. Or did something else change in your setup?
As far as of the network setup nothing changed, except firmware updates on the VOIP system, which I was suspecting to be the issue in the beginning.
The random audio issues have been gone since then, no more. Then we recently noticed while digging the login the SIP 486 errors, I can't confirm they have been happening since the beginning since we did a factory reset on the unit to try to fix this.
-
@paul2019 if pfsense is in fact dropping packets its easy enough to see.. Do a sniff on wan same time you doing on one lan.. And look for packets entering the wan, but not being sent on out the lan. Or the reverse - packets coming in to lan, and not leaving the wan..
you can do this easy enough with just tcpdump on pfsense vs the gui.. you can do one in gui, and other via tcpdump via ssh to pfsense, etc.
What exactly did you send the vendor where they said the firewall was dropping packets.. If its not showing both sides of pfsense then it was a guess on their part..
Always easier to blame the customers equipment.. ;) I find it hard to believe pfsense is just randomly dropping packets, but until you have proof either way can not be ruled out. But pfsense without an IPS is not going to be "inspecting" anything and saying - oh lets drop this packet, etc.
If it was that DF set thing - you can see if DF is set on a packet coming into the wan or entering the lan, etc. in your packet capture.
-
@johnpoz said in Can I disable packet filtering while still keeping NAT to white list countries?:
@paul2019 if pfsense is in fact dropping packets its easy enough to see.. Do a sniff on wan same time you doing on one lan.. And look for packets entering the wan, but not being sent on out the lan. Or the reverse - packets coming in to lan, and not leaving the wan..
you can do this easy enough with just tcpdump on pfsense vs the gui.. you can do one in gui, and other via tcpdump via ssh to pfsense, etc.
What exactly did you send the vendor where they said the firewall was dropping packets.. If its not showing both sides of pfsense then it was a guess on their part..
I'm going to have look at this tcpdump on the pfsense today.
The VOIP unit has a built-in packet capture tool, I turned it on and let it run till the SIP error happened, then I sent the dump to them with the precise date and time the error happened.
-
@paul2019 there is no real way they can say from a sniff on their device that your firewall dropped anything.. Al they could see from sniff on their device is no answer was received.. Or they didn't get something they were expecting. How can you tell where something was dropped?
if I send a packet to 1.2.3.4 and don't get an answer - sure sniffing on my device I can see I put a packet on the wire, but got no response.. But where was it dropped, in the local network, at the firewall, in the internet some where, maybe the place I was sending it got it and just didn't answer.
To know where something is being dropped you have to be able to check on the in and out of that something that is going to process the traffic..
-
@johnpoz said in Can I disable packet filtering while still keeping NAT to white list countries?:
@paul2019 there is no real way they can say from a sniff on their device that your firewall dropped anything.. Al they could see from sniff on their device is no answer was received.. Or they didn't get something they were expecting. How can you tell where something was dropped?
if I send a packet to 1.2.3.4 and don't get an answer - sure sniffing on my device I can see I put a packet on the wire, but got no response.. But where was it dropped, in the local network, at the firewall, in the internet some where, maybe the place I was sending it got it and just didn't answer.
To know where something is being dropped you have to be able to check on the in and out of that something that is going to process the traffic..
You're right, only with a traffic dump from the pfsense itself they would be able to tell that, if that was the case.
I will do a packet capture on the pfsense itself and send it to them.
-
@paul2019 you really need both in and out of pfsense to tell if pfsense itself is not passing on traffic that it should..
I mean you could sniff at pfsense wan and their device and see hey something is getting lost.. But until you actually sniff on pfsense lan interface as well - how are you sure pfsense got it.. I mean you can assume your network didn't drop it.. but you can not be sure.
We had a case where a switch was dropping udp 53 packets.. Sometimes.. This was causing issues with dns.. But we had narrow it down via the full path in the DC to find out where it was being dropped. And sure enough sniff on one specific switch showed it coming into the switch, but not leaving the switch... So you can not always assume something is passing traffic that it should until you validate where the traffic is actually getting loss.
-
@paul2019 Using a static port for outbound NAT is not uncommon; 3CX requires it if the server is on-premises. It prevents pfSense from randomizing the source port, which is normally done.
Agree, without Snort/Suricata, packets don’t randomly drop. unless packet loss…?
Since you mention a second router are you sure THAT is not involved is the problem? Another thing commonly needed is to disable SIP-ALG or similar “helper” features. It’s off in pfSense; check your other router and/or phone server configuration directions.
Re:disabling pf…no need to worry about allowing certain IPs, with the firewall disabled everything is allowed…though NAT doesn’t work.
-
@steveits said in Can I disable packet filtering while still keeping NAT to white list countries?:
@paul2019 Using a static port for outbound NAT is not uncommon; 3CX requires it if the server is on-premises. It prevents pfSense from randomizing the source port, which is normally done.
Agree, without Snort/Suricata, packets don’t randomly drop. unless packet loss…?
Since you mention a second router are you sure THAT is not involved is the problem? Another thing commonly needed is to disable SIP-ALG or similar “helper” features. It’s off in pfSense; check your other router and/or phone server configuration directions.
Re:disabling pf…no need to worry about allowing certain IPs, with the firewall disabled everything is allowed…though NAT doesn’t work.
Correct, it was randomizing the ports I believe and the change they did fixed it. (https://docs.netgate.com/pfsense/en/latest/recipes/nat-voip-phones.html)
The other "router" is the Verizon box, but it doesn't have DHCP or anything on it since whatever I hook up to it needs a static ip address config to be able to access internet, so I believe it does not do NAT on it, but I have no access to it too, only their tech staff can mess with it, it's a business plan.
We do have "SIP session helper" turned on in our VOIP unit, we did send the support our entire config and they haven't mentioned that this could be an issue though.
-
Should I change firewall optimization to "Conservative" and disable "scrub" as per stated here?
-
@paul2019 sure would be something to try.. But still confused to what changed - if this was working before, and now is having problems.. What changed - your saying they updated their firmware on their device?
If so then maybe sure scrubbing or clearing df might have an effect if they were not doing whatever they were doing before, etc.
-
@johnpoz said in Can I disable packet filtering while still keeping NAT to white list countries?:
@paul2019 if pfsense is in fact dropping packets its easy enough to see.. Do a sniff on wan same time you doing on one lan.. And look for packets entering the wan, but not being sent on out the lan. Or the reverse - packets coming in to lan, and not leaving the wan..
you can do this easy enough with just tcpdump on pfsense vs the gui.. you can do one in gui, and other via tcpdump via ssh to pfsense, etc.
What exactly did you send the vendor where they said the firewall was dropping packets.. If its not showing both sides of pfsense then it was a guess on their part..
Always easier to blame the customers equipment.. ;) I find it hard to believe pfsense is just randomly dropping packets, but until you have proof either way can not be ruled out. But pfsense without an IPS is not going to be "inspecting" anything and saying - oh lets drop this packet, etc.
If it was that DF set thing - you can see if DF is set on a packet coming into the wan or entering the lan, etc. in your packet capture.
Are these packet capture settings good?
-
@paul2019 that would be wan.. and if you don't restrict it to some IP and or ports its going to prob get very large very quickly.. You prob want to try and limit it to the traffic your interested in.
And you need something running on the lan side interface at the same time
Do you know the external IP of what the vendor device talks to, or is random source IPs - what about the port?
-
@johnpoz said in Can I disable packet filtering while still keeping NAT to white list countries?:
@paul2019 that would be wan.. and if you don't restrict it to some IP and or ports its going to prob get very large very quickly.. You prob want to try and limit it to the traffic your interested in.
And you need something running on the lan side interface at the same time
Do you know the external IP of what the vendor device talks to, or is random source IPs - what about the port?
Sounds good, interface WAN.
I was hoping to let it capture all day and then download the file it generates at the end of the day.
Yes I do have his external IP, will enter that in the Host Address field to limit the size. -
@paul2019 make sure your doing a sniff on the lan side interface at the same time... You really need to see in/out at the same time to validate firewall is dropping something..
