pfsense cannot ping router unless router is pinging pfsense

[ebj29]

Hello all,
I’m looking for help on a strange problem. Any help would be greatly appreciated.
I have a pfSense firewall that cannot ping the router’s gateway IP (or anything farther, like 1.1.1.1) unless the router is pinging the firewall.
The setup is :
I have WAN /28 with the first usable address on Mikrotik router RB960 as gateway xxx.xxx.xxx.128/28, and I have declared one of the public addresses on a pfSense firewall xxx.xxx.xxx.136/28.
There are two other routers between the FTTH router and the pfSense, all with pass through for VLAN 1705.
The RB960 can ping the pfSense firewall with no problem.

When I ping from the pfsense to the gateway on the RB960 it does not respond unless the RB960 is pinging the pfsense address at the same time.
Also, while the RB960 is pinging the pfsense, the LAN side of the pfsense has fast responding access to the internet. If I stop pinging from the RB960, the internet access becomes very slow responding or even time out.
I have set the ARP on the RB960 to the pfsense IP as permanent, with no change.

Also, I have deactivated all of the Firewall rules on the RB960 and tested again with no change, of course reactivating them again.

Please, any ideas of help would be greatly appreciated.

[ebj29]

@ebj29
I should mention, We put a Windows laptop on the same network port, with the same ip /28 address and it has no problem with accessing the gateway and internet.

[viragomann]

@ebj29 said in pfsense cannot ping router unless router is pinging pfsense:

I have WAN /28 with the first usable address on Mikrotik router RB960 as gateway xxx.xxx.xxx.128/28

.128 is not usable in a /28 subnet.

So maybe, that's a typo and your gateway is .129?
If so, ensure, that you have configured the interface subnet mask correctly on pfSense and stated the gateway in the WAN settings.

[ebj29]

@viragomann Hi and thank for your reply.
It is usable as the gateway ip of the outside facing router
with xxx.xxx.xxx.128/28 and all usable through to xxx.xxx.xxx.142 with broadcast on xxx.xxx.xxx.143

For anyone ever facing the same problem ; I found the problem / solution.

The vlan interface on the RB960 FTTH router in which the gateway IP is assigned, (vlan1705 vlan interface device) was attached to the port connected to the inside router.
I changed it to be attached to the Bridge and the problem went away.
Ouf !

[stephenw10]

.128 is the network address there if the subnet is routed to you. You should use .129 as the gateway.

https://jodies.de/ipcalc?host=83.172.155.128&mask1=28

[johnpoz]

@ebj29 said in pfsense cannot ping router unless router is pinging pfsense:

with the same ip /28 address

I am with @viragomann and @stephenw10 on this - while it might work in some scenarios.. .128 is the wire on a /28 cidr.. Shouldn't really be used as a host address. Same with .143 in that /28 being the "broadcast" while both wire/network address, broadcast address can sometimes be used as actual host address.. Wire/Network address and broadcast shouldn't really be used as host addresses.

Glad you got it sorted, but using those addresses as host when they are not meant as that is bad practice..