Two IP's from ISP, Two PFsense routers (one a vm) cannot access B from A
-
@Gblenn I believe the "bridge mode" of the ISP's router/modem basically turns it into a switch. At least that's what its supposed to do.
I agree, the problem must be in my router from site A. I have just connected a spare wifi AP to site B's LAN and when on that network I can connect to services at both sites, so site B is working correctly.
Site A is using the DNS forwarder (not resolver). I set this up many years ago, and it has host overrides for the services to be access when on that network.
Site B is using DNS resolver and have the host override for dwhacks.com only
I don't either of these should be causing an issue.
-
@stephenw10 Both firewalls have public IP's but only ping from B to A:
Ping from PFsense on site B
Ping from PFsense on site A:
Ping clearly finds the correct IP.
What should I be looking for in Diagnostics -> States ?
-
@dwhacks said in Two IP's from ISP, Two PFsense routers (one a vm) cannot access B from A:
Site A is using the DNS forwarder (not resolver). I set this up many years ago, and it has host overrides for the services to be access when on that network.
Well if you have host overrides on Site A that references the services that are now on Site B, it will not work. So remove or disable those host overrides and see if that fixes it...
-
@Gblenn as per the screenshots I have attached I do not see any conflicts.
I did think of something while I was making another coffee: before setting up the router for site B I have dual WAN at site A. My ISP almost never changes the IP addresses, is it possible there is some residual config or states or something left over in my site A router making it think that the IP of site B is supposed to go to itself? Maybe is DHCP as thats what the routers use on WAN?
-
@dwhacks said in Two IP's from ISP, Two PFsense routers (one a vm) cannot access B from A:
What should I be looking for in Diagnostics -> States ?
Looks for NAT'd traffic from the internal host you're testing from.
But if ping is failing then check the firewall rules on site B. You might just not be passing ping there but it would be much easier to test of you do.
Are those two public IPs actually in the same subnet?
-
@dwhacks said in Two IP's from ISP, Two PFsense routers (one a vm) cannot access B from A:
as per the screenshots I have attached I do not see any conflicts.
But if site A has a host override for daynewaterlow.com pointing to 192.168.2.7, and that IP is no longer valid, since daynewaterlow.com is now located at Site B, of course it will not work...
-
@Gblenn daynewaterlow.com is on site A, netbird.dwhacks.com is on site B. netbird.dwhacks.com is not accessible from the network of site A.
I haven't moved all my webservers over to site B yet because I am unable to access them from site A so that makes admin stuff tricky. I would like to move them eventually.
@stephenw10 I cannot see anything in states that points to the IP of site B at any point. I think they are probable on the same subnet of my ISP but I'm not sure how to check. I believe PING is allowed.
-
I added a rule to firewall on site B and I can now ping from site A:
I still cannot access the netbird.dwhacks.com from site A though.
-
@dwhacks said in Two IP's from ISP, Two PFsense routers (one a vm) cannot access B from A:
I cannot see anything in states that points to the IP of site B at any point.
In either firewall?
Is the client behind firewall A resolving the url to the firewall B WAN?
If it is you should at least see some states in firewall A. If you don't then it could be a firewall rule on the A LAN blocking it (or not passing it).
-
@dwhacks said in Two IP's from ISP, Two PFsense routers (one a vm) cannot access B from A:
I did think of something while I was making another coffee: before setting up the router for site B I have dual WAN at site A. My ISP almost never changes the IP addresses, is it possible there is some residual config or states or something left over in my site A router making it think that the IP of site B is supposed to go to itself? Maybe is DHCP as thats what the routers use on WAN?
So Site A is (or was) "aware" of the IP that now resides on Site B then... well yes I suppose there could be some residual states or something which makes it think it should go back to itself. Similar to what I was after with the host override rules, which however you have clearly changed. I assume you have removed WAN2 completely, as well as any gateway groups etc that you may have had. And how about services Dynamic DNS, on site A is that also updated to reflect that dwhacks is no longer on that IP?
Try tracert to dwhacks.com to see what you get from pfsense on site A... That should give you a clue as to what it's doing.
Also you can run Pcap on WAN whilst pinging dwhacks to see if it shows up. Add a filter with the public IP for Site B so you only capture the important information.
-
Been away for a couple days, so I haven't tried any suggestions. BUT everything worked for about 15 minutes when I tried it the last couple hours. It no longer works, and I can't even ping site B from site A....
When I try to ping from the shell on site A pfsense:
[2.7.2-RELEASE][admin@pfsense.localhacks.lan]/root: ping dwhacks.com PING dwhacks.com (24.71.68.91): 56 data bytes ping: sendto: Permission denied ping: sendto: Permission denied ping: sendto: Permission denied ping: sendto: Permission denied ^C --- dwhacks.com ping statistics --- 4 packets transmitted, 0 packets received, 100.0% packet lossI can ping other hosts, like google.ca
I will try some of the suggestions tomorrow.
-
@Gblenn Traceroute seems to go nowhere:
1 traceroute: wrote netbird.dwhacks.com 40 chars, ret=-1 *traceroute: wrote netbird.dwhacks.com 40 chars, ret=-1 *traceroute: wrote netbird.dwhacks.com 40 chars, ret=-1 * 2 traceroute: wrote netbird.dwhacks.com 40 chars, ret=-1 *traceroute: wrote netbird.dwhacks.com 40 chars, ret=-1 *traceroute: wrote netbird.dwhacks.com 40 chars, ret=-1 * etc (does this 18 times) -
@dwhacks said in Two IP's from ISP, Two PFsense routers (one a vm) cannot access B from A:
BUT everything worked for about 15 minutes when I tried it the last couple hours. It no longer works, and I can't even ping site B from site A....
Sounds like you have something that kicks in and blocks it? Are you running Suricata/Snort?
