Craziest PFSense problem Ive come across (cannot SSH to PFSense)

opticalc

I have 2 PCs on the same LAN as PFSense's LAN network (named NACHOWIFI) of 192.168.1.0/24 where PFSense is the .254 address.

PC1 on .1 can SSH to PFsense, PC2 on .253 cannot. It is not dual homed either. When PC2 tries, then sniffing tcpdump on pfsense shows the SYN coming in and PFSense just completely ignores it:

[26.07-RELEASE][root@REDACTED]/root: tcpdump -n -i mvneta0.401 'port 22 and host 192.168.1.253'
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on mvneta0.401, link-type EN10MB (Ethernet), snapshot length 262144 bytes
13:03:54.945444 IP 192.168.1.253.57698 > 192.168.1.254.22: Flags [S], seq 699652624, win 64240, options [mss 1460,sackOK,TS val 1673780428 ecr 0,nop,wscale 7], length 0
13:03:55.976676 IP 192.168.1.253.57698 > 192.168.1.254.22: Flags [S], seq 699652624, win 64240, options [mss 1460,sackOK,TS val 1673781460 ecr 0,nop,wscale 7], length 0
13:03:57.000689 IP 192.168.1.253.57698 > 192.168.1.254.22: Flags [S], seq 699652624, win 64240, options [mss 1460,sackOK,TS val 1673782484 ecr 0,nop,wscale 7], length 0

The anti-lockout is still there also:

Wait, what???
make it make sense!

johnpoz

@opticalc hmmm - ethernet filtering? Would be my first guess. Or blocked because of failed attempts.

Look in your sshguard table - or you could add the ip to bypass

Are you running the ethernet filtering - based on mac?

opticalc

@johnpoz no ethernet filtering but HA! it was that login protection, I added that bypass, didnt even know that was a thing.

What happened is I was trying to set up a Home Assistant automation to do some stuff over SSH and I guess it was a bit overzealous on me there.

Thanks, you rock!!

johnpoz

@opticalc yeah at some point it would unblock itself, but depending it could be longer than the block time, detection time because if you get blocked multiple times in a row it increases the block time.

Glad you got it sorted.