HELP: Traffic not being passed to destination host from a single host.

eakz83

Hi All,

We are using a PfSense firewall version 2.0.1 in a production environment and have recently come across this issue: Specific traffic (Microsoft RDP) from a single host is not allowed through the firewall even though there is a rule to permit it.

My investigations have not identified anything obvious. I have looked at the firewall logs and can see that the traffic is received on the WAN interface. I ran a packet capture which shows traffic not being sent out the destination interface. I have checked the state table and can confirm that a session is created. I have looked at the routing table and can confirm that a route exists for the destination host.

I can however connect to the destination host from another computer that is in a different subnet. The traffic from this host passes over the same interfaces!

To resolve this issue I have deleted and recreated the firewall rule, rebooted the firewall, checked the destination host firewall but so far nothing has resolved the problem. Any thoughts?

saeen

Hi Eakz83,

Even though from the information it is hard to say what is going on but i would suggest you look at the NAT section. So if a connection is coming on the WAN interface may be you have not configured port forwarding ?

Also i would suggest using VPN for RDP or atleast lock to specific external hosts. Hope it helps.

DerBachmannRocker

It might be worth to try reducing the MTU size. I have seen RDP break in the weirdest of scenarios when some packets were small enough but as soon as you logged in your session would hang. On you Windows computer open a command prompt as administrator (!) and try:

netsh interface ipv4 show subinterfaces

To list your interfaces and get the index and current MTU value.

netsh interface ipv4 set subinterface “Lan-Verbindung″ mtu=1200 store=persistent

To set a MTU value of 1200 to the interface with the name "Lan-Verbindung".

A value of 1200 should be low enough to rule out any MTU issue.

eakz83

Hi Saeen,

Thanks for the response.

We are not using NAT on the firewall and there is no port forwarding configured. Also, we have another host on the WAN subnet that can connect to the destination host without any issues.

eakz83

Hi DerBachmannRocker,

Thanks for the response.

I agree I have seen strange things when MTU values have been modified from the default but in this scenario we have not made any changes to the MTU on the server or the interface's of the firewall and as we can connect to the server from another host within the same network as the host that we are having this issue with I do not think that this is the problem. Also, I would have expected to see the packets being dropped by the firewall in the logs or in a packet capture.

Interestingly enough, I moved the destination server into another network and this resolved the issue, so I think that this may be an issue with the interface itself, possibly hardware.