ICMP works, TCP not: Asymmetrical Route? - 2.0.3

  • Hello again,

    we got a problem with our firewall.

    What we have:

    • for all physical server
    • for all virtual server
      – Alias IP
      -- Virtualization with Parallels/OpenVZ
      -- Using "routing" config.
      -- Rules "any to any: type any: all allow on every interface"

    what we try:
    A virtual server( tries to connect(anything with TCP) to another hardware node(
    is not working. If we try ICMP we got an answer.
    So imho the route should work but as explained, it does not.

    Maybe this is the problem:

    1: vServer sends a SYN to
    2: the physical server, collect the package and is routing to the defaultGW with sender
    3: pfSense receives the package.
    4: checkes the rules and figures out that there is one "any to any on any"
    5: Now pfsense sending the SYN package back thru the same Interface (cause the alias IP)
    6: physical server( receives the package
    7: physical server send the SYNACK with sender-ip to receiver via default GW
    8: Firewall does not has a rule and blocks the package. but IMHO the automatic back rule should work and it does not.

    We had this problem also on our old ZyXELL ZyWall, after enabling the Option "Asymetrical Route" the problem is gone.

    We are able to reproduce the same manner on pfSense 2.1 RCx.
    And if we DISABLE the Firewalling and using pfsense in routing mode, everything works fine except the firewalling ;)

    edit 1: typos
    edit 2: info

  • hi

    your problem is, the physical server does not send the ack request to firewall. it send it directly to, because the server should be in the same subnet. the answer of to must send it to the gateway because it is not in the same subnet. so only the ACK is going over gateway and so no rule match.

    now you must create an alias with all networks (e.g. and of the interface and add a new floating rule with:

    Interface of and
    Direction any
    Protocol TCP
    Source and Destination is the created alias
    TCP Flags all
    State type none

    So it should do what you want.

  • So topic solved :)

Log in to reply