ICMP pings still timing out despite ICMP traffic being reported as passed

johnpoz

Not having any issues here with polling.

I have no special rules other than the default lan rules.. Nat is automatic - you really should not have to do anything for pings to work.

So curious - are you behind a double nat.. You hide that second hop in your trace..

nosuchproblem.png_thumb

lanrules.png_thumb

timthetortoise

Second hop is very likely his public IP.

timthetortoise

@JacktheSmack:

I made any to any in the WAN rules

Well there's your problem. You're allowing anyone from anywhere into your WAN interface. Firewall rules apply to inbound packets. The ones from you are inbound on your LAN interface, outbound on your WAN interface. Once they've traversed your WAN interface, for all intents and purposes they're considered an established session, and you don't need any rules on your WAN interface to keep it working. Take the any to any rule off of your WAN interface, that's extremely dangerous.

Create a rule like this:

only with your IP instead of mine, and let me know what happens. Make sure that in the "protocol" section you select "any."

johnpoz

@timthetortoise:

Second hop is very likely his public IP.

It shouldn't be his ip, the gateway off the segment he is connected too sure, which with most isps prob a large segment - mine for example is a /21 So sure in a privacy concern issue you might want to hide part of that IP range.. But it only gives away a segment he is on that would for example in my case be some 2000 addresses ;)

timthetortoise

Yeah, meant gateway. Slow brain day. I've got a /28, so exposing my gateway would not be a great idea. Most people don't get /21s to play around with.

JacktheSmack

@johnpoz:

@timthetortoise:

Second hop is very likely his public IP.

It shouldn't be his ip, the gateway off the segment he is connected too sure, which with most isps prob a large segment - mine for example is a /21 So sure in a privacy concern issue you might want to hide part of that IP range.. But it only gives away a segment he is on that would for example in my case be some 2000 addresses ;)

It is my WAN IP that I did block out of the picture. My pfSense router is connected to a Motorola SURFboard SB 6121 modem, which should have no routing or firewalling of any kind.

I made the rule exactly as you said, and here it is under pfsense firewall logs.

Edit: While the Poll was cycling through, I unplugged my computer from the pfsense router, unplugged the router from the modem, and plugged my PC directly to the modem. Immediatly I started getting responses. It's not my ISP or modem, it's pfsense. I just need to know what setting I have wrong in my router.

dsdsfd.PNG_thumb

johnpoz

"While the Poll was cycling through, I unplugged my computer from the pfsense router, unplugged the router from the modem, and plugged my PC directly to the modem."

Really – normally you need to power cycle a cable modem. I have the SB6120 and if I change the mac of the device connected to it - I have to power cycle.

Power cycle your modem after you connect pfsense.

Here is the thing - out of the box what your doing should work.. you should not have to do anything for pings, or traceroutes to work.

As to what your blocking out - that should NOT be your wan IP.. What should be in there is the IP of your ISP router your hitting as first hop. So in my case its 24.13.176.1 while my actual IP is 24.13.x.x in that /21 range.

JacktheSmack

@johnpoz:

"While the Poll was cycling through, I unplugged my computer from the pfsense router, unplugged the router from the modem, and plugged my PC directly to the modem."

Really – normally you need to power cycle a cable modem. I have the SB6120 and if I change the mac of the device connected to it - I have to power cycle.

Power cycle your modem after you connect pfsense.

Here is the thing - out of the box what your doing should work.. you should not have to do anything for pings, or traceroutes to work.

As to what your blocking out - that should NOT be your wan IP.. What should be in there is the IP of your ISP router your hitting as first hop. So in my case its 24.13.176.1 while my actual IP is 24.13.x.x in that /21 range.

Oh you're right. That's a different IP address. The more I know….

I am gonna power cycle everything once people aren't using the Teamspeak server.

Edit: Power cycled, removed the MAC Address spoofing, but still having the issue.

axis-frank

I too am having this issue.

Have 2 WAN connections, both PPPoE on pfSense.
WAN 1 has an interface address (DHCP) with 5 Static IPs configured as Virtual IP Alias.
WAN 2 has a single Static IP, assigned via DHCP from the ISP.

I can ping WAN 2 on it's static IP just fine, as it's the same IP as the Interface address.
WAN 1 however, will only respond to a ping on it's interface address, but not on any of the IP Aliases. In the system logs, it shows this traffic as a pass entry (I specified to log it), but the machine is not getting a response.

Makes no sense!!

Any suggestions would be much appreciated. Please let me know if I can help by providing any more information.

Thanks in advance.

johnpoz

Your issue is not anything like the OP, not you have described it not.

The OP can not ping or traceroute to outside IPs.

Your talking about pinging your wans virtual IPs - not even in the same ballpark. Start your own thread!

axis-frank

My apologies, you're right. I've skimmed so many articles to try and find a solution, I misread this one.

Good luck OP

timthetortoise

@axis-frank:

My apologies, you're right. I've skimmed so many articles to try and find a solution, I misread this one.

Good luck OP

Try adding individual firewall rules for each IP on the interface, that was my fix in your case.

georgeman

I downloaded the utility and ran it, no issues with the polling function behind pfSense. Furthermore, I ran a wireshark capture on its traffic and all it generates is ICMP pings. I really can't see why it wouldn't just work ???

JacktheSmack

I disabled all packet filtering temporarily and despite NAT being completely off, it's still not working. Also I polled a couple of computers on the network just fine, with 0% loss.

So if it's not the firewall that's stopping it, what is?

georgeman

What if you get one of those hops and ping it from a console? Do you get replies?

johnpoz

can we see your wan and lan rules.. And are you nats automatic - and your floating tab is empty?

and you only have wan and lan interfaces on pfsense right?

This should just work out of the box, bing bang zoom.. You have something odd going on that is for sure - but without seeing your wan and lan rules and any nats you might have setup its hard to tell where your issue is.

Please post screen shots of these screens so we can see your full set.

JacktheSmack

@georgeman:

What if you get one of those hops and ping it from a console? Do you get replies?

Yes, pinging the hops individually works fine.

@johnpoz:

can we see your wan and lan rules.. And are you nats automatic - and your floating tab is empty?

and you only have wan and lan interfaces on pfsense right?

This should just work out of the box, bing bang zoom.. You have something odd going on that is for sure - but without seeing your wan and lan rules and any nats you might have setup its hard to tell where your issue is.

Please post screen shots of these screens so we can see your full set.

I've attached all the firewall rules and LAN/WAN settings.

http://imgur.com/a/MM8a8

![firewall nat 1 to 1.PNG](/public/imported_attachments/1/firewall nat 1 to 1.PNG)
![firewall nat 1 to 1.PNG_thumb](/public/imported_attachments/1/firewall nat 1 to 1.PNG_thumb)

johnpoz

Ok why and the hell do you have a 192.168.1.50 address as vip for a 1:1 to your wan?

What do you think that 1:1 nat is doing?

Your LAN rules say if your coming from 192.168.1.50 you can talk to 192.168.1.234?? When would that rule ever come into play? A box on 192.168.1.0/24 ie your lan would never even send a packet to 192.168.1.1 because 192.168.1.234 is its own network. And isn't .50 the vip you created?

I would suggest you remove all that stuff. I would then delete your nat rules since seems your currently set to auto but must at one time set it to manual.. So those should be deleted.

Your best best would be to prob just from the console do a
4) Reset to factory defaults

And then see what happens.

JacktheSmack

Reset to factory defaults, haven't changed a single option, and still getting timeout when I do a Poll.

johnpoz

dude your rules make no sense.. Why do you have rules for lan to lan traffic - you do understand that pfsense has nothing to do with boxes talking to each other on 192.168.1.0/24 – it is a gateway OFF that network..

You clearly created a VIP for a 1:1 - 192.168.1.50

You have setup a 1:1 NAT to what??

Simple just reset to factory and all that nonsense goes away. Then ask how to do what you want to do.. What is the purpose of 192.168.1.50 on your WAN interface in a 1:1 nat? What do you expect to accomplish with that?