Pfsense kvm guest and host/guest internet connectivity



  • Hi All,

    I have a strange situation at the moment that I have been trying to resolve for some time and I'm hoping there is someone out there who may have come across the same, or similar issue.

    I have a single host running ubuntu 13.10 with bridged network interfaces living on top of an lacp bond. KVM is configured to use these bridge interfaces for guest connectivity. All guests are using the virtio drivers for nic/block devices.

    pfsense is up and operational and if I connect a laptop to the local lan then i can browse/ping/ftp to devices on the internet.

    However, the host itself, and all kvm guests on the local system are only able to ping out on to the internet via the pfsense kvm guest, no other traffic appears to get a response back to the guest via pfsense.

    for example, another guest is able to ping and recieve responses to ftp.heanet.ie, however, if i try to ftp to ftp.heanet.ie i get a connection timed out.

    I can see some states in pfsense relating to the ftp request, but it does not appear to be responding back to the requestor.

    has anyone come across anything like this? Any pointers/tips would be greatly appreciated.



  • Hi All,

    I was reading through some older posts and came across someone mentioning weird NAT issues with the Virtio drivers when (s)he was testing pfsense in KVM.

    Anyhow, I changed my NIC models to e1000 and everything works as expected now.

    So, it appears there may be an issue with the if_vtnet drivers in the current pfsense version? (I am running v2.1 RELEASE).

    Thanks for reading and I hope this helps someone else down the line



  • I am using pfsense 2.1 on proxmox ve 3.1 which uses KVM.

    I have to physical NICs installed to pfsense - when both running as VirtIO I do not have http access from LAN. If there is only my WAN NIC in VirtIO mode and the LAN NIC is E1000 everything is working.

    So if you do not have bandwidth problems with the E1000 NICs I would not worry if they can be used as VirtIO or not. Probably newer versions of FreeBSD support VirtIO better.



  • Hello, have you been able to solve this?. I'm having this very same problem.



  • Just had the same problem (and it's 2018!)

    After looking online for some time, I found this article that suggests that the problem goes away by disabling hardware checksum offloading in Advanced / Networking:

    https://www.mondaiji.com/blog/other/it/10254-virtual-pfsense-on-kvm-virtio-network-issues

    I'm going it tomrrow and see what happens.