Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Can ping to LAN but not Web Configurator

    Scheduled Pinned Locked Moved Problems Installing or Upgrading pfSense Software
    48 Posts 9 Posters 65.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      kejianshi
      last edited by

      Interesting idea that maybe something else is interfering…

      Unplug the switch.  Plug the computer directly into the pfsense LAN with nothing else attached then give it a try.

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        ^ for all we know for his switch he is using some soho routers switch ports and it has an IP of 192.168.1.1, which you would think he would get that web gui.  But when something doesn't work that you think should be working, it takes 2 seconds to validate your actually talking to the correct something.  Have run into duplicate IPs too many times to not validate the mac.

        I would think more likely reason is that his browser is just using some proxy..

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          Some devices do not redirect to https when you try to use http and behave like this.
          If you had two devices trying to be 192.168.1.1 would you get ping response in both directions? Especially if one of them was the switch.

          Steve

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            no you could get answer to ping

            so from 192.168.1.100 I ping 192.168.1.1 but get mac of say the switch IP..  He answers.  When you ping the 100 from pfsense .1 he pings the mac of .100 and .100 send answer to the mac that asked.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              Hmm, yes layer 2/3 difference. The MAC would show though as you've been saying.

              Steve

              1 Reply Last reply Reply Quote 0
              • S
                SKT174
                last edited by

                Thanks for all the input guys, really appreciated.

                As suggested, I've taken out the switch, now directly connect my notebook to LAN interface (white cable , UE1 on pfsense), WAN (UE0) still the same Red Cable

                I followed the instructions as shown to me

                I can't confirm the MAC address as the J5 creator doesn't print the MAC on the unit nor the package it came with

                I've checked my Proxy setting to make sure

                I've installed Wireshark and as soon as I go to the pfsense box (192.168.1.1) I get the RED text on Black shown in Wireshark

                1 Reply Last reply Reply Quote 0
                • S
                  SKT174
                  last edited by

                  Oh I forgot to mentioned . Yes I've connected to another pfsense box to that address in the past.

                  And .. I've also tried connecting using another Desktop PC, same results.

                  It is a clean install, it doesn't route internet traffic yet, WAN interface is connected but I can't access internet on my notebook.

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    Hmm, weird. Looks like the pfSense box is replying but your laptop is ignoring the replies. Perhaps.  :-\

                    Are you able to browse other external sites? Ping external addresses? In other words is routing working?

                    I notice your WAN interface has auto-negotiated to 10Mb which is odd but shouldn't be causing this.

                    Steve

                    1 Reply Last reply Reply Quote 0
                    • DerelictD
                      Derelict LAYER 8 Netgate
                      last edited by

                      I've installed Wireshark and as soon as I go to the pfsense box (192.168.1.1) I get the RED text on Black shown in Wireshark

                      SYN from you
                      SYN,ACK from pfSense
                      ACK from you should be next.  It's not there so you aren't getting the webConfigurator.

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • S
                        SKT174
                        last edited by

                        So .. just to be sure I'm not doing anything stupid…

                        I've wipe & Re-Install PFsense again.

                        I selected option 1

                        I selected option I

                        And it is still not working for some strange reason.

                        The routing isn't working either as I can't access external internet.

                        1 Reply Last reply Reply Quote 0
                        • K
                          kejianshi
                          last edited by

                          More USB ethernet…

                          Trouble shooting these setups is always hard when they are so simple and yet things refuse to work, but I don't like USB ethernet, and I'm sure its working for some people in some installations, but up to this point, its the most likely culprit I've noticed.  You don't have even a single built in NIC?

                          1 Reply Last reply Reply Quote 0
                          • S
                            SKT174
                            last edited by

                            I'm thinking whether it's those USB ethernet adapter is causing it.  I'll see if I can try another brand and see if it makes any difference.

                            1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              Hard to believe it would work with ICMP but not TCP.
                              As Derelict said your client is not responding. This appears to be a client side issue. Yet you say you tried a different client? Different browser?

                              Steve

                              1 Reply Last reply Reply Quote 0
                              • DerelictD
                                Derelict LAYER 8 Netgate
                                last edited by

                                You want to check that "Block private networks" is unchecked on your WAN interface.  I don't know if the installer does that by default if it detects a private WAN address.

                                Is that wireshark capture a few messages back taken from the 192.168.1.100 windows client?  If so, you need to figure out why it is not sending an ACK in reply to the SYN,ACK sent by pfSense in the connection process before you waste any more time looking at pfSense.

                                Or, as has been mentioned, USB ethernet interfaces: not a fan.  BUT if they're mucking up the works, it should show in the SYN,ACK captured by wireshark.

                                Chattanooga, Tennessee, USA
                                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                1 Reply Last reply Reply Quote 0
                                • ?
                                  Guest
                                  last edited by

                                  If you look at "Valid interfaces are" the answer is:

                                  Probably not…

                                  1 Reply Last reply Reply Quote 0
                                  • DerelictD
                                    Derelict LAYER 8 Netgate
                                    last edited by

                                    Yeah.  More likely some software firewall or antivirus or ? on the windows pc.

                                    Chattanooga, Tennessee, USA
                                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                    1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator
                                      last edited by

                                      You will notice that the connection just kind of dies.. Not only do you see retrans from pfsense you call see retrans from .100 to .1

                                      It is not answering dns queries either..

                                      Juts for be complete - how you would verify the mac your pinging is to look in your arp table on the .100 box

                                      So

                                      C:>arp -a

                                      Interface: 192.168.1.100 –- 0xc
                                        Internet Address      Physical Address      Type
                                        169.254.7.80          00-26-24-08-8a-ed    dynamic
                                        169.254.82.185        00-1c-c3-09-05-7a    dynamic
                                        192.168.1.3          00-0c-29-c8-f2-dc    dynamic
                                        192.168.1.7          00-0c-29-dd-02-ba    dynamic
                                        192.168.1.8          00-0c-29-55-4f-95    dynamic
                                        192.168.1.40          00-1f-29-54-17-14    dynamic
                                        192.168.1.97          00-26-24-08-8a-ed    dynamic
                                        192.168.1.98          00-1c-c3-09-05-7a    dynamic
                                        192.168.1.99          00-06-dc-43-ad-78    dynamic
                                        192.168.1.253        00-0c-29-1e-18-ae    static
                                        192.168.1.255        ff-ff-ff-ff-ff-ff    static
                                        224.0.0.22            01-00-5e-00-00-16    static
                                        239.255.255.250      01-00-5e-7f-ff-fa    static

                                      You notice from my workstation that is the mac I saw on my ifconfig..

                                      Your sniff is odd.. You see 3 different connections to 80..  And yes you see the syn-ack back, but you never send ack?  And actually start the conversation..  And then you just see a bunch of retrans

                                      You see retrans from pfsense sending his syn-ack because he never got back the ack.. And you see .100 sending back his syn because seems he thinks he never got the syn-ack.

                                      Need to figure out why your client .100 did not send back ACK to the syn-ack he was clearly sent and seen by wireshark for the 3 different connections you tried to create to http (80)

                                      Do you have another client you can try?

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      1 Reply Last reply Reply Quote 0
                                      • DerelictD
                                        Derelict LAYER 8 Netgate
                                        last edited by

                                        MACs will also be in your wireshark captures.

                                        Chattanooga, Tennessee, USA
                                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                        1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by

                                          yeah in there it looks right

                                          to where he is sending the request for 80

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          1 Reply Last reply Reply Quote 0
                                          • DerelictD
                                            Derelict LAYER 8 Netgate
                                            last edited by

                                            Are these captures taken on .1 or .100?

                                            It makes a difference because if from .1 we know the SYN-ACK was sent, but not that it was actually received.  If from .100 we know it was sent and received.

                                            Chattanooga, Tennessee, USA
                                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.