Packet Tracer function



  • Apologies if this is not the right place to post this…

    Before working with pfSense, I worked with Cisco's ASA product, and previously PIX.

    The ASA has a packet tracer feature that can be used to help troubleshoot why packets get disposed of the way they do by the firewall.  It would allow one to specify the source IP, interface, and port, and the destination IP and port and trace this pretend packet through the firewall, detailing all the rules that affect the final disposition.  It was very useful when dealing with large, complex, almost idiotic rule sets.

    Does this functionality exist in pfSense, or something exactly similar?  ;)

    If not, is this the place to request such a feature, or should I post it elsewhere?



  • The firewall log will tell you if a connection got blocked and what rule blocked it, if that's what you're asking.



  • That's close, but not quite.  That will show if a firewall rule blocked or allowed a packet, if the rule has logging turned on.  But no info about NAT, Routing, Egress interface etc.

    Take for example, the situation that cdsJerry is dealing with.  If there was a Diagnostics–Packet tracer feature, one could theoretically input source and destination information, click a button, and have diagnostic report generated that details all the steps and checks the packet encounters as it traverses the firewall.  We could much more easily determine where his configuration is screwed up.

    I have no idea if it's even feasible.  If someone wanted to develop it as a standalone package, I'd contribute some dollars toward that delinquency.


  • Rebel Alliance Global Moderator

    cdsjerry's issue is pretty clear - he has a mess of rules most of which are useless and others that are completely wide open.  You don't need a trace to see that ;)


  • Netgate

    No.  Nothing like the packet tracer function in the ASA in pfSense.


  • Rebel Alliance Global Moderator

    juniper has the same sort of function as well, you can put in details of traffic like source ip, or dest ip and port, etc.  and what what happens to the traffic.  But that is just because the logging is so horrific if you ask me.

    Pfsense logging tell you exactly what blocked a packet or allowed a packet, etc.  Just log your rules and your good.



  • @johnpoz:

    cdsjerry's issue is pretty clear - he has a mess of rules most of which are useless and others that are completely wide open.  You don't need a trace to see that ;)

    Regardless, I salute you, Derelict, and Doktornotor for helping the guy.  That's a convoluted mess if I have EVER seen one.