Packet Tracer function
-
Apologies if this is not the right place to post this…
Before working with pfSense, I worked with Cisco's ASA product, and previously PIX.
The ASA has a packet tracer feature that can be used to help troubleshoot why packets get disposed of the way they do by the firewall. It would allow one to specify the source IP, interface, and port, and the destination IP and port and trace this pretend packet through the firewall, detailing all the rules that affect the final disposition. It was very useful when dealing with large, complex, almost idiotic rule sets.
Does this functionality exist in pfSense, or something exactly similar? ;)
If not, is this the place to request such a feature, or should I post it elsewhere?
-
The firewall log will tell you if a connection got blocked and what rule blocked it, if that's what you're asking.
-
That's close, but not quite. That will show if a firewall rule blocked or allowed a packet, if the rule has logging turned on. But no info about NAT, Routing, Egress interface etc.
Take for example, the situation that cdsJerry is dealing with. If there was a Diagnostics–Packet tracer feature, one could theoretically input source and destination information, click a button, and have diagnostic report generated that details all the steps and checks the packet encounters as it traverses the firewall. We could much more easily determine where his configuration is screwed up.
I have no idea if it's even feasible. If someone wanted to develop it as a standalone package, I'd contribute some dollars toward that delinquency.
-
cdsjerry's issue is pretty clear - he has a mess of rules most of which are useless and others that are completely wide open. You don't need a trace to see that ;)
-
No. Nothing like the packet tracer function in the ASA in pfSense.
-
juniper has the same sort of function as well, you can put in details of traffic like source ip, or dest ip and port, etc. and what what happens to the traffic. But that is just because the logging is so horrific if you ask me.
Pfsense logging tell you exactly what blocked a packet or allowed a packet, etc. Just log your rules and your good.
-
cdsjerry's issue is pretty clear - he has a mess of rules most of which are useless and others that are completely wide open. You don't need a trace to see that ;)
Regardless, I salute you, Derelict, and Doktornotor for helping the guy. That's a convoluted mess if I have EVER seen one.
-
I've come across a customer using Netgate/PFSense recently and I am really impressed by this firewall. I'm familiar with the Cisco packet tracer this user spoke of and agree to its usefulness. I normally use Fortigate's and was wondering how PFSense might compare in functionality and was really hoping it had this packet tracer function. In my numerous Fortinet installations, the rulesets are often complex and relying on logging to quickly validate rulesets is ultimately nonsense. I use FG's "Policy Lookup" feature almost daily and is probably my most used tool built into the platform. Not having this feature eliminates PFSense from being a contender for any of my medium to large installations. It would certainly be an excellent addition to this already impressive firewall. Is there a place to submit feature requests or is this the "right" place?
-
@jgradke feature requests can be put in here
-
@johnpoz said in Packet Tracer function:
@jgradke feature requests can be put in here
John, who exactly controls: https://redmine.pfsense.org? is there an administrator and their email address?
-
Pretty sure anyone can create an account to put in an issue or feature request.. I don't really recall the details, since have had an account for like 13 years or something ;)
-
@johnpoz said in Packet Tracer function:
Pretty sure anyone can create an account to put in an issue or feature request.. I don't really recall the details, since have had an account for like 13 years or something ;)
My problem is I created an account but as I was submitting or clicked submit, I noticed a typo in my email address...it was too late. So, I sent an email to a person in France, who I believed was an administrator but never heard a word. I was hoping to get the error corrected so I could confirmed and activate the account. Was hoping to not have to create a new account again...but that's what it appears I may need to do.
-
stephenw10 Netgate Administratorlast edited by stephenw10 Jan 25, 2024, 7:20 PM Jan 25, 2024, 7:18 PM
Send me your account in chat and I'll see what I can do.
Though if your email is incorrect you should just be able to create another account with the correct email?
Steve
-
For reference I posted it as a feature request:
https://redmine.pfsense.org/issues/15189
-
@stephenw10 Okay!
