Asymmetric routing problem. Either TCP works, ICMP not or ICMP works, TCP not.



  • I can't seem to figure this one out. I'm using gif to tunnel a static IP from a VPS to my home.

    From here, https://doc.pfsense.org/index.php/Asymmetric_Routing_and_Firewall_Rules#Gateway_not_set_when_it_should_be_set

    It seems that I should set the gateway. If I do, TCP works, however both ICMP replies and outgoing pings get sent out of my WAN interface instead of the tunnel.

    If I set the gateway to none, ICMP works properly, but TCP SYN/ACK gets sent out my WAN.



  • Managed to solve outgoing pings with an explicit allow ICMP echo request on the tunnel interface, seems those were being blocked even though I have an allow * on the LAN.

    I'm still seeing echo reply being sent out my WAN if I ping the tunnel IP externally. Is there any way to have a rule apply to packets coming from the pfsense box itself and set the gateway if src==tunnel ip?

    Since everything else seems to be working now, I can live without external ping.


Log in to reply