Asymmetric routing problem. Either TCP works, ICMP not or ICMP works, TCP not.
-
I can't seem to figure this one out. I'm using gif to tunnel a static IP from a VPS to my home.
From here, https://doc.pfsense.org/index.php/Asymmetric_Routing_and_Firewall_Rules#Gateway_not_set_when_it_should_be_set
It seems that I should set the gateway. If I do, TCP works, however both ICMP replies and outgoing pings get sent out of my WAN interface instead of the tunnel.
If I set the gateway to none, ICMP works properly, but TCP SYN/ACK gets sent out my WAN.
-
Managed to solve outgoing pings with an explicit allow ICMP echo request on the tunnel interface, seems those were being blocked even though I have an allow * on the LAN.
I'm still seeing echo reply being sent out my WAN if I ping the tunnel IP externally. Is there any way to have a rule apply to packets coming from the pfsense box itself and set the gateway if src==tunnel ip?
Since everything else seems to be working now, I can live without external ping.