Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Mystery 'Reply From' address

    General pfSense Questions
    3
    16
    2452
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      Coldaddy last edited by

      I have a strange problem that I'm not certain is due in any way to my pfSense firewall (SG-2220) but it may be. From my Windows 10 PC, I ping any host outside of my local network I get a 'Reply from' of 192.168.1.250. Note internal addresses are masked a little to protect the innocent (hopefully).

      PS C:\Users\Steve> ping www.whitehouse.gov

      Pinging e4036.dscb.akamaiedge.net [23.2.60.110] with 32 bytes of data:
      Reply from 192.168.1.250: bytes=32 time=11ms TTL=255
      Reply from 192.168.1.250: bytes=32 time=6ms TTL=255
      Reply from 192.168.1.250: bytes=32 time=4ms TTL=255
      Reply from 192.168.1.250: bytes=32 time=9ms TTL=255

      Note that the address is resolved correctly:
      Pinging e4036.dscb.akamaiedge.net [23.2.60.110] with 32 bytes of data:

      Pinging an internal host sometimes works as expected, sometimes not…like in this ping where the first reply is the 192 address and the others are correct:
      PS C:\Users\Steve> ping 172.16.x.251

      Pinging 172.16.x.251 with 32 bytes of data:
      Reply from 192.168.1.250: bytes=32 time=4ms TTL=255
      Reply from 172.16.x.251: bytes=32 time<1ms TTL=64
      Reply from 172.16.x.251: bytes=32 time<1ms TTL=64
      Reply from 172.16.x.251: bytes=32 time<1ms TTL=64

      Ping statistics for 172.16.x.251:
          Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
      Approximate round trip times in milli-seconds:
          Minimum = 0ms, Maximum = 4ms, Average = 1ms

      My local subnet is 172.16.x.x/24. From this PC I have bypassed my wireless access point. The network path is:
      PC -> 5-port-switch -> 8-port-switch -> SG-2220 -> Cable-Modem -> Internet

      Trace Route from this PC:
      PS C:\Users\Steve> tracert www.yahoo.com

      Tracing route to fd-fp3.wg1.b.yahoo.com [98.138.252.30]
      over a maximum of 30 hops:

      1    <1 ms    <1 ms    <1 ms  172.16.x.1
        2    4 ms    10 ms    8 ms  192.168.1.250

      Trace complete.

      Route Print:
      PS C:\Users\Steve> route print

      Interface List
        6…18 66 da 01 09 01 ......Intel(R) Ethernet Connection (2) I219-LM
        5...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
        1...........................Software Loopback Interface 1
        2...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface

      IPv4 Route Table

      Active Routes:
      Network Destination        Netmask          Gateway      Interface  Metric
                0.0.0.0          0.0.0.0      172.16.x.1    172.16.x.55    10
              127.0.0.0        255.0.0.0        On-link        127.0.0.1    306
              127.0.0.1  255.255.255.255        On-link        127.0.0.1    306
        127.255.255.255  255.255.255.255        On-link        127.0.0.1    306
            172.16.x.0    255.255.255.0        On-link      172.16.x.55    266
          172.16.x.55  255.255.255.255        On-link      172.16.x.55    266
          172.16.x.255  255.255.255.255        On-link      172.16.x.55    266
              224.0.0.0        240.0.0.0        On-link        127.0.0.1    306
              224.0.0.0        240.0.0.0        On-link      172.16.x.55    266
        255.255.255.255  255.255.255.255        On-link        127.0.0.1    306
        255.255.255.255  255.255.255.255        On-link      172.16.x.55    266

      Persistent Routes:
        None

      IPv6 Route Table

      Active Routes:
      If Metric Network Destination      Gateway
        2    306 ::/0                    On-link
        1    306 ::1/128                  On-link
        2    306 2001::/32                On-link
        2    306 2001:0:9d38:90d7:3cb2:46b9:b740:d3f4/128
                                          On-link
        6    266 fe80::/64                On-link
        2    306 fe80::/64                On-link
        5    266 fe80::5efe:172.16.x.55/128
                                          On-link
        2    306 fe80::3cb2:46b9:b740:d3f4/128
                                          On-link
        6    266 fe80::d8f7:55d8:2b18:6f62/128
                                          On-link
        1    306 ff00::/8                On-link
        6    266 ff00::/8                On-link
        2    306 ff00::/8                On-link

      Persistent Routes:
        None

      IP Config of PC:
      PS C:\Users\Steve> ipconfig /all

      Windows IP Configuration

      Host Name . . . . . . . . . . . . : DESKTOP-TQJB1RD
        Primary Dns Suffix  . . . . . . . :
        Node Type . . . . . . . . . . . . : Hybrid
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No
        DNS Suffix Search List. . . . . . : localdomain

      Ethernet adapter Ethernet 2:

      Connection-specific DNS Suffix  . : localdomain
        Description . . . . . . . . . . . : Intel(R) Ethernet Connection (2) I219-LM
        Physical Address. . . . . . . . . : 18-66-DA-01-09-01
        DHCP Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        Link-local IPv6 Address . . . . . : fe80::d8f7:55d8:2b18:6f62%6(Preferred)
        IPv4 Address. . . . . . . . . . . : 172.16.x.55(Preferred)
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Lease Obtained. . . . . . . . . . : Saturday, April 30, 2016 2:21:26 PM
        Lease Expires . . . . . . . . . . : Sunday, May 1, 2016 5:25:31 PM
        Default Gateway . . . . . . . . . : 172.16.x.1
        DHCP Server . . . . . . . . . . . : 172.16.x.1
        DHCPv6 IAID . . . . . . . . . . . : 119039706
        DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1E-9C-8D-DD-00-23-56-6C-69-83
        DNS Servers . . . . . . . . . . . : 4.2.2.1
        NetBIOS over Tcpip. . . . . . . . : Enabled

      Tunnel adapter isatap.localdomain:

      Connection-specific DNS Suffix  . : localdomain
        Description . . . . . . . . . . . : Microsoft ISATAP Adapter
        Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
        DHCP Enabled. . . . . . . . . . . : No
        Autoconfiguration Enabled . . . . : Yes
        Link-local IPv6 Address . . . . . : fe80::5efe:172.16.24.55%5(Preferred)
        Default Gateway . . . . . . . . . :
        DHCPv6 IAID . . . . . . . . . . . : 83886080
        DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1E-9C-8D-DD-00-23-56-6C-69-83
        DNS Servers . . . . . . . . . . . : 4.2.2.1
        NetBIOS over Tcpip. . . . . . . . : Disabled

      Tunnel adapter Teredo Tunneling Pseudo-Interface:

      Connection-specific DNS Suffix  . :
        Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
        Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
        DHCP Enabled. . . . . . . . . . . : No
        Autoconfiguration Enabled . . . . : Yes
        IPv6 Address. . . . . . . . . . . : 2001:0:9d38:90d7:2889:a8be:b740:d3f4(Preferred)
        Link-local IPv6 Address . . . . . : fe80::2889:a8be:b740:d3f4%2(Preferred)
        Default Gateway . . . . . . . . . : ::
        DHCPv6 IAID . . . . . . . . . . . : 201326592
        DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1E-9C-8D-DD-00-23-56-6C-69-83
        NetBIOS over Tcpip. . . . . . . . : Disabled

      The interesting thing is that I can browse the Internet just fine. Somehow the underlying networking is working.

      From the SG-2220 things seem fine:
      PING fd-fp3.wg1.b.yahoo.com (98.138.253.109): 56 data bytes
      64 bytes from 98.138.253.109: icmp_seq=0 ttl=45 time=61.114 ms
      64 bytes from 98.138.253.109: icmp_seq=1 ttl=45 time=54.734 ms
      64 bytes from 98.138.253.109: icmp_seq=2 ttl=45 time=57.004 ms

      –- fd-fp3.wg1.b.yahoo.com ping statistics ---
      3 packets transmitted, 3 packets received, 0.0% packet loss
      round-trip min/avg/max/stddev = 54.734/57.617/61.114/2.640 ms

      Trace Route:
      1  72.191.32.1  13.469 ms  11.199 ms  11.903 ms
      2  72.191.32.1  13.592 ms  14.063 ms  7.357 ms
      3  24.28.133.117  14.053 ms  19.868 ms  90.273 ms
      4  24.175.33.144  8.333 ms  14.618 ms  4.783 ms
      5  24.175.32.184  8.616 ms  8.047 ms  4.146 ms
      6  24.175.33.4  17.164 ms  15.691 ms  24.377 ms
      7  66.109.6.88  26.088 ms  24.335 ms  32.490 ms
      8  107.14.19.97  19.163 ms  22.183 ms  19.263 ms
      9  207.86.210.125  21.483 ms  20.448 ms  19.526 ms
      10  207.88.14.182  14.005 ms  21.042 ms  18.690 ms
      11  207.88.13.123  18.695 ms  16.746 ms  16.052 ms
      12  207.86.208.26  23.914 ms  17.980 ms  18.289 ms
      13  216.115.96.79  41.234 ms  36.095 ms  30.864 ms
      14  216.115.100.8  52.076 ms  63.114 ms
          216.115.104.116  58.420 ms
      15  216.115.105.181  41.523 ms  49.509 ms
          216.115.105.185  43.971 ms
      16  98.138.97.73  61.553 ms  57.639 ms  62.796 ms
      17  98.138.93.15  44.163 ms  48.536 ms  52.691 ms
      18  98.138.240.36  54.761 ms  67.783 ms  57.158 ms

      This behavior has happened on a server, also plugged into the same 5-port switch, although I recently rebuilt it (from Win2012R2 to Win2016TR4) and it now does not exhibit this behavior. The thing is, based on past experience, it will. It seems like newly installed machines show the behavior after awhile.

      Based on my testing, this behavior is something outside of the machine and it does not involve my wireless access point. The only common components I can see are the 2 switches and the pfSense firewall. I've checked every thing I know to check. I welcome any/all troubleshooting questions/suggestions as I need to get to the bottom of this.

      Thanks in advance,
      Steve

      1 Reply Last reply Reply Quote 0
      • johnpoz
        johnpoz LAYER 8 Global Moderator last edited by

        "My local subnet is 172.16.x.x/24. "

        Why do you think you need to hide rfc1918 space???  Come on really???

        Also why is your dns an outside dns and not pfsense or your AD if your running that?

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

        1 Reply Last reply Reply Quote 0
        • C
          cmb last edited by

          From the looks of that, 192.168.1.250 is probably your modem. It sounds like it's doing something weird with ICMP traffic that has a TTL that's been decremented by 1 possibly (since from the 2220 itself it doesn't happen). What type of WAN and modem?

          1 Reply Last reply Reply Quote 0
          • C
            Coldaddy last edited by

            @johnpoz I'm probably just ignorant, but am trying to learn. I pointed to the outside DNS server as a testing step…just have not set it back to the SG-2220. I got the same behavior with the pfSense firewall set as DNS server.

            Thanks for your help.
            Steve

            1 Reply Last reply Reply Quote 0
            • C
              Coldaddy last edited by

              @cmb Cable modem is an ARRIS SURFboard SB6183. Not sure how to answer about the type of WAN…it is Time Warner cable.

              Thanks for your help.
              Steve

              1 Reply Last reply Reply Quote 0
              • C
                cmb last edited by

                The modem should just be a bridge in that case. You have a public IP on WAN I presume?

                1 Reply Last reply Reply Quote 0
                • johnpoz
                  johnpoz LAYER 8 Global Moderator last edited by

                  rfc1918 space is not routable on the public internet.. We are all using it.. There is no reason to try and obfuscate your network that are using this space..  It just make its it harder to help you..

                  I use 192.168.9.0/24 for my lan for example… pfsense is at 192.168.9.253 while my box is at 192.168.9.100

                  If address space your dealing with is in the private range - there is no reason to hide any parts of this..

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                  1 Reply Last reply Reply Quote 0
                  • C
                    Coldaddy last edited by

                    @CMB Yes, WAN interface is set to use DHCP and is getting an address from Time Warner.

                    @johnpoz OK, my internal subnet is 172.16.24.0/24. pfSense firewall is .1. My PC is .55

                    If this is my cable modem I wonder why it is not consistent. I'm also not sure what I could do if it is the modem. Any thoughts on ways to troubleshoot this?

                    Again, thanks to you both for your help.

                    1 Reply Last reply Reply Quote 0
                    • johnpoz
                      johnpoz LAYER 8 Global Moderator last edited by

                      So when you ping something on your own segment

                      Pinging 172.16.x.251 with 32 bytes of data:
                      Reply from 192.168.1.250: bytes=32 time=4ms TTL=255
                      Reply from 172.16.x.251: bytes=32 time<1ms TTL=64
                      Reply from 172.16.x.251: bytes=32 time<1ms TTL=64

                      And you get a response from something else along with the response from the actual device..  Does this device have multiple IPs?  What is this device 172.16.24.251 your pinging for example??

                      And you say you have nothing on your network using 192.168.1.?

                      What happens when you try and ping that 192.168.1. address that you got a reply from?  These are wired and not wireless.. Do you have wireless how is it connected?

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                      1 Reply Last reply Reply Quote 0
                      • C
                        Coldaddy last edited by

                        The device I am pinging (.251) is the Wireless Access Point…it is a Wireless Router but is in WAP mode. It is on the same network but not in the connectivity path. It does not have multiple IPs...it gets one from the pfSense DHCP server and the .251 address is reserved for it.

                        Yes, there is no 192.168.1.0 network. There was in the past (a couple of months ago). That network was provided by the Wireless Router when it was in router mode.

                        Pinging the 192.168.1.250 address:
                        PS C:\Windows\system32> ping 192.168.1.250

                        Pinging 192.168.1.250 with 32 bytes of data:
                        Reply from 192.168.1.250: bytes=32 time=4ms TTL=255
                        Reply from 192.168.1.250: bytes=32 time=4ms TTL=255
                        Reply from 192.168.1.250: bytes=32 time=4ms TTL=255
                        Reply from 192.168.1.250: bytes=32 time=4ms TTL=255

                        Ping statistics for 192.168.1.250:
                            Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
                        Approximate round trip times in milli-seconds:
                            Minimum = 4ms, Maximum = 4ms, Average = 4ms

                        Everything I am working with right now is wired. I do have a wireless access point and it just participates in the internal subnet provided by the pfSense firewall. It is 172.16.24.251.

                        Pinging from the WAP:
                        PING www.yahoo.com (98.138.253.109): 56 data bytes
                        64 bytes from 98.138.253.109: seq=0 ttl=44 time=66.914 ms
                        64 bytes from 98.138.253.109: seq=1 ttl=44 time=51.565 ms
                        64 bytes from 98.138.253.109: seq=2 ttl=44 time=80.229 ms
                        64 bytes from 98.138.253.109: seq=3 ttl=44 time=57.837 ms

                        –- www.yahoo.com ping statistics ---
                        4 packets transmitted, 4 packets received, 0% packet loss
                        round-trip min/avg/max = 51.565/64.136/80.229 ms

                        1 Reply Last reply Reply Quote 0
                        • C
                          Coldaddy last edited by

                          Also, pinging 192.168.1.250 from the pfSense firewall fails:
                          PING 192.168.1.250 (192.168.1.250): 56 data bytes

                          –- 192.168.1.250 ping statistics ---
                          3 packets transmitted, 0 packets received, 100.0% packet loss

                          1 Reply Last reply Reply Quote 0
                          • johnpoz
                            johnpoz LAYER 8 Global Moderator last edited by

                            Well yeah pfsense would fail trying to ping that IP since it would send it out its default gateway interface..

                            So you can ping that from your box…  Look in your arp table what is the mac on that 192.168 AP..  What does that equal assuming its your AP..  Which is what exactly??

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                            1 Reply Last reply Reply Quote 0
                            • C
                              Coldaddy last edited by

                              It's not in the arp table:

                              PS C:\Windows\system32> ping 192.168.1.250

                              Pinging 192.168.1.250 with 32 bytes of data:
                              Reply from 192.168.1.250: bytes=32 time=4ms TTL=255
                              Reply from 192.168.1.250: bytes=32 time=4ms TTL=255
                              Reply from 192.168.1.250: bytes=32 time=4ms TTL=255
                              Reply from 192.168.1.250: bytes=32 time=4ms TTL=255

                              Ping statistics for 192.168.1.250:
                                  Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
                              Approximate round trip times in milli-seconds:
                                  Minimum = 4ms, Maximum = 4ms, Average = 4ms
                              PS C:\Windows\system32> arp -a

                              Interface: 172.16.24.55 –- 0x6
                                Internet Address      Physical Address      Type
                                172.16.24.1          00-08-a2-09-c6-69    dynamic
                                172.16.24.4          00-26-b9-88-ac-16    dynamic
                                172.16.24.19          00-11-32-02-e6-4e    dynamic
                                172.16.24.50          ac-3a-7a-a6-98-39    dynamic
                                172.16.24.51          50-1a-c5-ed-33-db    dynamic
                                172.16.24.53          a0-88-69-14-b1-62    dynamic
                                172.16.24.59          7c-1e-52-86-20-cc    dynamic
                                172.16.24.62          5c-ad-cf-8e-bb-9c    dynamic
                                172.16.24.251        1c-b7-2c-d9-95-d0    dynamic
                                172.16.24.255        ff-ff-ff-ff-ff-ff    static
                                224.0.0.2            01-00-5e-00-00-02    static
                                224.0.0.22            01-00-5e-00-00-16    static
                                224.0.0.251          01-00-5e-00-00-fb    static
                                224.0.0.252          01-00-5e-00-00-fc    static
                                224.0.0.253          01-00-5e-00-00-fd    static
                                239.255.255.250      01-00-5e-7f-ff-fa    static
                                255.255.255.255      ff-ff-ff-ff-ff-ff    static

                              This is such a weird issue.

                              1 Reply Last reply Reply Quote 0
                              • johnpoz
                                johnpoz LAYER 8 Global Moderator last edited by

                                do a traceroute to it..

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                                1 Reply Last reply Reply Quote 0
                                • C
                                  Coldaddy last edited by

                                  PS C:\Windows\system32> tracert 192.168.1.250

                                  Tracing route to 192.168.1.250 over a maximum of 30 hops

                                  1    <1 ms    <1 ms    <1 ms  172.16.24.1
                                    2    4 ms    5 ms    4 ms  192.168.1.250

                                  Trace complete.

                                  1 Reply Last reply Reply Quote 0
                                  • C
                                    cmb last edited by

                                    That's almost certainly your modem. 4 ms is too low for it to be traversing the coax and looks to be too consistently 4 ms for that as well.

                                    I haven't heard of anyone else seeing anything like that. Though there is some buggy firmware going around on TWC for SB6183 modems, I'd only heard of it breaking IPv6, not doing stupid things with IPv4. See this thread for instance, and the links to dslreports there.
                                    https://forum.pfsense.org/index.php?topic=108971.0

                                    1 Reply Last reply Reply Quote 0
                                    • First post
                                      Last post