3

I am seeing some strange behavior in pfSense 2.0.3 in which all of my WAN interfaces are up according to the Interfaces screen, yet all but the default gateway are shown as "Offline" in gateway groups.

My default gateway works just fine.

My first thought was that the gateways do not respond to ICMP, but I am able to ping them from an unrelated connection (ie from outside) just fine.

Even stranger, using the "Ping" tool in WebConfigurator I can ping 8.8.8.8 from all of the WAN interfaces, yet they cannot ping their own next hop.

Strangest of all, when I use an alternative monitor IP of 8.8.8.8 for any of the interfaces, it stops being pingable!

I am wondering the following:

  • Does the Ping tool in WebConfigurator still have the firewall and outbound NAT rules for localhost applied to it?
  • Has anybody seen anything like this before?
tacos_tacos_tacos
  • 3,250
  • 18
  • 63
  • 100
  • I kind of hate pfSense for hiding that you can't have multiple gateways as you think you've configured. It takes your configuration and translates it to firewall rules (I understand how that sounds like the same thing, but firewall filtering and routing are completely separate subsystems). Regardless, I'm glad it's working. – Chris S Mar 20 '13 at 04:13
  • @ChrisS, meaning is all traffic still just going to the default gateway, and then the floating firewall rule is applied there to forward along to another interface? ... and can you think of any reason why I was able to ping 8.8.8.8 despite the fact that the rule was being applied? – tacos_tacos_tacos Mar 20 '13 at 04:26
  • The firewall "messes" with packets as they flow through. If something is scheduled to go out on WAN2, the firewall writes in the appropriate source address and switches the "network view" (the new view has a different default gateway, even though the base system still has the original gateway). The routing subsystem obeys this alternate network view and things proceed as you might expect. – Chris S Mar 20 '13 at 05:20
  • As for 8.8.8.8 working, I'm pretty sure whatever utility was being called bound to the IP of the WAN interface, but did not open a raw socket on that interface. The OS would automatically use the wan IP of the interface with the default gateway when sending traffic externally. Which would make it look like 8.8.8.8 is working. – Chris S Mar 20 '13 at 05:21
  • The "network view" thing makes a lot more sense to me heuristically - thanks for the info. – tacos_tacos_tacos Mar 20 '13 at 05:49

2 Answers2

2

I have almost the same issue on pfsense ver 2.3.2-RELEASE-p1 After hours of googling I found this. https://forum.pfsense.org/index.php?topic=105644.0

Sometime gateways do not want to response to ping. If your gateway's working but dashboard still shows that it's offline you can try changing the advanced settings on the gateway for Data Payload. (Define data payload to send on ICMP packets to gateway monitor IP.) settings

slm
  • 7,615
  • 16
  • 56
  • 76
adopilot
  • 1,521
  • 6
  • 25
  • 41
0

So, I've learned something new: when you Ping from WebConfigurator, firewall rules are still applied.

In my case, I had a stupid floating rule that was assigning a gateway group of WANS A,B,C,D to ANY protocol, ANY source, ANY destination, OUT.

As a result, pings on gateways B, C, D were obviously going to time out, since ICMP traffic was being always routed through A.

After fixing the rule to only apply to TCP/UDP traffic, the problem was completely resolved.

tacos_tacos_tacos
  • 3,250
  • 18
  • 63
  • 100