4

I've got a PFSense firewall/gateway on our network. Everything works great except for the fact that I cannot access one specific website.

Pfsense is running the following packages

  • Country Block
  • LightSquid
  • nmap
  • notes
  • squid
  • squidGuard
  • Strikeback

I can access every single website I've ever tried aside from one that we need for business use (http://bridalnetwork.ca)

here's the traceroute

frodo:~ chase$ traceroute bridalnetwork.ca 
traceroute to  bridalnetwork.ca (192.197.103.73), 64 hops max, 52 byte packets  
 1  rohan (192.168.5.1)  6.618 ms  1.662 ms  9.207 ms  
 2  * * *  
 3  * * rohan (192.168.5.1)  7.225 ms !H  
 4  rohan (192.168.5.1)  5.314 ms !H 5.701 ms !H  7.573 ms !H  
frodo:~ chase$

How can I figure out what the reason behind the blockage is?

note: this has been tested on every computer on the network with the same results.
ps: the pfsense box is 'rohan' (192.168.5.1)

Here's what I get with Squid enabled
enter image description here

and here's what I get with Squid disabled
enter image description here

2
  • What do you see in a web browser when you try to visit that site? What do you see in your squid logs?
    – Zoredache
    Apr 7, 2012 at 21:32
  • I've updated the question with some browser info, but I can't find any info in squid that pertains to bridalnetwork.ca Apr 7, 2012 at 22:00

2 Answers 2

4

Your traceroute seems to indicate your routing is screwy. Should never see your default gateway as the hop multiple times. Maybe you have a subnet mask that's way out of whack or something similar. What does Diagnostics>Routes show? I doubt you're blocking it, seems more like a routing issue.

3
  • also the output of "route -n get 192.197.103.73" would be telling. If that shows anything other than your default gateway IP, you have a routing issue. If it doesn't show "gateway" in that output, then you have a subnet mask wrong. Apr 8, 2012 at 6:16
  • that was exactly it. I had 192.168.5.1/8 instead of 192.168.5.1/24 in my LAN config. Wonder why it was ONLY affecting that one website... Apr 10, 2012 at 1:57
  • 1
    @ChaseFlorell It was only blocking that website, because all other websites you tried didn't have an IP in the 192.168.5.1/8 range. Of course there were likely thousands of websites you accidentally blocked but never used and thus never noticed not to work. The full range you accidentally blocked was 192.0.0.1 to 192.255.255.254. So any website with an IP NOT starting with 192. was routed just fine. You can do the math yourself using: jodies.de/ipcalc?host=192.168.5.1&mask1=8&mask2=
    – noamik
    Mar 25, 2015 at 15:39
0

Quoth the manual:

The Firewall logs at Status > System Logs on the Firewall tab show all of the logged firewall events. By default, this includes connections blocked by the default deny rule.

Also, you can use pfctl -vvsr. That's -vv to be verbose, and include ruleset warnings. -s for filter paramters. -r to do a reverse DNS lookup on any IPs. pftctl has all sorts of cool options.

5
  • There is nothing in the firewall logs regarding that website, and I can't see anything in the pfctl command for that website either. Apr 7, 2012 at 22:24
  • @ChaseFlorell Can you use a DMZ port or separate external IP that doesn't pass through the pfsense gateway, but still goes through the same CPE / ISP gateway? Is the line DSL?
    – Wesley
    Apr 7, 2012 at 22:28
  • I'll try hooking a box directly into the cable modem as soon as I get a chance. Apr 7, 2012 at 22:30
  • @ChaseFlorell I've seen ISP CPE stuff do some weird stuff like intermittently blocking certain sites - usually as a result of strange MTU issues or PPPoA/PPPoE.
    – Wesley
    Apr 7, 2012 at 22:34
  • I'll have to check it out. I've been blaming this issue on my ISP for about 6 months. Now I'm thinking it's time I get to the bottom of the problem. Apr 7, 2012 at 22:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .