Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a PFSense firewall/gateway on our network. Everything works great except for the fact that I cannot access one specific website.

Pfsense is running the following packages

  • Country Block
  • LightSquid
  • nmap
  • notes
  • squid
  • squidGuard
  • Strikeback

I can access every single website I've ever tried aside from one that we need for business use (

here's the traceroute

frodo:~ chase$ traceroute 
traceroute to (, 64 hops max, 52 byte packets  
 1  rohan (  6.618 ms  1.662 ms  9.207 ms  
 2  * * *  
 3  * * rohan (  7.225 ms !H  
 4  rohan (  5.314 ms !H 5.701 ms !H  7.573 ms !H  
frodo:~ chase$

How can I figure out what the reason behind the blockage is?

note: this has been tested on every computer on the network with the same results.
ps: the pfsense box is 'rohan' (

Here's what I get with Squid enabled
enter image description here

and here's what I get with Squid disabled
enter image description here

share|improve this question
What do you see in a web browser when you try to visit that site? What do you see in your squid logs? – Zoredache Apr 7 '12 at 21:32
I've updated the question with some browser info, but I can't find any info in squid that pertains to – Chase Florell Apr 7 '12 at 22:00
up vote 4 down vote accepted

Your traceroute seems to indicate your routing is screwy. Should never see your default gateway as the hop multiple times. Maybe you have a subnet mask that's way out of whack or something similar. What does Diagnostics>Routes show? I doubt you're blocking it, seems more like a routing issue.

share|improve this answer
also the output of "route -n get" would be telling. If that shows anything other than your default gateway IP, you have a routing issue. If it doesn't show "gateway" in that output, then you have a subnet mask wrong. – Chris Buechler Apr 8 '12 at 6:16
that was exactly it. I had instead of in my LAN config. Wonder why it was ONLY affecting that one website... – Chase Florell Apr 10 '12 at 1:57
@ChaseFlorell It was only blocking that website, because all other websites you tried didn't have an IP in the range. Of course there were likely thousands of websites you accidentally blocked but never used and thus never noticed not to work. The full range you accidentally blocked was to So any website with an IP NOT starting with 192. was routed just fine. You can do the math yourself using: – noamik Mar 25 '15 at 15:39

Quoth the manual:

The Firewall logs at Status > System Logs on the Firewall tab show all of the logged firewall events. By default, this includes connections blocked by the default deny rule.

Also, you can use pfctl -vvsr. That's -vv to be verbose, and include ruleset warnings. -s for filter paramters. -r to do a reverse DNS lookup on any IPs. pftctl has all sorts of cool options.

share|improve this answer
There is nothing in the firewall logs regarding that website, and I can't see anything in the pfctl command for that website either. – Chase Florell Apr 7 '12 at 22:24
@ChaseFlorell Can you use a DMZ port or separate external IP that doesn't pass through the pfsense gateway, but still goes through the same CPE / ISP gateway? Is the line DSL? – Wesley Apr 7 '12 at 22:28
I'll try hooking a box directly into the cable modem as soon as I get a chance. – Chase Florell Apr 7 '12 at 22:30
@ChaseFlorell I've seen ISP CPE stuff do some weird stuff like intermittently blocking certain sites - usually as a result of strange MTU issues or PPPoA/PPPoE. – Wesley Apr 7 '12 at 22:34
I'll have to check it out. I've been blaming this issue on my ISP for about 6 months. Now I'm thinking it's time I get to the bottom of the problem. – Chase Florell Apr 7 '12 at 22:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.