Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got a PFSense firewall/gateway on our network. Everything works great except for the fact that I cannot access one specific website.

Pfsense is running the following packages

  • Country Block
  • LightSquid
  • nmap
  • notes
  • squid
  • squidGuard
  • Strikeback

I can access every single website I've ever tried aside from one that we need for business use (http://bridalnetwork.ca)

here's the traceroute

frodo:~ chase$ traceroute bridalnetwork.ca 
traceroute to  bridalnetwork.ca (192.197.103.73), 64 hops max, 52 byte packets  
 1  rohan (192.168.5.1)  6.618 ms  1.662 ms  9.207 ms  
 2  * * *  
 3  * * rohan (192.168.5.1)  7.225 ms !H  
 4  rohan (192.168.5.1)  5.314 ms !H 5.701 ms !H  7.573 ms !H  
frodo:~ chase$

How can I figure out what the reason behind the blockage is?

note: this has been tested on every computer on the network with the same results.
ps: the pfsense box is 'rohan' (192.168.5.1)

Here's what I get with Squid enabled
enter image description here

and here's what I get with Squid disabled
enter image description here

share|improve this question
    
What do you see in a web browser when you try to visit that site? What do you see in your squid logs? –  Zoredache Apr 7 '12 at 21:32
    
I've updated the question with some browser info, but I can't find any info in squid that pertains to bridalnetwork.ca –  Chase Florell Apr 7 '12 at 22:00

2 Answers 2

up vote 3 down vote accepted

Your traceroute seems to indicate your routing is screwy. Should never see your default gateway as the hop multiple times. Maybe you have a subnet mask that's way out of whack or something similar. What does Diagnostics>Routes show? I doubt you're blocking it, seems more like a routing issue.

share|improve this answer
    
also the output of "route -n get 192.197.103.73" would be telling. If that shows anything other than your default gateway IP, you have a routing issue. If it doesn't show "gateway" in that output, then you have a subnet mask wrong. –  Chris Buechler Apr 8 '12 at 6:16
    
that was exactly it. I had 192.168.5.1/8 instead of 192.168.5.1/24 in my LAN config. Wonder why it was ONLY affecting that one website... –  Chase Florell Apr 10 '12 at 1:57

Quoth the manual:

The Firewall logs at Status > System Logs on the Firewall tab show all of the logged firewall events. By default, this includes connections blocked by the default deny rule.

Also, you can use pfctl -vvsr. That's -vv to be verbose, and include ruleset warnings. -s for filter paramters. -r to do a reverse DNS lookup on any IPs. pftctl has all sorts of cool options.

share|improve this answer
    
There is nothing in the firewall logs regarding that website, and I can't see anything in the pfctl command for that website either. –  Chase Florell Apr 7 '12 at 22:24
    
@ChaseFlorell Can you use a DMZ port or separate external IP that doesn't pass through the pfsense gateway, but still goes through the same CPE / ISP gateway? Is the line DSL? –  Wesley Apr 7 '12 at 22:28
    
I'll try hooking a box directly into the cable modem as soon as I get a chance. –  Chase Florell Apr 7 '12 at 22:30
    
@ChaseFlorell I've seen ISP CPE stuff do some weird stuff like intermittently blocking certain sites - usually as a result of strange MTU issues or PPPoA/PPPoE. –  Wesley Apr 7 '12 at 22:34
    
I'll have to check it out. I've been blaming this issue on my ISP for about 6 months. Now I'm thinking it's time I get to the bottom of the problem. –  Chase Florell Apr 7 '12 at 22:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.