0

I was accessing a site daily until this morning. Now I cannot ping the site through ping on my pfsense firewall or on a client behind the firewall. I have made no changes to the firewall.

If I bypass the firewall I can access the site OK https://www.ncbi.nlm.nih.gov.

Running wireshark from a client I can see the DNS request:

Info: Standard query 0x0cf2 Server failure A https://www.ncbi.nlm.nih.gov

I tried changing the default (empty) nameservers in pfsense to 1.1.1.1, 1.0.0.1 and 8.8.8.8 (all 3, in that order), but this made no difference.

I cleared the arp table, rebooted pfsense.

I cant see any blocks in the firewall on the website i am accessing.

If I filter the firewall logs on the destination IP address 130.14.29.110 I can see WAN rule 'let out anything from firewall host itself - ICMP and UDP' and I can resolve the URL in the table.

Here is ping result from Diagnostics/Ping in pfsense:

PING 130.14.29.110 (130.14.29.110) from my_internal_LAN_IP: 56 data bytes

--- 130.14.29.110 ping statistics --- 5 packets transmitted, 0 packets received, 100.0% packet loss

If I do DNS Lookup from pfsense using the IP as hostname O get the website URL - so that works OK

Result Record type www.ncbi.nlm.nih.gov PTR Timings Name server Query time 127.0.0.1 194 msec

If I do traceroute to hostname 130.14.29.110 in pfsense, I can see hop out to my ISP then 14 more hops around the ISP then it stops. But when I connect without going through pfsense I can connect fine.

Any ideas?

3
  • What makes you think it's the firewall or its DNS configuration? Could it be a problem with the site? It's hard to tell when you don't disclose the site. Also, the amount of details in the question aren't sufficient to reproduce nor debug the problem. Jul 10 at 9:10
  • I added the website, i can access it fine when i bypass the firewall Jul 10 at 9:26
  • 1
    DNS and HTTP work for that site, but not ping/traceroute. I think they are likely dropping ICMP. pfsense may not like misconfigured sites.
    – stark
    Jul 10 at 12:09
0

Site is working now though pfsense, difficult to work out what issue was.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.