I have a pfSense virtual machine running on a CentOS 7 host. The host has 2 network adapters, enp1s0 and enp3s0. enp3s0 is connected to a bridge br1. My pfSense virtual machine is also connected to this bridge. This is the "WAN" side of our network, pfSense authenticates a PPPoE session with our ISP via an ADSL modem in RFC 1483 bridging mode. enp1s0 is connected to a bridge br0, and pfSense and other virtual machines are connected to that bridge. enp1s0 is physically connected to our network switch, allowing our LAN traffic to be routed through pfSense and access the internet.

This works fine for LAN clients, our workstations connected to the network switch can access the internet without problems. However, our virtual machines and the CentOS host are having issues.

VMs and the host can ping WAN servers without issue, but TCP traffic will not connect. (LAN traffic is fine, I can SSH into VMs from local machines without issue). Observe:

[user@host ~]$ ping google.com
PING google.com ( 56(84) bytes of data.
64 bytes from syd09s12-in-f14.1e100.net ( icmp_seq=1 ttl=56 time=20.0 ms
64 bytes from syd09s12-in-f14.1e100.net ( icmp_seq=2 ttl=56 time=19.9 ms
64 bytes from syd09s12-in-f14.1e100.net ( icmp_seq=3 ttl=56 time=55.5 ms
64 bytes from syd09s12-in-f14.1e100.net ( icmp_seq=4 ttl=56 time=186 ms
64 bytes from syd09s12-in-f14.1e100.net ( icmp_seq=5 ttl=56 time=79.2 ms
--- google.com ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4003ms
rtt min/avg/max/mdev = 19.911/72.319/186.857/61.526 ms
[user@host ~]$ wget google.com
--2016-01-15 10:33:16--  http://google.com/
Resolving google.com (google.com)..., 2404:6800:4006:803::200e
Connecting to google.com (google.com)||:80... failed: Connection timed out.
Connecting to google.com (google.com)|2404:6800:4006:803::200e|:80... failed: Network is unreachable.

I have double checked the firewall in both pfSense and iptables on the host, there are no rules to prevent this traffic. The host routing table appears to be fine:

[user@host ~]$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface         UG    1024   0        0 br0   U     0      0        0 br0

I have no idea where the issue could be here, I would highly appreciate any suggestions on what path look down.

Thanks :)

  • Looks like the issue is in pfSense? It's impossible to say, since you haven't provided very much information. – Michael Hampton Jan 15 '16 at 0:12
  • First thing that has be done, is to ensure that the transit traffic goes in and comes out of the pfSense. But I just don't understand your scheme, it's too complicated for text. Two bridges... two interfaces... A good picture would be handy. – drookie Jan 15 '16 at 8:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.