I have a pfSense virtual machine running on a CentOS 7 host. The host has 2 network adapters, enp1s0 and enp3s0. enp3s0 is connected to a bridge br1. My pfSense virtual machine is also connected to this bridge. This is the "WAN" side of our network, pfSense authenticates a PPPoE session with our ISP via an ADSL modem in RFC 1483 bridging mode. enp1s0 is connected to a bridge br0, and pfSense and other virtual machines are connected to that bridge. enp1s0 is physically connected to our network switch, allowing our LAN traffic to be routed through pfSense and access the internet.
This works fine for LAN clients, our workstations connected to the network switch can access the internet without problems. However, our virtual machines and the CentOS host are having issues.
VMs and the host can ping WAN servers without issue, but TCP traffic will not connect. (LAN traffic is fine, I can SSH into VMs from local machines without issue). Observe:
[user@host ~]$ ping google.com PING google.com (220.127.116.11) 56(84) bytes of data. 64 bytes from syd09s12-in-f14.1e100.net (18.104.22.168): icmp_seq=1 ttl=56 time=20.0 ms 64 bytes from syd09s12-in-f14.1e100.net (22.214.171.124): icmp_seq=2 ttl=56 time=19.9 ms 64 bytes from syd09s12-in-f14.1e100.net (126.96.36.199): icmp_seq=3 ttl=56 time=55.5 ms 64 bytes from syd09s12-in-f14.1e100.net (188.8.131.52): icmp_seq=4 ttl=56 time=186 ms 64 bytes from syd09s12-in-f14.1e100.net (184.108.40.206): icmp_seq=5 ttl=56 time=79.2 ms ^C --- google.com ping statistics --- 5 packets transmitted, 5 received, 0% packet loss, time 4003ms rtt min/avg/max/mdev = 19.911/72.319/186.857/61.526 ms [user@host ~]$ wget google.com --2016-01-15 10:33:16-- http://google.com/ Resolving google.com (google.com)... 220.127.116.11, 2404:6800:4006:803::200e Connecting to google.com (google.com)|18.104.22.168|:80... failed: Connection timed out. Connecting to google.com (google.com)|2404:6800:4006:803::200e|:80... failed: Network is unreachable.
I have double checked the firewall in both pfSense and iptables on the host, there are no rules to prevent this traffic. The host routing table appears to be fine:
[user@host ~]$ route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 192.168.1.1 0.0.0.0 UG 1024 0 0 br0 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 br0
I have no idea where the issue could be here, I would highly appreciate any suggestions on what path look down.