I am using VMware ESXi and have configured a pfSense router in a VM.. Other VMs are getting IPs from this router VM. Now on any VM (e.g. Windows 10) If I try to open http://google.com it returns nothing, but if I add an 'S' and browse: https://google.com it works fine.. Or on Linux, if I wget -O - http://google.com it returns following response:

Screenshot of the console

but wget-O - https://google.com returns the correct response.

Any hint that could help?

Edit 1: Shell output of pfctl -sa TRANSLATION RULES:

no nat proto carp all
nat-anchor "natearly/*" all
nat-anchor "natrules/*" all
nat on vmx0 inet from 127.0.0.0/8 to any port = isakmp -> 150.20.21.22 static-port
nat on vmx0 inet from 192.168.1.0/24 to any port = isakmp -> 150.20.21.22 static-port
nat on vmx0 inet6 from ::1 to any port = isakmp -> (vmx0) round-robin static-port
nat on vmx0 inet from 127.0.0.0/8 to any -> 150.20.21.22 port 1024:65535
nat on vmx0 inet from 192.168.1.0/24 to any -> 150.20.21.22 port 1024:65535
nat on vmx0 inet6 from ::1 to any -> (vmx0) port 1024:65535 round-robin
no rdr proto carp all
rdr-anchor "relayd/*" all
rdr-anchor "tftp-proxy/*" all
rdr-anchor "miniupnpd" all
binat on vmx0 inet from 192.168.1.1 to any -> 150.20.21.25

FILTER RULES:
scrub on vmx0 all fragment reassemble
scrub on vmx1 all fragment reassemble
anchor "relayd/*" all
anchor "openvpn/*" all
anchor "ipsec/*" all
block drop in log quick inet from 169.254.0.0/16 to any label "Block IPv4 link-local"
block drop in log quick inet from any to 169.254.0.0/16 label "Block IPv4 link-local"
block drop in log inet all label "Default deny rule IPv4"
block drop out log inet all label "Default deny rule IPv4"
block drop in log inet6 all label "Default deny rule IPv6"
block drop out log inet6 all label "Default deny rule IPv6"
pass quick inet6 proto ipv6-icmp all icmp6-type unreach keep state
pass quick inet6 proto ipv6-icmp all icmp6-type toobig keep state
pass quick inet6 proto ipv6-icmp all icmp6-type neighbrsol keep state
pass quick inet6 proto ipv6-icmp all icmp6-type neighbradv keep state
pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type echorep keep state
pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type routersol keep state
pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type routeradv keep state
pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type neighbrsol keep state
pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type neighbradv keep state
pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type echorep keep state
pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type routersol keep state
pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type routeradv keep state
pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type neighbrsol keep state
pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type neighbradv keep state
pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type echoreq keep state
pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type routersol keep state
pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type routeradv keep state
pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type neighbrsol keep state
pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type neighbradv keep state
pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type echoreq keep state
pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type routersol keep state
pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type routeradv keep state
pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type neighbrsol keep state
pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type neighbradv keep state
pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type echoreq keep state
pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type routersol keep state
pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type routeradv keep state
pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type neighbrsol keep state
pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type neighbradv keep state
pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type echoreq keep state
pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type routersol keep state
pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type routeradv keep state
pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type neighbrsol keep state
pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type neighbradv keep state
block drop log quick inet proto tcp from any port = 0 to any label "Block traffic from port 0"
block drop log quick inet proto udp from any port = 0 to any label "Block traffic from port 0"
block drop log quick inet proto tcp from any to any port = 0 label "Block traffic to port 0"
block drop log quick inet proto udp from any to any port = 0 label "Block traffic to port 0"
block drop log quick inet6 proto tcp from any port = 0 to any label "Block traffic from port 0"
block drop log quick inet6 proto udp from any port = 0 to any label "Block traffic from port 0"
block drop log quick inet6 proto tcp from any to any port = 0 label "Block traffic to port 0"
block drop log quick inet6 proto udp from any to any port = 0 label "Block traffic to port 0"
block drop log quick from <snort2c> to any label "Block snort2c hosts"
block drop log quick from any to <snort2c> label "Block snort2c hosts"
block drop in log quick proto tcp from <sshguard> to (self) port = ssh label "sshguard"
block drop in log quick proto tcp from <webConfiguratorlockout> to (self) port = http label "webConfiguratorlockout"
block drop in log quick from <virusprot> to any label "virusprot overload table"
pass in quick on vmx0 proto udp from any port = bootps to any port = bootpc keep state label "allow dhcp client out WAN"
pass out quick on vmx0 proto udp from any port = bootpc to any port = bootps keep state label "allow dhcp client out WAN"
block drop in log quick on vmx0 from <bogons> to any label "block bogon IPv4 networks from WAN"
block drop in log quick on vmx0 from <bogonsv6> to any label "block bogon IPv6 networks from WAN"
block drop in log on ! vmx0 inet from 150.20.21.14/26 to any
block drop in log inet from 150.20.21.22 to any
block drop in log on vmx0 inet6 from fe80::4e52:62ff:fe0e:6e1 to any
block drop in log quick on vmx0 inet from 10.0.0.0/8 to any label "Block private networks from WAN block 10/8"
block drop in log quick on vmx0 inet from 127.0.0.0/8 to any label "Block private networks from WAN block 127/8"
block drop in log quick on vmx0 inet from 172.16.0.0/12 to any label "Block private networks from WAN block 172.16/12"
block drop in log quick on vmx0 inet from 192.168.0.0/16 to any label "Block private networks from WAN block 192.168/16"
block drop in log quick on vmx0 inet6 from fc00::/7 to any label "Block ULA networks from WAN block fc00::/7"
block drop in log on ! vmx1 inet from 192.168.1.0/24 to any
block drop in log inet from 192.168.1.1 to any
block drop in log on vmx1 inet6 from fe80::20c:29ff:fef3:3802 to any
pass in quick on vmx1 inet proto udp from any port = bootpc to 255.255.255.255 port = bootps keep state label "allow access to DHCP server"
pass in quick on vmx1 inet proto udp from any port = bootpc to 192.168.1.1 port = bootps keep state label "allow access to DHCP server"
pass out quick on vmx1 inet proto udp from 192.168.1.1 port = bootps to any port = bootpc keep state label "allow access to DHCP server"
pass quick on vmx1 inet6 proto udp from fe80::/10 to fe80::/10 port = dhcpv6-client keep state label "allow access to DHCPv6 server"
pass quick on vmx1 inet6 proto udp from fe80::/10 to ff02::/16 port = dhcpv6-client keep state label "allow access to DHCPv6 server"
pass quick on vmx1 inet6 proto udp from fe80::/10 to ff02::/16 port = dhcpv6-server keep state label "allow access to DHCPv6 server"
pass quick on vmx1 inet6 proto udp from ff02::/16 to fe80::/10 port = dhcpv6-server keep state label "allow access to DHCPv6 server"
pass in on lo0 inet all flags S/SA keep state label "pass IPv4 loopback"
pass out on lo0 inet all flags S/SA keep state label "pass IPv4 loopback"
pass in on lo0 inet6 all flags S/SA keep state label "pass IPv6 loopback"
pass out on lo0 inet6 all flags S/SA keep state label "pass IPv6 loopback"
pass out inet all flags S/SA keep state allow-opts label "let out anything IPv4 from firewall host itself"
pass out inet6 all flags S/SA keep state allow-opts label "let out anything IPv6 from firewall host itself"
pass out route-to (vmx0 150.20.21.15) inet from 150.20.21.22 to ! 150.20.21.14/26 flags S/SA keep state allow-opts label "let out anything from firewall host itself"
pass in quick on vmx1 proto tcp from any to (vmx1) port = http flags S/SA keep state label "anti-lockout rule"
anchor "userrules/*" all
pass in quick on vmx1 inet from 192.168.1.0/24 to any flags S/SA keep state label "USER_RULE: Default allow LAN to any rule"
anchor "tftp-proxy/*" all
No queue in use

STATES:
vmx0 icmp 150.20.21.22:32034 -> 150.20.21.15:32034       0:0
lo0 icmp 150.20.21.22:32592 -> 10.0.0.0:32592       0:0
vmx1 tcp 40.67.253.249:443 <- 192.168.1.50:51511       ESTABLISHED:ESTABLISHED
vmx0 tcp 150.20.21.22:26099 (192.168.1.50:51511) -> 40.67.253.249:443       ESTABLISHED:ESTABLISHED
vmx1 tcp 93.184.221.240:80 <- 192.168.1.50:51754       TIME_WAIT:TIME_WAIT
vmx0 tcp 150.20.21.22:11870 (192.168.1.50:51754) -> 93.184.221.240:80       TIME_WAIT:TIME_WAIT
vmx1 tcp 93.184.221.240:80 <- 192.168.1.50:51755       TIME_WAIT:TIME_WAIT
vmx0 tcp 150.20.21.22:22883 (192.168.1.50:51755) -> 93.184.221.240:80       TIME_WAIT:TIME_WAIT
vmx1 udp 216.58.205.227:443 <- 192.168.1.50:57719       MULTIPLE:MULTIPLE
vmx0 udp 150.20.21.22:48762 (192.168.1.50:57719) -> 216.58.205.227:443       MULTIPLE:MULTIPLE
vmx1 tcp 192.168.1.1:80 <- 192.168.1.50:51756       ESTABLISHED:ESTABLISHED
vmx1 tcp 192.168.1.1:80 <- 192.168.1.50:51757       ESTABLISHED:ESTABLISHED
vmx1 udp 216.58.205.227:443 <- 192.168.1.50:49517       MULTIPLE:MULTIPLE
vmx0 udp 150.20.21.22:64087 (192.168.1.50:49517) -> 216.58.205.227:443       MULTIPLE:MULTIPLE
vmx0 tcp 150.20.21.22:24559 -> 208.123.73.93:443       FIN_WAIT_2:FIN_WAIT_2
vmx0 tcp 150.20.21.22:37189 -> 208.123.73.93:443       FIN_WAIT_2:FIN_WAIT_2
vmx1 tcp 216.58.205.240:80 <- 192.168.1.50:51760       TIME_WAIT:TIME_WAIT
vmx0 tcp 150.20.21.22:30557 (192.168.1.50:51760) -> 216.58.205.240:80       TIME_WAIT:TIME_WAIT
vmx1 tcp 172.227.102.35:80 <- 192.168.1.50:51761       TIME_WAIT:TIME_WAIT
vmx0 tcp 150.20.21.22:15607 (192.168.1.50:51761) -> 172.227.102.35:80       TIME_WAIT:TIME_WAIT
vmx1 tcp 172.227.102.35:80 <- 192.168.1.50:51762       TIME_WAIT:TIME_WAIT
vmx0 tcp 150.20.21.22:29455 (192.168.1.50:51762) -> 172.227.102.35:80       TIME_WAIT:TIME_WAIT
vmx1 tcp 172.227.102.35:80 <- 192.168.1.50:51763       TIME_WAIT:TIME_WAIT
vmx0 tcp 150.20.21.22:53681 (192.168.1.50:51763) -> 172.227.102.35:80       TIME_WAIT:TIME_WAIT
vmx1 tcp 172.227.102.35:80 <- 192.168.1.50:51764       TIME_WAIT:TIME_WAIT
vmx0 tcp 150.20.21.22:58735 (192.168.1.50:51764) -> 172.227.102.35:80       TIME_WAIT:TIME_WAIT
vmx1 tcp 172.227.102.35:80 <- 192.168.1.50:51765       TIME_WAIT:TIME_WAIT
vmx0 tcp 150.20.21.22:14153 (192.168.1.50:51765) -> 172.227.102.35:80       TIME_WAIT:TIME_WAIT
vmx1 tcp 172.227.102.35:80 <- 192.168.1.50:51766       TIME_WAIT:TIME_WAIT
vmx0 tcp 150.20.21.22:19640 (192.168.1.50:51766) -> 172.227.102.35:80       TIME_WAIT:TIME_WAIT
vmx1 tcp 172.227.102.35:80 <- 192.168.1.50:51767       TIME_WAIT:TIME_WAIT
vmx0 tcp 150.20.21.22:59405 (192.168.1.50:51767) -> 172.227.102.35:80       TIME_WAIT:TIME_WAIT
vmx1 tcp 172.227.102.35:80 <- 192.168.1.50:51768       TIME_WAIT:TIME_WAIT
vmx0 tcp 150.20.21.22:16060 (192.168.1.50:51768) -> 172.227.102.35:80       TIME_WAIT:TIME_WAIT
vmx1 tcp 172.227.102.35:80 <- 192.168.1.50:51769       TIME_WAIT:TIME_WAIT
vmx0 tcp 150.20.21.22:17183 (192.168.1.50:51769) -> 172.227.102.35:80       TIME_WAIT:TIME_WAIT
vmx1 tcp 172.227.102.35:80 <- 192.168.1.50:51770       TIME_WAIT:TIME_WAIT
vmx0 tcp 150.20.21.22:9071 (192.168.1.50:51770) -> 172.227.102.35:80       TIME_WAIT:TIME_WAIT
vmx1 tcp 172.227.102.35:80 <- 192.168.1.50:51771       TIME_WAIT:TIME_WAIT
vmx0 tcp 150.20.21.22:61128 (192.168.1.50:51771) -> 172.227.102.35:80       TIME_WAIT:TIME_WAIT
vmx1 tcp 172.227.102.35:80 <- 192.168.1.50:51772       TIME_WAIT:TIME_WAIT
vmx0 tcp 150.20.21.22:61995 (192.168.1.50:51772) -> 172.227.102.35:80       TIME_WAIT:TIME_WAIT
vmx1 tcp 172.227.102.35:80 <- 192.168.1.50:51773       TIME_WAIT:TIME_WAIT
vmx0 tcp 150.20.21.22:35555 (192.168.1.50:51773) -> 172.227.102.35:80       TIME_WAIT:TIME_WAIT
vmx0 tcp 150.20.21.22:30590 -> 208.123.73.93:443       FIN_WAIT_2:FIN_WAIT_2
vmx1 udp 192.168.1.1:53 <- 192.168.1.50:59522       SINGLE:MULTIPLE
vmx0 udp 150.20.21.22:45078 -> 216.239.32.10:53       MULTIPLE:SINGLE
vmx0 udp 150.20.21.22:32303 -> 216.239.32.10:53       MULTIPLE:SINGLE
vmx0 udp 150.20.21.22:19668 -> 216.239.36.10:53       MULTIPLE:SINGLE
vmx0 udp 150.20.21.22:29710 -> 216.239.32.10:53       MULTIPLE:SINGLE
vmx1 udp 216.58.205.238:443 <- 192.168.1.50:59523       MULTIPLE:MULTIPLE
vmx0 udp 150.20.21.22:56690 (192.168.1.50:59523) -> 216.58.205.238:443       MULTIPLE:MULTIPLE
vmx0 udp 150.20.21.22:123 -> 131.234.137.63:123       MULTIPLE:SINGLE
vmx0 udp 150.20.21.22:123 -> 104.207.131.54:123       MULTIPLE:SINGLE

INFO:
Status: Enabled for 0 days 00:33:21           Debug: Urgent

Interface Stats for vmx1              IPv4             IPv6
  Bytes In                          305055                0
  Bytes Out                        1632623                0
  Packets In
    Passed                            2200                0
    Blocked                              1                0
  Packets Out
    Passed                            2342                0
    Blocked                              0                0

State Table                          Total             Rate
  current entries                       54
  searches                           59804           29.9/s
  inserts                             2102            1.1/s
  removals                            2048            1.0/s
Counters
  match                              38232           19.1/s
  bad-offset                             0            0.0/s
  fragment                               0            0.0/s
  short                                  0            0.0/s
  normalize                              0            0.0/s
  memory                                 0            0.0/s
  bad-timestamp                          0            0.0/s
  congestion                             0            0.0/s
  ip-option                              0            0.0/s
  proto-cksum                            0            0.0/s
  state-mismatch                         0            0.0/s
  state-insert                           0            0.0/s
  state-limit                            0            0.0/s
  src-limit                              0            0.0/s
  synproxy                               0            0.0/s
  map-failed                             0            0.0/s

LABEL COUNTERS:
Block IPv4 link-local 38093 0 0 0 0 0 0 0
Block IPv4 link-local 36387 0 0 0 0 0 0 0
Default deny rule IPv4 36387 36004 3463613 36004 3463613 0 0 0
Default deny rule IPv4 38093 0 0 0 0 0 0 0
Default deny rule IPv6 38093 0 0 0 0 0 0 0
Default deny rule IPv6 1706 0 0 0 0 0 0 0
Block traffic from port 0 38093 0 0 0 0 0 0 0
Block traffic from port 0 1547 0 0 0 0 0 0 0
Block traffic to port 0 38093 0 0 0 0 0 0 0
Block traffic to port 0 1547 0 0 0 0 0 0 0
Block traffic from port 0 38093 0 0 0 0 0 0 0
Block traffic from port 0 0 0 0 0 0 0 0 0
Block traffic to port 0 0 0 0 0 0 0 0 0
Block traffic to port 0 0 0 0 0 0 0 0 0
Block snort2c hosts 38093 0 0 0 0 0 0 0
Block snort2c hosts 38093 0 0 0 0 0 0 0
sshguard 38093 0 0 0 0 0 0 0
webConfiguratorlockout 36271 0 0 0 0 0 0 0
virusprot overload table 36509 0 0 0 0 0 0 0
allow dhcp client out WAN 36387 1 328 1 328 0 0 1
allow dhcp client out WAN 1709 0 0 0 0 0 0 0
block bogon IPv4 networks from WAN 37807 1 36 1 36 0 0 0
block bogon IPv6 networks from WAN 36127 1 36 1 36 0 0 0
Block private networks from WAN block 10/8 36119 0 0 0 0 0 0 0
Block private networks from WAN block 127/8 36119 0 0 0 0 0 0 0
Block private networks from WAN block 172.16/12 36119 0 0 0 0 0 0 0
Block private networks from WAN block 192.168/16 36119 0 0 0 0 0 0 0
Block ULA networks from WAN block fc00::/7 36119 0 0 0 0 0 0 0
allow access to DHCP server 356 0 0 0 0 0 0 0
allow access to DHCP server 2 4 1328 2 672 2 656 2
allow access to DHCP server 1790 0 0 0 0 0 0 0
allow access to DHCPv6 server 84 0 0 0 0 0 0 0
allow access to DHCPv6 server 0 0 0 0 0 0 0 0
allow access to DHCPv6 server 0 0 0 0 0 0 0 0
allow access to DHCPv6 server 0 0 0 0 0 0 0 0
pass IPv4 loopback 38090 52 5956 26 1726 26 4230 26
pass IPv4 loopback 52 0 0 0 0 0 0 0
pass IPv6 loopback 52 0 0 0 0 0 0 0
pass IPv6 loopback 26 0 0 0 0 0 0 0
let out anything IPv4 from firewall host itself 38090 52 5956 26 4230 26 1726 26
let out anything IPv6 from firewall host itself 1706 0 0 0 0 0 0 0
let out anything from firewall host itself 1706 7444 2428778 3764 2029866 3680 398912 1680
anti-lockout rule 38218 182 99797 81 26285 101 73512 2
USER_RULE: Default allow LAN to any rule 38216 4347 1835084 2112 277220 2235 1557864 352

TIMEOUTS:
tcp.first                   120s
tcp.opening                  30s
tcp.established           86400s
tcp.closing                 900s
tcp.finwait                  45s
tcp.closed                   90s
tcp.tsdiff                   30s
udp.first                    60s
udp.single                   30s
udp.multiple                 60s
icmp.first                   20s
icmp.error                   10s
other.first                  60s
other.single                 30s
other.multiple               60s
frag                         30s
interval                     10s
adaptive.start            58200 states
adaptive.end             116400 states
src.track                     0s

LIMITS:
states        hard limit    97000
src-nodes     hard limit    97000
frags         hard limit     5000
table-entries hard limit   400000

TABLES:
bogons
bogonsv6
snort2c
sshguard
virusprot
webConfiguratorlockout

OS FINGERPRINTS:
762 fingerprints loaded

Note (Original IPs are different obviously):
150.20.21.22 -> Main IP (also the host of the VMware ESXi)
150.20.21.25 -> Extra purchased IP on the same server (Currently unused, don't know why its still in records)
150.20.21.15 -> Gateway
150.20.21.14 -> Not sure of this, it just one less than the gateway IP.

  • Be brave enough to at least add a reason/comment, why are you down-voting? – Tester Oct 12 at 7:53
  • You're saying that HTTP access is blocked (i.e. port 80). Is port 443 (httpS) blocked, too? – Mr Shunz Oct 12 at 12:46
  • yes, http is not responding or if I should say redirecting to https.. But if I write https, it replies fine as it should. – Tester Oct 12 at 13:05
  • Seems to me as a pfSense firewall or some other configuration issue within pfSense.. Right now the pfSense is almost default, I just setup the interfaces (wan&lan only) – Tester Oct 12 at 13:40
  • Please edit your question and add the output of pfctl -sa on your pfSense router. – Mr Shunz Oct 12 at 13:42

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.