-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 alan walters wrote: > Ry pinging from the wan in the pfsense gui to the next hop maybe you > have a cable wrong or something else silly that we all do sometimes
Thanks for the thot. If only that were true... The pfsense box can ping anything and everything. It can ping the machine on the LAN. It can ping the gateway. It can ping random machines on the Internet. So all the "cables" (one is a wireless link) are in place and working. The machine on the LAN can ping the LAN interface on the pfsense box. It can also ping the WAN interface on the pfsense box. It cannot ping anything past the pfsense box. When I attach a tcpdump to the pfsense LAN interface you see the echo request and an reply of unreachable. If I attach the tcpdump to the WAN interface, I see no traffic at all. So for some reason or other, pfsense is refusing to forward the packet I figured out how to use pfctl to see the NAT rules; but I don't know how to dump a state table to see whether the IP from the LAN box is being mapped or not. But even if the NAT was not working, I would still expect the machine to forward the packet with an unchanged src address (so I think I'm just grasping at straw). > > -----Original Message----- > From: Eric W. Bates [mailto:[EMAIL PROTECTED] > Sent: 10 April 2006 22:31 > To: [email protected] > Subject: [pfSense Support] dumb routing question > > My pfsense box does not seem willing to forward any packets. > > Pretty much factory default. > > It has a non-routable subnet (10.128.10.1/24) on the LAN, and a legit IP > on the WAN. > > I presume NAT is configured; but unless I turn on advanced NAT, I don't > think I can see to confirm? > > The pfsense box has full connectivity/routing out. But if I merely try > to ping the very next hop from a machine on the LAN, the pfsense box > reports an ICMP unreachable. tcpdump attached to the WAN interface > doesn't see anything (i.e. the pfsense machine is not forwarding the > packets to the WAN interface, just bouncing them from the LAN > interface). > > sysctl reports that forwarding is on: > net.inet.ip.forwarding: 1 > net.inet.ip.fastforwarding: 1 > > The firewall log does not report that anything is being blocked (default > rule of allowing everything from the LAN side is in place). > > How do I look to see what the NAT config is? > > I can't think why else stuff is not working. > > Thanks. > > -- > Eric W. Bates > [EMAIL PROTECTED] - --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] - --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] - -- Eric W. Bates [EMAIL PROTECTED] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFEOuDZD1roJTQ4LlERAkSGAKDFvaWtYfBOfKo+BDRAlARETXXTAACguepE GN0M6Pfv2VKvPp9hBwZIe10= =zHPB -----END PGP SIGNATURE----- --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
