1

We're running PFSense Version: 2.2.2

On our LAN the PFSense box is our default gateway, so it goes:

USER PC -> PFSense Box -> Firewall -> Internet

We've set allow ANY ANY rules on the firewall of the PFSense Box, which we've had to leave enabled because we do traffic shaping on the box. However, something is causing issues when uploading files (small or large) or submitting form data on certain sites, so far all sites are SSL using port 443. For example, uploading to dropbox.com or slack.com does not work, it will sit there and then time out, same with Gmail attachments.

There is NOTHING in the firewall logs, or any other logs for that matter, which leaves me to believe that it's not the firewall blocking (not to mention the ANY ANY rules), but I've got no idea what other settings I should be looking at to see what could be causing this. If we remove the PFSense box from the equation (make the firewall the default gateway) everything is fine.

Does anyone have any ideas of what I could check out? I did a packet capture, however I'm not too knowledgeable in what to look for, but it looked like all the communication was one way, USER PC -> website, with no replies coming back.

UPDATE: Upon more testing any files smaller then 50kb get uploaded just fine, as soon as you pass that 50kb file size they will not upload.

UPDATE 2: Attached is a capture of me trying to upload a file to dropbox unsuccessfully: https://www.dropbox.com/s/23tjggy5lxzm3nj/dropboxreview.pcapng?dl=0

9
  • Are you sure that you are logging blocks? I know in Cisco gear you have to put deny ip any any log. Notice the log keyword. Try looking in the documentation for how to log denies. Jul 2, 2015 at 19:02
  • It definitely is, if I had to guess I would say that the firewall isn't technically blocking it, but it's a config issue, upon more testing any files smaller then 50kb get uploaded just fine, as soon as you pass that 50kb file size they will not upload.
    – Neostim
    Jul 2, 2015 at 19:05
  • ...and what happens if you use the pfSense as the firewall? I'm suspecting something (double-NAT issue?) related to having YourLAN==pfSense==OtherLAN==Firewall==WAN. You find that YourLAN==Firewall==WAN works - what about YourLAN==pfSense==WAN?
    – Ecnerwal
    Jul 7, 2015 at 13:47
  • It's actually all on the same LAN until it goes out to the internet, so basically: MY PC (10.5.1.2)-> PF Sense (Default Gateway for the LAN) (10.5.1.1)-> Firewall (10.5.1.254) -> Internet I assume when data is coming back from the internet it's skipping the PF Sense box all together and going: Internet -> Firewall (10.5.1.254) -> MY PC (10.5.1.2) since it's on the same network. I can't remove the firewall from the equation currently because it's providing internet for all of our locations across the province, but you think it could be a double NAT issue?
    – Neostim
    Jul 7, 2015 at 13:56
  • Had some similar troubles with QoS / Trafic Sharper with PFSense. Tried disabling it ?
    – Onthewired
    Jul 7, 2015 at 15:42

2 Answers 2

1

Have you done any captures on your client machines that you are testing with? That is the first place that I would start. Is other non-encrypted traffic working?

3
  • Seems all other traffic is fine, I did do some captures but really am not that great with going through it with wireshark and noticing anything relevant. If helpful I could do a dropbox upload on the client PC and post results?
    – Neostim
    Jul 2, 2015 at 19:07
  • Go for it, I'd be happy to take a glance.
    – Daniel
    Jul 2, 2015 at 19:22
  • Thanks! I used wireshark on my computer and tried uploading a file to dropbox while recording, the capture file is here: dropbox.com/s/23tjggy5lxzm3nj/dropboxreview.pcapng?dl=0
    – Neostim
    Jul 6, 2015 at 14:00
0

The first thing I notice about your capture is that you have TCP Sequence Offloading (TSO) enabled. This isn't inherently a problem, but it could be masking whatever is causing your connection to stall.

I don't see anything else suspicious in the PCAP, but a lot of the interaction is hidden behind your card's TSO feature. I would try turning off TSO and making another capture to see if there is anything suspicious going on.

2
  • Unfortunately I don't see anything in the driver settings of the NIC resembling any TSO for me to disable. The only thing I see remotely like it is Protocol ARP Offload and Protocol NS Offload, but I suspect those aren't going to do what you're suggesting.
    – Neostim
    Jul 8, 2015 at 11:29
  • Sometimes the option is only exposed if you install the vendor's drivers for the card instead of using Microsoft's default ones. Jul 9, 2015 at 14:28

Not the answer you're looking for? Browse other questions tagged or ask your own question.