Topics

I investigated an unusually high number of packets hitting my default deny rule. For the most part they had the TCP-FPA flags set. Looking at a trace I did on the box hosting the firewall-VM I looked at some affected connections and the most unusual about them is that the client still sends traffic into a half-closed connection. Two examples:

1) Server sends FIN
2) Client ACKs the FIN
3) Client Sends additional data -> Packet is blocked
4) Client sends FIN -> Packet is blocked
5) Client retransmits FIN a few times -> Packets are blocked

Second case:
1) Server sends FIN
2) Client ACKs packet before FIN
3) Server retransmits FIN
4) Client ACKs the FIN
5) Client sends FIN -> Packet is blocked
6) Client retransmits FIN a few times -> Packets are blocked

Both clients are Android devices talking to the cloud. One connection is IPv4, the other is IPv6. How can I troubleshoot this further? Why don't the packets match the stateful return path?

Hi all!

I set up an OpenVPN tunnel from my OPNsense to a RaspberryPi located in a remote network for a Site-2-Site tunnel. The tunnel itself is established successfully, correct routes are installed on both sides.

What works:
- Ping from both sides inside the VPN tunnel network
- Ping from the remote side to *any* of the firewall interfaces
- Ping from local LAN box to remote VPN tunnel address

What does not work:
- Ping from the firewall (or any local LAN box) to the remote-LAN-address of the raspi.
- everything else ;)

At first I thought this was due to ip_forward issues on the raspi, but a trace shows that there are no VPN-data packetes egressing from the firewall when pinging the remote-LAN (they are when pinging the remote tunnel address). Although they are visible when tracing the tun interface on the firewall.

Since pinging from the remote side to all firewall interfaces is working I suspect something regarding the rules is wrong (the remote ping is only working because the return path matches an established fw-state?). I have enabled logging for all the default rules and for all IPv4 deny-rules on the Floating, LAN and OpenVPN tabs. There is nothing in the logs and I even can see the pass-state created when pinging from the firewall itself.

I have noticed some oddities:

- Matching on "OpenVPN Network" in rules does not work, I've used an Alias for now. Is the expected behavior?
- Successfull matching on the VPN-Interface IPs when using "This Firewall" seems to depend on some devine interference?
- I can not edit my other OpenVPN connections, because it failes with "local port in use". I use two servers with the same port, one is IPv4, the other IPv6

Does someone have an idea why my box doesn't send out the packets to the remote LAN? Can I or should I assign the tunnel interfaces under Interfaces -> Assignments? This would allow me to dumb down my ruleset.

Cheers,
Flo