Home
Help
Search
Login
Register
OPNsense Forum
»
Archive
»
22.1 Legacy Series
»
Fragmented ICMP echo replies dropped by default rule
« previous
next »
Print
Pages: [
1
]
Author
Topic: Fragmented ICMP echo replies dropped by default rule (Read 1093 times)
rmayr
Newbie
Posts: 15
Karma: 1
Fragmented ICMP echo replies dropped by default rule
«
on:
March 11, 2022, 12:15:55 pm »
Hi everybody,
I currently face a strange issue that I can't understand and hope that anybody can enlighten me.
Setting:
* Upstream connection (igb0) is behind an ISP router and hence already behind a NAT. MTU on that interface is 1500.
* Wireguard tunnel to another OPNsense instance, MTU of these interfaces manually set to 1420.
* Pinging from a Linux host on one side to a Linux server on another side using "ping -4 -s 1392 -M want <serverIP>" works as expected and replies arrive with latency of 10-11ms.
* Doing the same with "ping -4 -s 1394 -M want <serverIP>" yields on the Linux client:
PING <serverIP> (<serverIP>) 1394(1422) Bytes Daten.
Von 192.168.64.254 icmp_seq=1 Frag needed and DF set (mtu = 1420)
(192.168.64.254 is the static IP on the LAN interface of OPNsense, while the default route of the Linux client is 192.168.64.1, which is a virtual CARP IP. This seems to work as expected, with the exception of replies not being received.)
Sniffing on the firewall itself on the Wireguard interface:
root@firewall2:~ # tcpdump -n -i wg1 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on wg1, link-type NULL (BSD loopback), capture size 262144 bytes
11:44:11.804655 IP <clientIP> > <serverIP>: ICMP echo request, id 77, seq 513, length 1400
11:44:11.804689 IP <clientIP> > <serverIP>: ip-proto-1
11:44:11.815346 IP <serverIP> > <clientIP>: ICMP echo reply, id 77, seq 513, length 1400
11:44:11.815501 IP <serverIP> > <clientIP>: ip-proto-1
So the (fragmented) replies are coming back in through the Wireguard tunnel.
However, these are dropped by the default rule:
VPN_INS 2022-03-11T12:01:49 <serverIP> <clientIP> icmp Default deny rule
(VPN_INS is the assigned interface name for wg1.)
What I don't understand: Why would unfragmented ICMP replies correctly match the state table entry caused by the ICMP echo request, but wouldn't match when fragmented? Is interface scrubbing (which is not turned off) messing up the replies here?
Logged
Patrick M. Hausen
Hero Member
Posts: 6604
Karma: 560
Re: Fragmented ICMP echo replies dropped by default rule
«
Reply #1 on:
March 11, 2022, 12:37:54 pm »
Fragments in general are a really bad idea and dropped by default.
Logged
Deciso DEC750
People who think they know everything are a great annoyance to those of us who do.
(Isaac Asimov)
Print
Pages: [
1
]
« previous
next »
OPNsense Forum
»
Archive
»
22.1 Legacy Series
»
Fragmented ICMP echo replies dropped by default rule