I've just set up a pfSense router, and am trying to figure out some strange behaviour. It's a fairly simple set up: I have a static IP from the ISP and a single PPPoE WAN interface and a single LAN interface. I've allowed DNS everywhere through the firewall, and browsing the internet generally works. I'm using pfsense
2.1-BETA1 (i386) from March 19th.
Issues (these may be related):
Large HTTP downloads will just 'stop' at some point, and never complete. I'm trying to download an ISO at the moment, and it has just given up at about 103MB out of 650MB. Despite multiple retries, downloads larger than 50MB never complete.
I'm seeting some strange things in the firewall logs about blocking outbound traffic on port 443:
Mar 22 18:25:22 192.168.0.1 pf: 00:00:00.818527 rule 4/0(match): block out on pppoe0: (tos 0x0, ttl 63, id 3535, offset 0, flags [DF], proto TCP (6), length 893) Mar 22 18:25:22 192.168.0.1 pf: <publicip>.44395 > 22.214.171.124.443: Flags [FP.], seq 2278533959:2278534812, ack 270462703, win 262, length 853
Mar 22 18:32:10 192.168.0.1 pf: 00:00:22.972286 rule 3/0(match): block in on pppoe0: (tos 0x0, ttl 57, id 39991, offset 0, flags [DF], proto TCP (6), length 84) Mar 22 18:32:10 192.168.0.1 pf: 126.96.36.199.443 > <publicip>.3684: Flags [FP.], cksum 0x8cdd (correct), seq 1848167695:1848167739, ack 810363008, win 501, length 44
The first appears to be a packet from me to a Google IP address bound for port 443. The second appears to be a packet from the same IP, perhaps a response to a request. Why would this be blocked? In a typical NAT scenario, I would expect outbound packets to be permitted and established/related traffic to be permitted back in.
If this type of traffic is blocked, why can I otherwise browse the web? Why isn't it broken everywhere?
(edit: I'm starting to suspect this may be an MTU problem...)