One website is getting blocked by PFSense
One website is getting blocked by PFSense
Hey everyone, I have a pfsense box that works great with almost all websites (99.99%). But this specific one - the link https://angelsrescue.org/ and its IP 35.208.254.225 - stops working on many browsers across my networks using both wired and wireless connections, even through pfsense. It works fine on my cell phone when I use LTE. Here are some key things to know: I can ping that address without any packet loss. I use NextDNS and the domain is in their allowed list. Even though it shows up as an allowed page in NextDNS logs, I keep getting blocked. I tried changing the DNS server, but nothing helped. I turned off pfBlockerNG - still gets blocked. It doesn't show up in my pfsense firewall logs as a blocked IP. When I add a rule to let that IP through from WAN to LAN, it shows up as an allowed event. I shared an image of my firewall rules and packet capture results here for you to see: Image of Firewall Logs, Rules, and Packet Capture Thank you if someone could share their thoughts on why this specific site is causing trouble!
Link went through, but the site felt slow. Two tests ran and showed this spot: 17 50 ms 51 ms 47 ms 225.254.208.35.bc.googleusercontent.com [35.208.254.225] ??? It's not the usual place I'd see. Check your Hosts file for any mentions of angelsrescue or that IP address.
Hey Ralston, thanks for giving it a try. I looked at my hosts file and there were no entries for the domain or IP address. I ran the pathping command from the computer's terminal, and then also ran a traceroute through Pfsense. Here are what those commands showed: https://www.dropbox.com/s/uv31ju18w672ax...2.png?dl=0 I'm not sure if my first picture showing just tcp 0 means anything in the packet capture. Normally there should be a port assigned eventually. Thanks again!
You need tracert to check if there is routing going through that IP address. It's hard to tell what your packet capture shows me, but I think seeing an actual session setup would be great. You should see packets leaving the router and getting a response back. I guess things are partially working then failing. What Ralston posted is really weird because those IP addresses don't reverse lookup to the same URL. Maybe you'll worry that this could cause trouble for HTTPS or maybe your browser or pfsense is blocking it because of security reasons.
@Vigilante001 Have you deleted a link or screenshot recently? I remember seeing something and wanted to verify it. Can't find it now ??? Are you using a static ISP address, or are you using a VPN? Use "What is my IP" to check your address but do not post that number.