pfSense refuses legitimate connection

[Edelrat]

Hello everyone,

 

I have yet another problem with pfSense.

This time it is about pfSense blocking a homepage (battlelog.battlefield.com):

 

 

Sorry for the sceenshot being german, if anyone needs aditional information from this screenshot, I can translate it.

I tried adding a rule to the firewall, which allows traffic from any IP towards this IP. This didn`t solve the issue. (Traffic was blocked on the LAN-interface, Firewall rule created with Easy Rule, directly from the logs)

I also thought about the problem being squid. I told squid to not cache the homepage, and deleted the local cache. Both did not change anything.

I considered snort being the issue, but again, disabling snort didn't do anything.

 

When I restart pfSense and try to access the homepage instantly after it booting, I am able to access it like I used to. When I try again a short time (e.g. 1 minute), I get the same error from above. That leads me to think, that there is some service blocking it, which is not running instantly after pfSense boots up. I have absolutely no idea, which one it could be.

Two days ago I was able to access the homepage without any problems.

For now this is the only homepage I have this problem with.

 

Thanks in advance for any replies!

 

 

 

[The_Denks]

Try disabling your friewall all together and test it with that

[Edelrat]

31 minutes ago, UberGamerKing said:

Try disabling your friewall all together and test it with that

When I disable my firewall all together, I don't have access to the internet at all. I am not sure why..

 

EDIT: Well, it looks like the problem just fixed itself. I really have no idea what was the problem, or what caused it. I have the bad feeling, that I will have the same problem again soon, but for now it is working.

 

Thanks for your reply anyways!

[Edelrat]

On 10.11.2016 at 8:16 PM, UberGamerKing said:

Try disabling your friewall all together and test it with that

Oh well, same problem again.

This time it was with some other homepages aswell.

 

UPDATE: I found out, that snort is the problem here. Now I am trying to figgure out how I can unblock (or rather keep it from being blocked again), since snort doesn't support FQDN.