This thing is driving me crazy, pretty much ready throw the towel and switch to a geek firewall, at least I get control...
But before I do that, maybe the community can help.
Short version
My access point cannot ping a remote network (blocked with ICMP packets with invalid ICMP type/code.)
My own computer can (computer is on the same network as access point)
Long version
The configuration is a bit complex.
10.0.1.0/24 : My home LAN
10.1.0.0/16 : My LAB network
10.2.0.0/24 : a private network that links LAN and LAB together. As LAB is hidden behind another firewall, I had to throw an intermediate network in the mix
When I ping 10.1.0.107 from the LAN, here is what happens :
default gw is Sophos, its routing table indicates 10.1.0.0/16 gw is 10.2.0.2, it has its own alias as 10.2.0.1 local so forwards the packet.
Packet is received by the remote firwall (pfsense) that naturally routes it without MASQ to the LAB network.
Echo reply comes through, but for some reason, when the ping originated from the AP (10.0.1.116) it is rejected as "ICMP packets with invalid ICMP type/code." in rule 0, if it comes from my laptop, no issue at all.
Even worst : if from the AP I ping another host, *right next* to the one that fails, it works also.
It happens only with some hosts, and this is the firewall blocking echo reply as I see it in the logs.
Thoughts?
