5

I cannot ping my mac that is running macOS Big Sur 11.0.1 It seems to receive the ping packages but does not respond to them, and yes:

  • Firewall is off
  • I have tried turning stealth mode on and off
  • I have even reinstalled/restored the OS from recovery mode
  • They both have the same subnet mask 255.255.255.0

To check if I receive any packages I ran:

sudo tcpdump 'icmp[icmptype] = icmp-echo or icmp[icmptype] = icmp-echoreply'

When I ping the ethernet IP from my router (192.168.0.1 / 95.XX.XX.168) I get the following:

tcpdump: data link type PKTAP
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on pktap, link-type PKTAP (Apple DLT_PKTAP), capture size 262144 bytes
01:16:56.067149 IP 95.XX.XX.168 > 192.168.0.52: ICMP echo request, id 25956, seq 0, length 72
01:16:57.074797 IP 95.XX.XX.168 > 192.168.0.52: ICMP echo request, id 25956, seq 1, length 72
01:16:58.084733 IP 95.XX.XX.168 > 192.168.0.52: ICMP echo request, id 25956, seq 2, length 72

From the same router, I can ping my iPhone and it responds.

PING 192.168.0.80 (192.168.0.80) from 95.XX.XX.168: 64 data bytes
72 bytes from 192.168.0.80: seq=0 ttl=64 time=120.000 ms
72 bytes from 192.168.0.80: seq=1 ttl=64 time=130.000 ms
72 bytes from 192.168.0.80: seq=2 ttl=64 time=40.000 ms
--- 192.168.0.80 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 40.000/96.666/130.000 ms

And I can ping other machines from my macbook, for example, my iPhone:

ping -t 3 192.168.0.80
PING 192.168.0.80 (192.168.0.80): 56 data bytes
64 bytes from 192.168.0.80: icmp_seq=0 ttl=64 time=211.346 ms
64 bytes from 192.168.0.80: icmp_seq=1 ttl=64 time=961.203 ms
64 bytes from 192.168.0.80: icmp_seq=2 ttl=64 time=11.140 ms

--- 192.168.0.80 ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 11.140/394.563/961.203/408.926 ms

And the tcpdump for it:

01:28:03.524898 IP 192.168.0.52 > 192.168.0.80: ICMP echo request, id 1288, seq 0, length 64
01:28:03.736146 IP 192.168.0.80 > 192.168.0.52: ICMP echo reply, id 1288, seq 0, length 64
01:28:04.529410 IP 192.168.0.52 > 192.168.0.80: ICMP echo request, id 1288, seq 1, length 64
01:28:05.490506 IP 192.168.0.80 > 192.168.0.52: ICMP echo reply, id 1288, seq 1, length 64
01:28:05.529564 IP 192.168.0.52 > 192.168.0.80: ICMP echo request, id 1288, seq 2, length 64
01:28:05.540622 IP 192.168.0.80 > 192.168.0.52: ICMP echo reply, id 1288, seq 2, length 64

On the other hand, when I ping my macbook from my iPhone:

PING 192.168.0.52 (192.168.0.52)
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3
Request timeout for icmp_seq 4
Request timeout for icmp_seq 5
Request timeout for icmp_seq 6
Request timeout for icmp_seq 7
--- 192.168.0.52 ping statistics ---
9 packets transmitted, 0 packets received, lost 100.0 %

But the macbook seems to receive them, only it doesn't respond:

01:25:54.267776 IP 192.168.0.80 > 192.168.0.52: ICMP echo request, id 12, seq 0, length 24
01:25:56.269888 IP 192.168.0.80 > 192.168.0.52: ICMP echo request, id 12, seq 1, length 24
01:25:58.261587 IP 192.168.0.80 > 192.168.0.52: ICMP echo request, id 12, seq 2, length 24
01:26:00.270944 IP 192.168.0.80 > 192.168.0.52: ICMP echo request, id 12, seq 3, length 24
01:26:02.269110 IP 192.168.0.80 > 192.168.0.52: ICMP echo request, id 12, seq 4, length 24
01:26:04.266884 IP 192.168.0.80 > 192.168.0.52: ICMP echo request, id 12, seq 5, length 24
01:26:06.264448 IP 192.168.0.80 > 192.168.0.52: ICMP echo request, id 12, seq 6, length 24
01:26:08.266868 IP 192.168.0.80 > 192.168.0.52: ICMP echo request, id 12, seq 7, length 24
01:26:10.264863 IP 192.168.0.80 > 192.168.0.52: ICMP echo request, id 12, seq 8, length 24

There doesn't seem to be any firewall rules on my machine after running sudo pfctl -s all:

No ALTQ support in kernel
ALTQ related functions disabled
TRANSLATION RULES:
nat-anchor "com.apple/*" all
rdr-anchor "com.apple/*" all

FILTER RULES:
scrub-anchor "com.apple/*" all fragment reassemble
anchor "com.apple/*" all

DUMMYNET RULES:
dummynet-anchor "com.apple/*" all

INFO:
Status: Disabled                              Debug: Urgent

State Table                          Total             Rate
  current entries                        0               
  searches                               0            0.0/s
  inserts                                0            0.0/s
  removals                               0            0.0/s
Counters
  match                                  0            0.0/s
  bad-offset                             0            0.0/s
  fragment                               0            0.0/s
  short                                  0            0.0/s
  normalize                              0            0.0/s
  memory                                 0            0.0/s
  bad-timestamp                          0            0.0/s
  congestion                             0            0.0/s
  ip-option                              0            0.0/s
  proto-cksum                            0            0.0/s
  state-mismatch                         0            0.0/s
  state-insert                           0            0.0/s
  state-limit                            0            0.0/s
  src-limit                              0            0.0/s
  synproxy                               0            0.0/s
  dummynet                               0            0.0/s

TIMEOUTS:
tcp.first                   120s
tcp.opening                  30s
tcp.established           86400s
tcp.closing                 900s
tcp.finwait                  45s
tcp.closed                   90s
tcp.tsdiff                   30s
udp.first                    60s
udp.single                   30s
udp.multiple                 60s
icmp.first                   20s
icmp.error                   10s
grev1.first                 120s
grev1.initiating             30s
grev1.estblished           1800s
esp.first                   120s
esp.estblished              900s
other.first                  60s
other.single                 30s
other.multiple               60s
frag                         30s
interval                     10s
adaptive.start             6000 states
adaptive.end              12000 states
src.track                     0s

LIMITS:
states        hard limit    10000
app-states    hard limit    10000
src-nodes     hard limit    10000
frags         hard limit     5000
tables        hard limit     1000
table-entries hard limit   200000

OS FINGERPRINTS:
696 fingerprints loaded

And my ifconfig looks like this:

ifconfig -a
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
    options=1203<RXCSUM,TXCSUM,TXSTATUS,SW_TIMESTAMP>
    inet 127.0.0.1 netmask 0xff000000 
    inet6 ::1 prefixlen 128 
    inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 
    nd6 options=201<PERFORMNUD,DAD>
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
en5: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    ether ac:de:48:00:11:22 
    inet6 fe80::aede:48ff:fe00:1122%en5 prefixlen 64 scopeid 0x4 
    nd6 options=201<PERFORMNUD,DAD>
    media: autoselect (100baseTX <full-duplex>)
    status: active
ap1: flags=8802<BROADCAST,SIMPLEX,MULTICAST> mtu 1500
    options=400<CHANNEL_IO>
    ether 3a:f9:d3:83:18:e6 
    media: autoselect
    status: inactive
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    options=400<CHANNEL_IO>
    ether 38:f9:d3:83:18:e6 
    inet6 fe80::14f2:ebf3:1101:67bc%en0 prefixlen 64 secured scopeid 0x6 
    inet 192.168.0.124 netmask 0xffffff00 broadcast 192.168.0.255
    nd6 options=201<PERFORMNUD,DAD>
    media: autoselect
    status: active
awdl0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
    options=400<CHANNEL_IO>
    ether 7a:88:46:2c:f0:b2 
    inet6 fe80::7888:46ff:fe2c:f0b2%awdl0 prefixlen 64 scopeid 0x7 
    nd6 options=201<PERFORMNUD,DAD>
    media: autoselect
    status: active
llw0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    options=400<CHANNEL_IO>
    ether 7a:88:46:2c:f0:b2 
    inet6 fe80::7888:46ff:fe2c:f0b2%llw0 prefixlen 64 scopeid 0x8 
    nd6 options=201<PERFORMNUD,DAD>
    media: autoselect
    status: active
en3: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
    options=460<TSO4,TSO6,CHANNEL_IO>
    ether 82:53:be:a4:44:05 
    media: autoselect <full-duplex>
    status: inactive
en4: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
    options=460<TSO4,TSO6,CHANNEL_IO>
    ether 82:53:be:a4:44:04 
    media: autoselect <full-duplex>
    status: inactive
en1: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
    options=460<TSO4,TSO6,CHANNEL_IO>
    ether 82:53:be:a4:44:01 
    media: autoselect <full-duplex>
    status: inactive
en2: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
    options=460<TSO4,TSO6,CHANNEL_IO>
    ether 82:53:be:a4:44:00 
    media: autoselect <full-duplex>
    status: inactive
en7: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    options=6467<RXCSUM,TXCSUM,VLAN_MTU,TSO4,TSO6,CHANNEL_IO,PARTIAL_CSUM,ZEROINVERT_CSUM>
    ether 48:65:ee:1d:59:23 
    inet6 fe80::1caa:45bf:3aec:20de%en7 prefixlen 64 secured scopeid 0xd 
    inet 192.168.0.52 netmask 0xffffff00 broadcast 192.168.0.255
    nd6 options=201<PERFORMNUD,DAD>
    media: autoselect (100baseTX <full-duplex>)
    status: active
bridge0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    options=63<RXCSUM,TXCSUM,TSO4,TSO6>
    ether 82:53:be:a4:44:01 
    Configuration:
        id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
        maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
        root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
        ipfilter disabled flags 0x0
    member: en1 flags=3<LEARNING,DISCOVER>
            ifmaxaddr 0 port 11 priority 0 path cost 0
    member: en2 flags=3<LEARNING,DISCOVER>
            ifmaxaddr 0 port 12 priority 0 path cost 0
    member: en3 flags=3<LEARNING,DISCOVER>
            ifmaxaddr 0 port 9 priority 0 path cost 0
    member: en4 flags=3<LEARNING,DISCOVER>
            ifmaxaddr 0 port 10 priority 0 path cost 0
    nd6 options=201<PERFORMNUD,DAD>
    media: <unknown type>
    status: inactive
utun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1380
    inet6 fe80::60fa:19f1:c750:5337%utun0 prefixlen 64 scopeid 0xf 
    nd6 options=201<PERFORMNUD,DAD>
utun1: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 2000
    inet6 fe80::49fb:f35f:566c:6246%utun1 prefixlen 64 scopeid 0x10 
    nd6 options=201<PERFORMNUD,DAD>
pktap0: flags=1<UP> mtu 0
utun2: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1380
    inet6 fe80::7d94:7b40:79c1:a260%utun2 prefixlen 64 scopeid 0x12 
    nd6 options=201<PERFORMNUD,DAD>
utun3: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1380
    inet6 fe80::7e34:be6:af87:77b2%utun3 prefixlen 64 scopeid 0x13 
    nd6 options=201<PERFORMNUD,DAD>

Any ideas what should I look into? Thanks!

Improve this question

2 Answers 2

Reset to default
3

Checkpoint Endpoint Security VPN does block this as noted.

  • Their explanation (from the web site) is that they include a built-in firewall because the VPN connection can have firewall rules that are defined by the VPN site administrator.
  • Checkpoint VPN is compatible with 10.15 Catalina and 11.0 Big Sur. When you install it, you MUST go to the System Preferences->Privacy and allow their extensions. Then reboot before trying to use it.

Note on the previous answer:

launchctl changed in newer macOS releases. Previously, you could edit the *.plist file and change the RunAtLoad and KeepAlive directly. But this is no longer recommended. Instead, you should use launchctl to set the status to enable or disable, for example:

launchctl disable system/com.checkpoint.epc.service

To list services available, use the print system or print user or print gui options:

launchctl print system

launchctl print gui/501 ### Where 501 is the User UID number, 501 is the first account created.

launchctl print login/myname ### Where byname is the User login name
Improve this answer
1
  • Thanks for checking this out - what is annoying is that these rules are kept after I close the VPN client. I will check again once I get to my computer but right now I have a command that kills the process and disable the firewall.
    – Cyupa
    Commented Dec 24, 2020 at 9:10
1

It seems that the Endpoint Security VPN (I have the Checkpoint client but the Symantec is also culpable) mingles around and blocks any incoming connections and any PING echo requests.

So the solution is to kill the agent:

sudo launchctl unload /Library/LaunchDaemons/com.checkpoint.epc.service.plist
sudo kextunload /Library/Extensions/cpfw.kext

and turn the AutoLaunch off by setting the RunAtLoad and KeepAlive PLIST values to false:

sudo nano /Library/LaunchDaemons/com.checkpoint.epc.service.plist

I have a script that can be used here:

https://gist.github.com/cyupa/ebb2a80a699d4c2f567b78161cb28767

Improve this answer
2
  • 1
    This also fixed a completely unrelated issue where the WebStorm IDE was not reachable from the LAN.
    – Dag Sondre Hansen
    Commented Apr 27, 2021 at 13:58
  • 1
    sudo launchctl unload /Library/LaunchDaemons/com.checkpoint.epc.service.plist && sudo kextunload /Library/Extensions/cpfw.kext was enough to do it for me.
    – cesar
    Commented Oct 21, 2021 at 12:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .