Weird LAN networking connectivity issue

[kasin]

In LAN mode I am unable to connect to the server locally via WiFi, but can remotely via ethernet, or externally via port forwarding. This is very confusing! I can send UDP packets to the server, and even to fantasy grounds on the server when on the wifi, but the client doesn't connect and hangs at "Attempting direct connection to server".

Both machines are macs.

Attached is my compiled logs from the server. Of note in console.log is a null reference exception:
[11/26/2024 2:27:41 PM] [WARNING] URL: System.TypeInitializationException: The type initializer for 'System.Net.ServicePointManager' threw an exception.

On the client, console.log just says:
[11/26/2024 3:55:44 PM] FGU: v4.6.0 FREE (2024-11-24)
[11/26/2024 3:55:44 PM] OS: Mac OS X 15.1.1
[11/26/2024 3:55:44 PM] GRAPHICS: Apple M1 Pro : 10922
[11/26/2024 3:55:44 PM] UI SCALE: 1
[11/26/2024 3:55:44 PM] USER: kasin
[11/26/2024 3:55:44 PM] Launcher scene starting.
[11/26/2024 3:55:54 PM] Attempting direct connection to server. [192.168.2.2:1802]

Client network.log says:
[11/26/2024 3:55:44 PM] FGU: v4.6.0 FREE (2024-11-24)
[11/26/2024 3:55:44 PM] USER: kasin

The server has 192.168.2.2 on the ethernet interface and 192.168.2.72 on the wifi interface

Tests tried:
0. Ping the server (192.168.2.2 and 192.168.2.72) from the client (192.168.2.186) on the LAN via IPv4 and IPv6 (both passed)
1. Tried connecting FG via LAN IPv4 address (192.168.2.2) and IPv6 (both failed)
2. Updated both server and client to latest release (still failed)
3. Rebooted both client and server machine (still failed)
4. Disabled firewalls (anti-virus not installed on either) (still failed)
5. Launched the 5e tutorial campaign with no extensions loaded (still failed)
6. tested network connectivity
6a. Test UDP connectivity between client and server by running netcat on a different port (1803) on server to see if UDP packets arrive from client (passed)
6b. Testing UDP connectivity from client to FG server by running netcat on client to connect to fantasy grounds running on port 1802 (connection not dropped, so looks like something was running on that port to receive the packets, but no response from server. The lack of response is unsurprising given I don't know the syntax to send.). (passed)
7. Checked fantasy grounds on the server is running and listening on port 1802 for UDP with lsof (passed)
7. Disabled VPN on both client and server machines (still failed)
8. Tested client and server software works by connecting to server from outside the LAN using port forwarding (passed, so it is just the LAN)
9. Completely clean install of both client and server by deleting all config and plists, deleting the application folder, downloading FG, and re-installing. (still failed)
10. Checked the MAC address in the routing tables of both client and server correctly reflected the right routes and show they are directly connected at layer 2 (passed, I am getting desperate).
11. Connect the client via ethernet to the same switch as the server (passed). This one is blowing my mind!!!
12. Disable the WiFi interface on the server. (Still failed).

I cannot work out how this is happening. Why can I get network connectivity, but FG won't connect except via ethernet?

Any ideas?

[damned]

Do you have Wifi isolation enabled on your router or access point?

[TVDinner]

Are you bridging/connecting the ethernet and wifi with the Mac, or is there some sort of "router" involved?

I don't do Macs and haven't done Berkeley in a long time, but I'd focus at the packet filtering on the server wifi. I'd make sure when packet filtering is off on the mac that the default is to accept packets. When it's running, look at the rule list for the default and 1802.

For testing, you can try to swap the server and client, and try a brokered connection (cloud server).

[kasin]

Nope, just checked. Although why can I send UDP packets but FG won’t connect?

[kasin]

No, it’s all layer 2. The wifi access point is connected via Ethernet to a switch which the server is so connected via Ethernet. I just did a manual arp on the client which returns the server’s MAC address, and vice versa, so they are definitely layer 2.

Your idea of switching client and server made we realise I was only testing UDP packets one way, from client to server. I just tried and I can send UDP packets from server to client on port 1802. Using the same port (1802) with nc would seem to rule out a port filter.

I tried running FG on the client and connecting from the server and no joy (good idea though).

With a packet capture I can see zero traffic between the hosts when using FG but I can see UDP packets being exchanged when using nc. It’s like it even isn’t trying to connect via FG.

[Trenloe]

I'd try test #12 again, but reboot both the client and server machines after disabling the WiFi interface on the server.

[TVDinner]

With a packet capture I can see zero traffic between the hosts when using FG but I can see UDP packets being exchanged when using nc.

This really sounds like the Mac has a per-app firewall with nc authorized while FGU isn't. I'd expect the installer to configure this and it needs to be there on both ends.