• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

VLAN to LAN ping always possible despite rules

L2/Switching/VLANs
vlan lan ping access bug
3
7
1.3k
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • A
    Autourdupc
    last edited by Dec 28, 2021, 4:49 PM

    Hello.

    After so many times spent to find what is wrong...

    PC Engines APU2 - BIOS Coreboot v4.13.0.2
    pfsense 2.5.2-RELEASE (amd64)
    FreeBSD 12.2-STABLE

    The settings
    WAN is on igb0
    LAN is 192.168.20.0/24 on igb2
    VLAN is 192.168.253.0/24 on igb2

    Purpose of VLAN : IPCams network
    Devices on VLAN must be isolated from LAN
    Devices on LAN must get access on devices on VLAN.

    I did all the settings and got the following :
    Devices on the LAN can access Internet -> OK (great !)
    Devices on the VLAn can access Internt -> OK (great !)
    Devices on LAN can access devices on VLAN -> OK (great !)
    Devices on VLAN are not able to access devices on LAN -> OK (great !)

    I did a test :
    Connecting a computer on VLAN (it gets IP 192.168.253.2 from DHCP on VLAN).
    Ping 192.168.20.104 from computer -> No ping (great !)

    From GUI on pfsense : ping 192.168.20.104 from VLAN -> Ping is ok (bad !!!)

    My question is :
    Why is pfsense able to ping LAN network from VLAN ?
    It should not, according to rules that are working.

    Is this a bug ?

    J 1 Reply Last reply Dec 28, 2021, 4:55 PM Reply Quote 0
    • J
      johnpoz LAYER 8 Global Moderator @Autourdupc
      last edited by johnpoz Dec 28, 2021, 4:56 PM Dec 28, 2021, 4:55 PM

      @autourdupc said in VLAN to LAN ping always possible despite rules:

      From GUI on pfsense : ping 192.168.20.104 from VLAN -> Ping is ok (bad !!!)

      Why would you think a rule on vlan would stop pfsense from pinging this device just because you set the source IP to be vlan IP?

      Pfsense is allowed to do whatever it wants ;)

      Via hidden rules.

      [21.05.2-RELEASE][admin@sg4860.local.lan]/root: pfctl -sr | grep "let out"
      pass out inet all flags S/SA keep state allow-opts label "let out anything IPv4 from firewall host itself"
      pass out inet6 all flags S/SA keep state allow-opts label "let out anything IPv6 from firewall host itself"
      

      The interface rules wouldn't be evaluated for traffic pfsense is generating - since the traffic didn't actually enter the vlan interface from the vlan.

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

      A 1 Reply Last reply Dec 28, 2021, 5:04 PM Reply Quote 0
      • A
        Autourdupc @johnpoz
        last edited by Autourdupc Dec 28, 2021, 5:05 PM Dec 28, 2021, 5:04 PM

        @johnpoz said in VLAN to LAN ping always possible despite rules:

        The interface rules wouldn't be evaluated for traffic pfsense is generating - since the traffic didn't actually enter the vlan interface from the vlan.

        Hi !

        I tought that GUI ping would help me to check / verify my settings...
        After spending 2 full days to check, undo/ redo, etc... all the settings, I tought that my isolation was not correct.
        This is in last tests that I use a computer on the VLAn to check... and was working as expecting.
        I would bet that ping from GUI would do the same as ping from an external device.

        V J 2 Replies Last reply Dec 28, 2021, 5:09 PM Reply Quote 0
        • V
          viragomann @Autourdupc
          last edited by Dec 28, 2021, 5:09 PM

          @autourdupc said in VLAN to LAN ping always possible despite rules:

          I would bet that ping from GUI would do the same as ping from an external device.

          That is meant to check for proper network configuration of the destination device, but not for testing user rules at all.

          1 Reply Last reply Reply Quote 0
          • J
            johnpoz LAYER 8 Global Moderator @Autourdupc
            last edited by johnpoz Dec 28, 2021, 5:11 PM Dec 28, 2021, 5:09 PM

            @autourdupc said in VLAN to LAN ping always possible despite rules:

            I would bet that ping from GUI would do the same as ping from an external device.

            Nope.. testing from pfsense itself is good check of connectivity, that pfsense can talk to an IP, and changing the source IP checks that client can back to that IP, etc. But its not a valid check of an interfaces firewall rules.

            Same way checking a port forward from an internal device is not a valid check of a port forward. To check a port forward you need to be external..

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

            A 1 Reply Last reply Dec 29, 2021, 7:59 AM Reply Quote 0
            • A
              Autourdupc @johnpoz
              last edited by Dec 29, 2021, 7:59 AM

              @johnpoz said in VLAN to LAN ping always possible despite rules:

              Nope.. testing from pfsense itself is good check of connectivity,

              Thanks to all of you for your explanations...
              Next time, i will ask community before spending soo much time !

              But now, I'm stronger because I know !

              J 1 Reply Last reply Dec 29, 2021, 11:56 AM Reply Quote 0
              • J
                johnpoz LAYER 8 Global Moderator @Autourdupc
                last edited by Dec 29, 2021, 11:56 AM

                @autourdupc said in VLAN to LAN ping always possible despite rules:

                Next time, i will ask community before spending soo much time !

                What we are here for.. If there is some issue you have question on - or not sure if your understanding something correctly.. Yup just stop on by, here to help.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                1 Reply Last reply Reply Quote 0
                2 out of 7
                • First post
                  2/7
                  Last post
                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.