Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    No routing between local networks

    Scheduled Pinned Locked Moved Routing and Multi WAN
    20 Posts 4 Posters 1.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • G
      gueaje @NogBadTheBad
      last edited by

      @nogbadthebad said in No routing between local networks:

      @gueaje said in No routing between local networks:

      @nogbadthebad no packet flowing from LAN1 to LAN2 or the other way round

      @bob-dig said in No routing between local networks:

      @gueaje This is typical for OSes like Windows with their firewall.

      Just tested between TrueNAS and Ubuntu, the same blockage is there.

      Do a packet capture on LAN2, do you see packets from LAN1 ?

      packet capture run on LAN2, no packet from LAN1
      packet capture run on LAN1, no packet from LAN2

      NogBadTheBadN 1 Reply Last reply Reply Quote 0
      • NogBadTheBadN
        NogBadTheBad @gueaje
        last edited by NogBadTheBad

        @gueaje Firewall rules on the interface or incorrect subnet mask on the clients if I had to guess.

        Drag a screenshot of your firewall rules, into your post.

        Andy

        1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

        G 1 Reply Last reply Reply Quote 0
        • G
          gueaje @NogBadTheBad
          last edited by

          @nogbadthebad
          here you go, WireGuard, DMZ, LANCGUEST and LANSEVER has no rule setup.
          LAN1 is LANCLIENT
          LAN2 is LANSEVER

          8f3475fd-de19-4331-94c2-bec409126e38-image.png
          7f6bca51-558e-48a2-9347-bb375e118883-image.png
          af0a3f1b-475d-4fbe-bbe0-0b7b23816851-image.png
          e70a5387-ced8-4f92-8ec0-310c5fac70b7-image.png
          bf612b0a-836b-48a9-9727-b5f7162f79d9-image.png

          NogBadTheBadN 1 Reply Last reply Reply Quote 0
          • NogBadTheBadN
            NogBadTheBad @gueaje
            last edited by

            @gueaje I'd be tempted to remove the floating rule and interface group, then add any any rules on LANCLIENT & LANSEVER.

            Firewall rules are generally processed as follows:-

            Floating Rules
            Interface Group rules
            Interface tab rules

            Andy

            1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

            G GertjanG 2 Replies Last reply Reply Quote 0
            • G
              gueaje @NogBadTheBad
              last edited by

              @nogbadthebad
              Removed floating rule and interface group, and recreate the same rule under LANCLIENT and LANSEVER, still no luck.

              Tried to reboot the pfsense machine as well.

              fa9f8017-4493-4210-96bb-c599254763cf-image.png
              7ba53270-1588-426f-8dce-d670da4f3dd2-image.png

              NogBadTheBadN 1 Reply Last reply Reply Quote 0
              • NogBadTheBadN
                NogBadTheBad @gueaje
                last edited by NogBadTheBad

                @gueaje The subnet mask and gateway is correct on each box, that you're trying to ping from & to ?

                The interfaces are directly attached so it should work.

                Andy

                1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                G 1 Reply Last reply Reply Quote 0
                • G
                  gueaje @NogBadTheBad
                  last edited by

                  @nogbadthebad said in No routing between local networks:

                  interfaces are directly attached so it should work.

                  Yes, I have checked and rechecked that since you pointed out earlier.
                  Also I tried to use ping tool from diagnostic menu in pfsense.
                  I can ping the hosts from respective pfsense interface (i.e. ping using LANSERVER to ping host in the same network), but it's not reachable if I change source address to LANCLIENT.

                  BTW, if it helps, hosts from both networks are able to access internet.
                  Can this configuration cause the issue? i.e. instead routing the traffic directly from LANSERVER to LANCLIENT, this setup cause the traffic directed to internet?

                  090c2c5a-bdce-4ec0-adc3-fea4ce3901be-image.png

                  NogBadTheBadN 1 Reply Last reply Reply Quote 0
                  • NogBadTheBadN
                    NogBadTheBad @gueaje
                    last edited by NogBadTheBad

                    @gueaje Is your default route your WAN gateway and are you using any sort of PIA ?

                    Diagnostics -> Routes

                    Andy

                    1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                    G 1 Reply Last reply Reply Quote 0
                    • GertjanG
                      Gertjan @NogBadTheBad
                      last edited by

                      @nogbadthebad said in No routing between local networks:

                      @gueaje I'd be tempted to remove the floating

                      Tempted ? ;)
                      What about this one :

                      @gueaje
                      re create the firewall rule you've removed on the LAN interface when you installed pfSense.
                      By pure magic, things start to work.

                      If these are the rules on the LAN interface :

                      bacc1f46-b6f9-43d5-b8e0-c95c2a2fd8b4-image.png

                      then, yeah, all traffic (except destination port 22 80 443 TC pfSense itself) goes into the default, last, hidden "black hole" rule. That included 'ping'.

                      Why did you remove the pass rule that was present in the beginning ? That comes with some punishment ;)

                      Btw : my advise : stay away from floating rules (leave them as you've found them : none).

                      No "help me" PM's please. Use the forum, the community will thank you.
                      Edit : and where are the logs ??

                      G 1 Reply Last reply Reply Quote 1
                      • G
                        gueaje @NogBadTheBad
                        last edited by

                        @nogbadthebad

                        I don't have PIA. (yet, still considering it. based on your question, looks like I have to put aside that consideration :) )

                        In the setup, I leave it as Automatic. Under Diagnostic route, it point to WAN1 right now.
                        Should I change it to LANCLIENT or LANSEVER?

                        NogBadTheBadN 1 Reply Last reply Reply Quote 0
                        • G
                          gueaje @Gertjan
                          last edited by

                          @gertjan
                          From fresh install, it was not working with default setup (no rule except "Anti-Lockout Rule).
                          Hence, I added floating rule to allow all for LAN networks, and it still not working.

                          Bob.DigB GertjanG 2 Replies Last reply Reply Quote 0
                          • Bob.DigB
                            Bob.Dig LAYER 8 @gueaje
                            last edited by

                            @gueaje Just start over freshly.

                            G 1 Reply Last reply Reply Quote 0
                            • NogBadTheBadN
                              NogBadTheBad @gueaje
                              last edited by NogBadTheBad

                              @gueaje Leave it as is.

                              I only asked about PIA as everything would route via your OpenVPN interface unless you has don't pull routes.

                              As you're not using PIA it should be fine.

                              Andy

                              1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                              1 Reply Last reply Reply Quote 0
                              • GertjanG
                                Gertjan @gueaje
                                last edited by

                                @gueaje said in No routing between local networks:

                                @gertjan
                                From fresh install, it was not working with default setup (no rule except "Anti-Lockout Rule).

                                Read pfSense manual : Firewall Rule Best Practices

                                In a default two-interface LAN and WAN configuration, pfSense utilizes default deny on the WAN and default allow on the LAN.

                                This means you find the anti lockout rule and a pass rule on the LAN interface.

                                So, again, on a default pfSense you will find this pass rule on the interface called LAN (other interface are not assigned yet).
                                It is presumed that when you create other (more) LAN type interface, you copy this rule to your new LAN interfaces also. You have to change the "Source" while coping, of course.

                                No "help me" PM's please. Use the forum, the community will thank you.
                                Edit : and where are the logs ??

                                1 Reply Last reply Reply Quote 0
                                • G
                                  gueaje @Bob.Dig
                                  last edited by

                                  @bob-dig said in No routing between local networks:

                                  @gueaje Just start over freshly.

                                  Will need to find time later, probably over long weekend.
                                  Currently can't afford downtime due to work from home.

                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.