VLAN cannot ping is gateway!
-
@johnpoz That's how I set up my interfaces. No Gateway... Set to "none" like all my others Netgate and pfSense boxes
This is the first time I get this problem on pfSense/Netgate but it's my first 7100U device, all Natgate 2100 devices (20) no issue...
-
@snoopyski said in VLAN cannot ping is gateway!:
No Gateway... Set to "none" like all my others Netgate and pfSense boxes
Then why do you have this??
-
@johnpoz This is a test... I already removed all... Back to normal but same issue
-
@snoopyski Good morning. This is my setup now, back to standard but still not working :
-
@snoopyski said in VLAN cannot ping is gateway!:
back to standard but still not working :
What is not working? So you have an IP set on pfsense 192.168.x.1 and pfsense can not ping its own IP 192.168.x.1 ??
But you have another IP set 192.168.Y.1 and pfsense can ping that IP.
-
@johnpoz Hello, my pfsense is on 172.168.16.5, and he cannot ping gateway and devices on VLAN9 (10.10.1.0/24) but works for my VLAN5(10.0.0.0/24) and the VLAN9 cannot reach my LAN subnet and gateway
-
@snoopyski said in VLAN cannot ping is gateway!:
172.168.16.5, and he cannot ping gateway
And what gateway is that??? Again you do not set a gateway on a local network..
Are you saying you can not ping your wan/isp gateway IP using this source.. Or can not ping 8.8.8.8?
If so look to your outbound nat rules - Users shoot themselves in the foot all the time following some stupid vpn guide that says to change to manual outbound nat, and then they can not figure out why some new network they add doesn't work.
cannot reach my LAN subnet and gateway
Again - what gateway? There is no gateway IP on local network... Do you mean you can not ping from your vlan 9 IP to your vlan 5 IP? using the build in ping?
Or clients on your vlan 9 can not ping the vlan 5 IP, or IPs of devices on the vlan 5 network.. What are the rules on this vlan 9 interface?
-
@johnpoz said in VLAN cannot ping is gateway!:
@snoopyski said in VLAN cannot ping is gateway!:
172.168.16.5, and he cannot ping gateway
This is my pfsense LAN IP 172.168.16.5
And what gateway is that??? Again you do not set a gateway on a local network..
No gateway set... The only gateway we have is the WAN gateway
Are you saying you can not ping your wan/isp gateway IP using this source.. Or can not ping 8.8.8.8?
I said, I can ping local network and hosts, but I cannot ping VLAN9 and his hosts.
Internet works and I can ping/access VLAN5 hosts
If so look to your outbound nat rules - Users shoot themselves in the foot all the time following some stupid vpn guide that says to change to manual outbound nat, and then they can not figure out why some new network they add doesn't work.
My Outbound NAT is set to : Automatic
cannot reach my LAN subnet and gateway
Again - what gateway? There is no gateway IP on local network... Do you mean you can not ping from your vlan 9 IP to your vlan 5 IP? using the build in ping?
Yes, from my LAN I cannot ping VLAN9 hosts vice versa
Or clients on your vlan 9 can not ping the vlan 5 IP, or IPs of devices on the vlan 5 network.. What are the rules on this vlan 9 interface?
VLAN9 cannot ping local network (LAN)
Additional information : Strange things : From a OpenVPN connection I can ping LAN + VLAN9 + VLAN5 networks lol
-
@snoopyski said in VLAN cannot ping is gateway!:
Yes, from my LAN I cannot ping VLAN9 hosts vice versa
Can you ping the vlan9 IP of pfsense?
Users always forget host firewall rules. Please post up your rules on lan, vlan 5 and vlan 9.. Out of the box the any any rules of lan would allow you to talk to anything in vlan 5 or 9 as long as they are using pfsense as their gateway. No matter what rules are on vlan 5 or vlan 9.
Common mistakes users make.
-
They policy route traffic out vpn or gateway on their lan. Without creating rules above the policy route to allow traffic to their other networks they want to allow traffic.
-
Some host firewall running on device in their destination network that doesn't allow traffic from their source network..
-
The device in dest network is using some other than pfsense IP as their gateway.
-
The mask on the destination device is wrong, and thinks their source IP is local to the destination network - so the destination device never sends traffic back to pfsense.
-
floating rules preventing whatever it is they are wanting to allow.
-
Rule is tcp/udp, and they don't know why ping (icmp) doesn't work
There are other common mistakes users make..
Without details of you rules, your configuration it is impossible to help you figure out which of the many common mistakes your making..
Simple tests to do..
If your lan rules is default any any rule, with no specific gateway set on the rule.. Can a device on the lan network ping the IP of pfsense on your other network/vlan interface you setup?
Ok now try and ping an IP on this destination network.. If does not work - you sure this device answers ping, you sure its using pfsense as its gateway, you sure its not running a firewall or security software
when users insist they have it all setup correctly and not working.. Sniff on your destination interface in pfsense packet capture under diagnostics.. Now ping some IP in in this destination network do you see pfsense send on the pings - if so then its not a pfsense issue.
-
-
-
@snoopyski do you have any rules in the floating tab?
-
@johnpoz No empty
-
@snoopyski so now from a device on your lan can you ping the pfsense IPs that you set on vlan9 and vlan5 interface?
What are the IPs you have set on vlan 9 and vlan 5 interface, and what are their masks - pfsense should not allow you to create overlapping IPs..
What are these IPs.. example
lan 192.168.1.1
vlan9 192.168.9.1
vlan5 192.168.5.1All with /24 makes would be an example setup.. What that last octet is doesn't really matter but lets be clear on what they are.
So from a device on lan, you can ping 192.168.1.1, can you ping 192.168.9.1 and 192.168.5.1? Using whatever actual IPs you have set on these interfaces
-
@johnpoz Only VLAN5 works not VLAN9 very strange.
So I can only ping IP set on VLAN5 and of curse my LAN IP
-
So from my edited example... Your saying you can ping from some 192.168.1.x device you can ping 192.168.1.1, 192.168.5.1 but not 192.168.9.1
And what exactly is the mask on this device in your lan? lets for example see the output of ipconfig on this device in your lan. And lets see the interface you setup on vlan 5 on pfsense.
example here is my lan device
What specific interface do you have these setup on? This is on a switch port I take it on your 7100 - lets see that config.
-
@johnpoz In your example :
From my LAN ping :
192.168.1.1 = OK, Hosts = OK
192.168.9.1 = OK, Hosts = Failed (no access to anything on this VLAN)
192.168.5.1 = OK, Hosts = OK -
-
This post is deleted! -
@snoopyski said in VLAN cannot ping is gateway!:
192.168.9.1 = OK, Hosts = Failed (no access to anything on this VLAN)
So you can ping pfsense IP on vlan 9 from lan.. But you can not ping hosts on this vlan.
So sniff on vlan 9 interface.. Get a running ping going from your lan to 192.168.9.x do you see the ping go out??
This is 10 second test...
Can pfsense ping this 192.168.9.x IP from the ping in the gui?
edit:
why do you have all your interfaces assigned to lagg0 ? This is the uplink of the soc.. You should not have interfaces assigned to that.. -
@johnpoz No pfsense cannot ping 192.168.9.1 and other hosts
