VLAN cannot ping is gateway!
-
@snoopyski said in VLAN cannot ping is gateway!:
Yes, from my LAN I cannot ping VLAN9 hosts vice versa
Can you ping the vlan9 IP of pfsense?
Users always forget host firewall rules. Please post up your rules on lan, vlan 5 and vlan 9.. Out of the box the any any rules of lan would allow you to talk to anything in vlan 5 or 9 as long as they are using pfsense as their gateway. No matter what rules are on vlan 5 or vlan 9.
Common mistakes users make.
-
They policy route traffic out vpn or gateway on their lan. Without creating rules above the policy route to allow traffic to their other networks they want to allow traffic.
-
Some host firewall running on device in their destination network that doesn't allow traffic from their source network..
-
The device in dest network is using some other than pfsense IP as their gateway.
-
The mask on the destination device is wrong, and thinks their source IP is local to the destination network - so the destination device never sends traffic back to pfsense.
-
floating rules preventing whatever it is they are wanting to allow.
-
Rule is tcp/udp, and they don't know why ping (icmp) doesn't work
There are other common mistakes users make..
Without details of you rules, your configuration it is impossible to help you figure out which of the many common mistakes your making..
Simple tests to do..
If your lan rules is default any any rule, with no specific gateway set on the rule.. Can a device on the lan network ping the IP of pfsense on your other network/vlan interface you setup?
Ok now try and ping an IP on this destination network.. If does not work - you sure this device answers ping, you sure its using pfsense as its gateway, you sure its not running a firewall or security software
when users insist they have it all setup correctly and not working.. Sniff on your destination interface in pfsense packet capture under diagnostics.. Now ping some IP in in this destination network do you see pfsense send on the pings - if so then its not a pfsense issue.
-
-
-
@snoopyski do you have any rules in the floating tab?
-
@johnpoz No empty
-
@snoopyski so now from a device on your lan can you ping the pfsense IPs that you set on vlan9 and vlan5 interface?
What are the IPs you have set on vlan 9 and vlan 5 interface, and what are their masks - pfsense should not allow you to create overlapping IPs..
What are these IPs.. example
lan 192.168.1.1
vlan9 192.168.9.1
vlan5 192.168.5.1All with /24 makes would be an example setup.. What that last octet is doesn't really matter but lets be clear on what they are.
So from a device on lan, you can ping 192.168.1.1, can you ping 192.168.9.1 and 192.168.5.1? Using whatever actual IPs you have set on these interfaces
-
@johnpoz Only VLAN5 works not VLAN9 very strange.
So I can only ping IP set on VLAN5 and of curse my LAN IP
-
So from my edited example... Your saying you can ping from some 192.168.1.x device you can ping 192.168.1.1, 192.168.5.1 but not 192.168.9.1
And what exactly is the mask on this device in your lan? lets for example see the output of ipconfig on this device in your lan. And lets see the interface you setup on vlan 5 on pfsense.
example here is my lan device
What specific interface do you have these setup on? This is on a switch port I take it on your 7100 - lets see that config.
-
@johnpoz In your example :
From my LAN ping :
192.168.1.1 = OK, Hosts = OK
192.168.9.1 = OK, Hosts = Failed (no access to anything on this VLAN)
192.168.5.1 = OK, Hosts = OK -
-
This post is deleted! -
@snoopyski said in VLAN cannot ping is gateway!:
192.168.9.1 = OK, Hosts = Failed (no access to anything on this VLAN)
So you can ping pfsense IP on vlan 9 from lan.. But you can not ping hosts on this vlan.
So sniff on vlan 9 interface.. Get a running ping going from your lan to 192.168.9.x do you see the ping go out??
This is 10 second test...
Can pfsense ping this 192.168.9.x IP from the ping in the gui?
edit:
why do you have all your interfaces assigned to lagg0 ? This is the uplink of the soc.. You should not have interfaces assigned to that.. -
@johnpoz No pfsense cannot ping 192.168.9.1 and other hosts
-
@snoopyski see my edit... Why do you have interfaces assigned to your lagg which only contains the uplink to the soc..
That sure doesn't seem right to me.. Calling @stephenw10
-
@snoopyski said in VLAN cannot ping is gateway!:
No pfsense cannot ping 192.168.9.1 and other hosts
But your saying devices from lan can ping 9.1?
But pfsense both from cmd line and from gui can not ping its own IP address?
-
@johnpoz said in VLAN cannot ping is gateway!:
@snoopyski said in VLAN cannot ping is gateway!:
No pfsense cannot ping 192.168.9.1 and other hosts
But your saying devices from lan can ping 9.1?
No devices on LAN cannot ping hosts on 9.1
But pfsense both from cmd line and from gui can not ping its own IP address?
From the cmd (shell) I can ping its own IP 192.168.9.1 but not from GUI if the source is LAN, if the source is WAN I can ping 192.168.9.1
-
@johnpoz said in VLAN cannot ping is gateway!:
@snoopyski see my edit... Why do you have interfaces assigned to your lagg which only contains the uplink to the soc..
That sure doesn't seem right to me.. Calling @stephenw10
It's the Netgate default setup out of the box! What's wrong?
-
@snoopyski said in VLAN cannot ping is gateway!:
but not from GUI if the source is LAN, if the source is WAN I can ping 192.168.9.1
That makes no sense at all.. Other than a mask issue..
Can you post your routing table please.
-
-
@snoopyski said in VLAN cannot ping is gateway!:
Hello everyone,
I have 2 VLAN :
VLAN9 and VLAN5
Same settings, VLAN9 in the Netgate "Diagnostics ping" section cannot ping itself the VLAN9 gateway from VLAN9 source BUT works fine for the VLAN5 for itself
So the result is :
LAN cannot reach VLAN9 devices and VLAN9 cannot reach LAN devices
PS : Of course, my rules ares open for my test
Any Idea ? The device is Netgate 7100U
Best regards
In that VLAN, did you create something in the "System/Routing/Gateways" menu?
When I was starting with Pfsense, I went through a similar error, but my mistake was that I didn't need to create a gateway for each vlan, because the IP you define in it will be your gateway.
If you created it, just go and disable the Gateway from the vlan and everything will work.
