Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    LAN routing to VLANS

    Scheduled Pinned Locked Moved Routing and Multi WAN
    29 Posts 4 Posters 1.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      Malicair @viragomann
      last edited by

      @viragomann
      The 7100 is seeing 10.x traffic.

      Here is the results of a LAN packet capture:
      18:28:16.793704 IP 10.10.8.12.29620 > 8.8.4.4.53: UDP, length 32
      18:28:17.952164 IP 10.10.10.11.49268 > 8.8.8.8.53: UDP, length 59
      18:28:17.952415 IP 10.10.10.11.64554 > 40.97.190.2.443: tcp 31
      18:28:17.952794 IP 10.10.10.11.52456 > 8.8.8.8.53: UDP, length 59
      18:28:17.952800 IP 10.10.10.11.63862 > 8.8.8.8.53: UDP, length 37
      18:28:17.952807 IP 10.10.10.11.58518 > 8.8.8.8.53: UDP, length 37
      18:28:20.972454 IP 10.10.10.11.64554 > 40.97.190.2.443: tcp 31

      And here is results from the firewall:
      Dec 6 18:27:17 LAN Default deny rule IPv4 (1000000103) 10.10.10.11 17.253.5.202 ICMP
      Dec 6 18:27:20 LAN Default deny rule IPv4 (1000000103) 10.10.8.11:47105 8.8.4.4:53 UDP

      V 1 Reply Last reply Reply Quote 0
      • V
        viragomann @Malicair
        last edited by

        @malicair
        I see. Obviously pfSense doesn’t pass the packets.
        You need a rule on LAN to allow it.
        By default pfSense automatically creates a rule only for the LAN subnet. But 10.10.x.x lies outside of this.

        Additionally you need the route and outbound NAT rule as mentioned above.

        M 1 Reply Last reply Reply Quote 0
        • M
          Malicair @viragomann
          last edited by

          @viragomann

          I created a LAN gateway of 192.168.50.2 and setup a route for destination addresses of 10.10.x.x to that GW. Is this sufficient?

          V 1 Reply Last reply Reply Quote 0
          • V
            viragomann @Malicair
            last edited by viragomann

            @malicair
            Yes, but don’t state it in the LAN interface settings, only in System > Routing > Gateways.

            However, also this does only matter on inbound connections.

            M 2 Replies Last reply Reply Quote 0
            • M
              Malicair @viragomann
              last edited by

              @viragomann
              I did not change any settings in interfaces > LAN

              I went to System > Routing > Gateway and created the following:
              Interface: LAN
              Gateway: 192.168.50.2

              Then into System > Routing > Static Routes and created the following:
              Destination Network: 10.0.0.0 /28
              Gateway: (selected 192.168.50.2)

              NAT > Outbound:
              4ae756d0-029c-40fc-ab75-cc47c382d529-image.png

              I'm still not getting connectivity.
              When I look at the firewall log I see both LAN and WAN deny of 10.x clients

              V 1 Reply Last reply Reply Quote 0
              • M
                Malicair @viragomann
                last edited by

                @viragomann
                FYI: It's late here.. going to pause until morning.

                Thanks!

                1 Reply Last reply Reply Quote 0
                • V
                  viragomann @Malicair
                  last edited by

                  @malicair said in LAN routing to VLANS:

                  When I look at the firewall log I see both LAN and WAN deny of 10.x clients

                  Can you post a screenshot, please?

                  M 2 Replies Last reply Reply Quote 0
                  • M
                    Malicair @viragomann
                    last edited by

                    @viragomann
                    Want to circle back with you regarding the /28 designation that you referred to previously. As I understand it a /28 only has 15 addresses so a 10.0.0.0 would have a range of 10.0.0.0-10.0.0.15. Whereas a /8 would provide a range from 10.0.0.0-10.255.255.255 which would cover all 10.x addresses. Shouldn't I be applying a rule with a /8 to cover each of the VLans I have within 10.10.x.x & 10.20.x.x (10.10.8.x, 10.10.10.x, 10.10.14.x, 10.20.0.0)?

                    V 1 Reply Last reply Reply Quote 0
                    • M
                      Malicair @viragomann
                      last edited by

                      @viragomann
                      Here is a screen shot of the firewall syslog:
                      7e7cb0dc-409e-44cd-b80b-0315281aa57e-image.png

                      1 Reply Last reply Reply Quote 0
                      • V
                        viragomann @Malicair
                        last edited by

                        @malicair
                        Yes, I was tired yesterday evening.
                        For your networks you need at least 10.0.0.0/11 (10.0.0.0 - 10.31.255.255).
                        Or even add a separate route for each subnet.

                        Also the blocks by the firewall results of the too small range.

                        M 1 Reply Last reply Reply Quote 0
                        • M
                          Malicair @viragomann
                          last edited by

                          @viragomann
                          OK, seems that I have full connectivity working now. :)

                          I created rules for both the WAN and LAN interfaces allowing the traffic for the 10.0.0.0/8 network. Initially I had a mistake in only allowing TCP, which showed up in the syslogs so changed that to ANY and now my clients are connecting.

                          After multiple days of chasing the configuration I'm quite happy that it's now working. THANKS MUCH!!

                          Now onto my next step of getting the NORDVPN working. (AFTER SAVING MY CONFIG!)

                          Cheers and have a great day!

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.