LAN routing to VLANS

viragomann

@malicair
I see. Obviously pfSense doesn’t pass the packets.
You need a rule on LAN to allow it.
By default pfSense automatically creates a rule only for the LAN subnet. But 10.10.x.x lies outside of this.

Additionally you need the route and outbound NAT rule as mentioned above.

Malicair

@viragomann

I created a LAN gateway of 192.168.50.2 and setup a route for destination addresses of 10.10.x.x to that GW. Is this sufficient?

viragomann

@malicair
Yes, but don’t state it in the LAN interface settings, only in System > Routing > Gateways.

However, also this does only matter on inbound connections.

Malicair

@viragomann
I did not change any settings in interfaces > LAN

I went to System > Routing > Gateway and created the following:
Interface: LAN
Gateway: 192.168.50.2

Then into System > Routing > Static Routes and created the following:
Destination Network: 10.0.0.0 /28
Gateway: (selected 192.168.50.2)

NAT > Outbound:

I'm still not getting connectivity.
When I look at the firewall log I see both LAN and WAN deny of 10.x clients

Malicair

@viragomann
FYI: It's late here.. going to pause until morning.

Thanks!

viragomann

@malicair said in LAN routing to VLANS:

When I look at the firewall log I see both LAN and WAN deny of 10.x clients

Can you post a screenshot, please?

Malicair

@viragomann
Want to circle back with you regarding the /28 designation that you referred to previously. As I understand it a /28 only has 15 addresses so a 10.0.0.0 would have a range of 10.0.0.0-10.0.0.15. Whereas a /8 would provide a range from 10.0.0.0-10.255.255.255 which would cover all 10.x addresses. Shouldn't I be applying a rule with a /8 to cover each of the VLans I have within 10.10.x.x & 10.20.x.x (10.10.8.x, 10.10.10.x, 10.10.14.x, 10.20.0.0)?

Malicair

@viragomann
Here is a screen shot of the firewall syslog:

viragomann

@malicair
Yes, I was tired yesterday evening.
For your networks you need at least 10.0.0.0/11 (10.0.0.0 - 10.31.255.255).
Or even add a separate route for each subnet.

Also the blocks by the firewall results of the too small range.

Malicair

@viragomann
OK, seems that I have full connectivity working now. :)

I created rules for both the WAN and LAN interfaces allowing the traffic for the 10.0.0.0/8 network. Initially I had a mistake in only allowing TCP, which showed up in the syslogs so changed that to ANY and now my clients are connecting.

After multiple days of chasing the configuration I'm quite happy that it's now working. THANKS MUCH!!

Now onto my next step of getting the NORDVPN working. (AFTER SAVING MY CONFIG!)

Cheers and have a great day!