Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Super Confused - LAN Gateway

    Scheduled Pinned Locked Moved Virtualization
    52 Posts 5 Posters 6.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • bearhntrB
      bearhntr @chpalmer
      last edited by

      @chpalmer said in Super Confused - LAN Gateway:

      @bearhntr said in Super Confused - LAN Gateway:

      I plugged this into the LAN NIC on the VM nothing in WAN at the moment. I gave the LAN on the new VM 10.9.28.254/24. Before I added the LANGW (and pointed it at 10.9.28.250...I was not able to ping anything from pfSense web console other than its own address (10.9.28.254).
      However I cannot get any INTERNET

      Your second box (VM) will not try and access the internet through its LAN.. (well.. not by default.. you would have to do some changes..) You are probably better off adding a firewall rule to the VM to allow your access to it via the WAN port and then configuring it that way. Especially if this is a temporary setup.

      Make sure that your second LAN on your first box (10.9.28.0/24) has outbound NAT enabled for it. (it should by default but no one knows what you might have changed before all of this)

      On PF1 (my working and original pfSense box) - I set the OPT1 port to 10.9.28.250/24 (static).
      on PF2 (my new MV pfSense box) - I set the LAN to 10.9.28.254/24 (static).

      Once the PF2 it up and running I am accessing the Web page from VM on the VM server using vmbr2 as its NIC - and a static address of 10.9.28.100/24 - gateway set to 10.9.28.254 and DNS the same (and added 1.1.1.1 as well).

      I am able to web into PF2 with no issues. I can PING anything on that network (2 other VMs all with 10.9.28.x/24 static address) but not the 10.9.28.250 address from PF1.

      That is where I was reading to use the LANGW. So I created it, and pointed it to 10.9.28.250. I still cannot ping it,...nor, can I ping 10.9.28.254 from PF1.

      I have these rules on PF1 for OPT1:

      c750100b-8625-4579-8e01-3c22aa88d1dd-image.png

      which should leave that network (wide open) - as I see it.

      chpalmerC 1 Reply Last reply Reply Quote 0
      • chpalmerC
        chpalmer @bearhntr
        last edited by

        @bearhntr

        Your client device 10.9.28.100 is a LAN device behind 10.9.28.250 is it not?? Its gateway should be set to 10.9.28.250.

        Everything else is on its subnet so no gateway needed to access anything there. (say that outloud to yourself.)

        Anything on the /24 is local. Understand? You will be able to reach anything on that subnet as long as your allowed by firewall rules.. speaking of-

        What does the OPT interface firewall ruleset look like on PF1?

        Your pf2 LAN port will not look at pf1 for its internet without some special massaging. Basically with that "massaging" then you would be turning your pf2 LAN port into another WAN port.

        Its an "If and Then" argument. If the address Im trying to reach is within my subnet.. Then go directly to it. If the address Im trying to reach is outside my subnet then go via the gateway address Ive been provided. If you provide the wrong gateway address to a device it will not find its way out of the subnet.

        Triggering snowflakes one by one..
        Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

        bearhntrB chpalmerC 2 Replies Last reply Reply Quote 0
        • bearhntrB
          bearhntr @chpalmer
          last edited by

          @chpalmer said in Super Confused - LAN Gateway:

          @bearhntr

          Your client device 10.9.28.100 is a LAN device behind 10.9.28.250 is it not?? Its gateway should be set to 10.9.28.250.

          Nope - 10.9.28.100 is a static IP on the VM server where I am attempting to setup new pfSense (PF2).

          Lets see if this helps:

          5f1bfe43-d022-4f71-926b-aaf8d974f3ab-image.png

          Everything else is on its subnet so no gateway needed to access anything there. (say that outloud to yourself.)

          Anything on the /24 is local. Understand? You will be able to reach anything on that subnet as long as your allowed by firewall rules.. speaking of-

          What does the OPT interface firewall ruleset look like on PF1?

          The WAN port on the PF2 (all images in White - are new VM pfSense) - is using vmbr1 on the Proxmox - nothing plugged into that.

          922934b3-fded-4288-8ebb-896dbc6a6b31-image.png

          The LAN port on the PF2 - is using vmbr2 on the Proxmox (same as the Windows box at 10.9.28.100)

          19ac587f-010a-47d1-828e-d84c2fd1785b-image.png

          Your pf2 LAN port will not look at pf1 for its internet without some special massaging. Basically with that "massaging" then you would be turning your pf2 LAN port into another WAN port.

          Yes - that is what I am reading by using the LANGW (below):
          b8f28c2c-7c57-4bbe-9b58-a6e8d70aa844-image.png

          2576aec2-3836-4bba-9d3d-5a403166d731-image.png

          Its an "If and Then" argument. If the address Im trying to reach is within my subnet.. Then go directly to it. If the address Im trying to reach is outside my subnet then go via the gateway address Ive been provided. If you provide the wrong gateway address to a device it will not find its way out of the subnet.

          Yes... as I have approximate 80 devices on the PF1 LAN (192.168.10.xxx/24) - I cannot reach any of those from PF2.

          J 1 Reply Last reply Reply Quote 0
          • chpalmerC
            chpalmer @chpalmer
            last edited by

            @chpalmer said in Super Confused - LAN Gateway:

            What does the OPT interface firewall ruleset look like on PF1?

            10.9.28.250 ??

            Triggering snowflakes one by one..
            Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

            bearhntrB 3 Replies Last reply Reply Quote 0
            • bearhntrB
              bearhntr @chpalmer
              last edited by

              @chpalmer said in Super Confused - LAN Gateway:

              @chpalmer said in Super Confused - LAN Gateway:

              What does the OPT interface firewall ruleset look like on PF1?

              10.9.28.250 ??

              c2c2d3da-ba48-4391-b492-725dd96345d0-image.png

              chpalmerC 1 Reply Last reply Reply Quote 0
              • bearhntrB
                bearhntr @chpalmer
                last edited by

                @chpalmer

                This is the LAN on PF1

                8cc94e4c-47f2-4f1b-a166-527118b768a8-image.png

                1 Reply Last reply Reply Quote 0
                • J
                  Jarhead @bearhntr
                  last edited by

                  @bearhntr
                  Listen, you wanna keep trying what you are now, go for it. But you're being foolish.
                  Just connect the wan of vm to your existing lan and be done with it.
                  You can then add a rule on the vm wan to allow access through it for configuring it if you need to.

                  From orig pfSense, can you ping the new vm pfSense 10.9.28.254?

                  bearhntrB 1 Reply Last reply Reply Quote 0
                  • bearhntrB
                    bearhntr @chpalmer
                    last edited by

                    @chpalmer

                    This is from my home PC (192.168.10.xxx) -

                    aa10ae19-5122-4e2e-8de9-80f001112997-image.png

                    J 1 Reply Last reply Reply Quote 0
                    • J
                      Jarhead @bearhntr
                      last edited by

                      @bearhntr
                      Try from pfSense.

                      If it's no good, it's not connected properly.

                      1 Reply Last reply Reply Quote 0
                      • bearhntrB
                        bearhntr @Jarhead
                        last edited by

                        @jarhead

                        d26dcce9-55bc-44b8-a1b2-5d2a1d3be8d9-image.png

                        J 1 Reply Last reply Reply Quote 0
                        • J
                          Jarhead @bearhntr
                          last edited by

                          @bearhntr
                          So fix the connection before anything else.
                          Layer 1 problem.

                          bearhntrB 1 Reply Last reply Reply Quote 0
                          • bearhntrB
                            bearhntr @Jarhead
                            last edited by

                            This is what I do not understand....

                            from PF2 -- (which is 10.9.28.254/24)

                            441de818-b956-444c-9916-3011553ac75e-image.png

                            9d89db2e-3b6d-4f31-b4a6-10bdd975de86-image.png

                            J 1 Reply Last reply Reply Quote 0
                            • chpalmerC
                              chpalmer @bearhntr
                              last edited by

                              @bearhntr I would make the OPT1 Net the source.. on your PF1 firewall rules page.. Probably just me though..

                              Triggering snowflakes one by one..
                              Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

                              chpalmerC bearhntrB 2 Replies Last reply Reply Quote 1
                              • chpalmerC
                                chpalmer @chpalmer
                                last edited by chpalmer

                                Set your 10.9.28.11 statically and set its gateway to .250.. you will then be able to get to the internet with that machine if your first pf is working correctly.

                                Once you get there then you can tear your hair out on making your pf2 LAN port into another WAN port.

                                Triggering snowflakes one by one..
                                Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

                                chpalmerC 1 Reply Last reply Reply Quote 0
                                • chpalmerC
                                  chpalmer @chpalmer
                                  last edited by

                                  Can you also show this page from pf2?

                                  /system_gateways.php

                                  Triggering snowflakes one by one..
                                  Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

                                  bearhntrB 1 Reply Last reply Reply Quote 0
                                  • J
                                    Jarhead @bearhntr
                                    last edited by

                                    @bearhntr said in Super Confused - LAN Gateway:

                                    This is what I do not understand....

                                    from PF2 -- (which is 10.9.28.254/24)

                                    441de818-b956-444c-9916-3011553ac75e-image.png

                                    9d89db2e-3b6d-4f31-b4a6-10bdd975de86-image.png

                                    They're not connected.
                                    Are you using a virtual switch?
                                    How are you connecting the two routers?
                                    Is the pc you were connecting to the VM a physical machine? If so, disconnect it and use that cable to connect to OPT on router 1. Does it ping that way?

                                    bearhntrB 1 Reply Last reply Reply Quote 0
                                    • bearhntrB
                                      bearhntr @chpalmer
                                      last edited by

                                      @chpalmer said in Super Confused - LAN Gateway:

                                      @bearhntr I would make the OPT1 Net the source.. on your PF1 firewall rules page.. Probably just me though..

                                      Tried this -- did no good. Still cannot ping PF2 from PF1 and vice versa using pfSense.

                                      1 Reply Last reply Reply Quote 0
                                      • bearhntrB
                                        bearhntr @chpalmer
                                        last edited by

                                        @chpalmer said in Super Confused - LAN Gateway:

                                        Can you also show this page from pf2?

                                        /system_gateways.php

                                        Please explain how to do this. The image above in WHITE is from PF2 >> STATUS >> GATEWAYS.

                                        I went to the SHELL, and I do not see the file you mention.

                                        J 1 Reply Last reply Reply Quote 0
                                        • J
                                          Jarhead @bearhntr
                                          last edited by

                                          @bearhntr Just do this.
                                          Make the OPT 10.10.1.1/30
                                          Make the VM WAN 10.10.1.2/30
                                          Connect the two. Make sure to uncheck block private networks on VM WAN.
                                          You'll now have internet on the VM.
                                          You can allow the original LAN through the VM firewall if you want or just configure it from the VM LAN.

                                          bearhntrB 1 Reply Last reply Reply Quote 0
                                          • bearhntrB
                                            bearhntr @Jarhead
                                            last edited by

                                            @jarhead

                                            The PF1 (192.168.10.254/24) is an HP T620+ ThinClient with a 2-port NIC installed in the expansion slot. The built in NIC is used for OPT1, and the port 0 on the 2-port card is WAN to my cable modem, port 1 is LAN to my Wireless AP (Netgear ORBI).

                                            The PF2 (will be 10.9.28.254/24) is the new one on the Proxmox. There are 5 ports on this box (on-board NIC is the console port for Proxmox and is set to 192.168.10.250/24 (this will change once I get 10.9.28.xxx/24 working) and connects to one port on the ORBI. The 4-port card in the PCIe slot is as follows:

                                            *port 0 = (to be the new WAN - is vmbr1 (Linux Virtual Bridge) to this port {I have another posting to see if this should be virtualized or or IOMMU PCI port into pfSense VM.

                                            port 1= (is to be the new LAN - is vmbr2 (Linux Virtual Bridge) to this port.*

                                            That leaves me with 2 ports not in use.

                                            From the LAN port on the Proxmox - I have a cable plugged into a hub, in turn from there another cable in to the OPT1 port on the PF1 box (which is static 10.9.28.250/24) - have even tried a cable directly from OPT1 to PF2-LAN made no difference. I put the HUB there in case I wanted to plug a laptop in there to test as well. When I get his working - the HP T620+ will be OFF and stored incase I need a replacement some day.

                                            See if this helps:

                                            ff44b43e-a44f-461f-a56d-acfab43c03e8-image.png

                                            bearhntrB 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.