Recommendations for my pfsense setup with 5 nics

Teke

@jarhead
Thank you for the reply. I will delete the trunk ports on my switch.
4 of them, 1 for each pfsense NIC. I will just associate them to the correct vlan

Teke

@jarhead
So I have setup the Nic ports and the Cisco ports as well as allowing all traffic from all networks in the firewall but I still can't ping. It is giving me a general failure.
Ports config
interface FastEthernet0/1
description pfSense Lan
switchport access vlan 30
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/2
description pfSense Cameras
switchport access vlan 20
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/3
description pfSense Wifi
switchport access vlan 40
switchport mode access
spanning-tree portfast

ip default-gateway 192.168.10.1

It's not picking up a default gateway. I'm just not sure how to set it in pfsense because everything I have read said not to do that. Is that because it grabs it from the WAN?

Jarhead

@teke Can the pc ping itself?
What port on the switch is the pc plugged into?
What vlan is on that port?

Teke

@jarhead
It can ping itself (192.168.10.1) from the diagnostic web interface
I messed up the config above.
It's on fa0/1 and I listed the vlan wrong. It is now 10 but same ping issue.

The laptop (192.168.40.100) is plugged into port fa0/9 which is vlan40 and my pc is plugged into fa0/16 (192.168.10.100) which is on vlan 10. They both get the correct IP address but they can't route.

When I do ipconfig/release and then renew there is no gateway listed.

bingo600

@teke
How are the pfSense interfaces connected to the Cisco Switch ?

Are they connected to the Cisco
fa0/1

fa0/2

fa0/3

If yes ...
Where is the PC connected ?

You do know that you have to make "inbound" allow rules on the pfSense interfaces , in order to get those to allow traffic from the switch in to the pfSense firewall ... Correct ?

Teke

@bingo600
How are the pfSense interfaces connected to the Cisco Switch ?
They are connected each with a cat6 cable

Are they connected to the Cisco
fa0/1 - Lan

fa0/2 - OPT1

fa0/3 - OTP2

If yes ...
Where is the PC connected ? Connected to port 16 on the cisco switch and it's tagged with vlan10

You do know that you have to make "inbound" allow rules on the pfSense interfaces , in order to get those to allow traffic from the switch in to the pfSense firewall ... Correct ?

So on all firewall rule interfaces I have to add inbound rules for all other interfaces?
ex. if on Lan firewall would the rule be protocol any. source opt1 net, destination Lan allow?

bingo600

@teke

You could start out with a rule like this, on the interfaces (change Lan_net) to the respective (XXX_net) on the other interfaces.

That would allow anything for starters ....

Edit: DON'T do the above on WAN

Teke

@bingo600
I do have something similar to that but instead of Lan_Net I have any.

bingo600

@teke
That would also work ...

Do you still have DHCP default GW issues on the PC ?

Teke

@bingo600
I have that but ping can't flow between a PC on the Lan and a laptop on the OPT2 network. I've been trying different configs the last 3 days but can't seem to make things work. I would have things working from OPT1 and 2 (ping wise) but I couldn't ping from LAN to OPT1/2. I can play with the firewall rules tomorrow when I'm back to work.

I also thought that my switch ports had to be trunked with the corresponding vlans as well. If I don't need that it make things easier.

Teke

@bingo600

Do you still have DHCP default GW issues on the PC ?
I do. It grabs an IP but the gateway is blank. I was wondering if it is supposed to grab it from the WAN, which is not plugged in.

bingo600

@teke
Without def-gw set , the PC's would only be able to ping on their own Lan/Vlan.
Not even OPT2

Do you use pfSense as DHCP server ???

@stephenw10
Would pfSense DHCP server NOT send out def-gw, if WAN isn't connected ??

Jarhead

@teke
The DHCP server has nothing to do with the WAN.

Post screenshots of pfSense config's. All interfaces, all firewall rules.

Chances are this is a switch problem so if you can, connect the laptop and a pc directly to the pfSense interfaces and test from there to prove it.

Teke

@bingo600
I read a bunch of how to's and watch a few videos on how to set this up and they all say not to put in a default gateway even though I know that you need one to route. I was thinking this was because I have no WAN connected yet??

I do use pfSense for the DHCP server.
Should I set the gateway up on each interface DHCP scope?

Teke

@jarhead said in Recommendations for my pfsense setup with 5 nics:

@teke
The DHCP server has nothing to do with the WAN.

Post screenshots of pfSense config's. All interfaces, all firewall rules.
I will post shortly.

Chances are this is a switch problem so if you can, connect the laptop and a pc directly to the pfSense interfaces and test from there to prove it.
I have 2 laptops connected directly to the pfSense box.
Laptop 1 plugged into Lan
Laptop 2 plugged into OPT2
They both get an IP but they can't ping each other.

johnpoz

@teke said in Recommendations for my pfsense setup with 5 nics:

Should I set the gateway up on each interface DHCP scope?

You don't need to do this - by default pfsense hands out its IP on the dhcp interface as the gateway.

But if client has no gateway, then no it wouldn't be able to talk to other networks/vlans on pfsense or the internet

Your saying when you look at the client that got an IP (from your dhcp) not some 169.254 address? It has no gateway?

Jarhead

@teke said in Recommendations for my pfsense setup with 5 nics:

@bingo600
I read a bunch of how to's and watch a few videos on how to set this up and they all say not to put in a default gateway even though I know that you need one to route. I was thinking this was because I have no WAN connected yet??

Where exactly are you referring to about the gateway?
If you're talking about the LAN interface, then no, don't put one in.
Are you talking about the switch??

Jarhead

@teke said in Recommendations for my pfsense setup with 5 nics:

@jarhead said in Recommendations for my pfsense setup with 5 nics:

@teke
The DHCP server has nothing to do with the WAN.

Post screenshots of pfSense config's. All interfaces, all firewall rules.
I will post shortly.

Chances are this is a switch problem so if you can, connect the laptop and a pc directly to the pfSense interfaces and test from there to prove it.
I have 2 laptops connected directly to the pfSense box.
Laptop 1 plugged into Lan
Laptop 2 plugged into OPT2
They both get an IP but they can't ping each other.

Show pics of your rules as I asked earlier.
Show the ipconfig of the laptops.

Teke

@jarhead
I've reinstalled pfSense just incase I messed something up.
During the install I choose my WAN (RE0)
I also manually chose my LAN as BCE0
I then added all OPT ports
LAN has the default 192.168.1.1/24 as the IP address.
When running ipconfig on my windows box this is what I get.

No Gateway. Is this supposed to have a gateway right after install?

I really appreciate all of the help so far. I just don't know this product yet but I'm getting a crash course.

johnpoz

@teke yeah it should be handing out the gateway out of the box for the lan interface you enabled dhcp on.. So unless you put in "none" in the box I posted above.

If me I would do a sniff of the dhcp, and look to see if the dhcp server handed that out..

You can do a sniff (packet capture) under diagnostic menu.. Pick you lan interface and port 67, this will capture dhcp traffic.

You can then see what the client is asking for - and what the dhcp server returned..

example

See in the discover the client asked for router (gateway)... Then in the offer the router (pfsense IP on this interface) was offered.