Separate LANs unable to see each other
-
New to pfSense, just finished a build today - but either I'm not understanding something <obvious?> or I have some settings wrong.
At this point, I have two separate networks, LAN (10.10.10.0/24) and IoT (10.10.20.0/24) - VLANS to come later. I have my "main" computer on LAN at 10.10.10.121, and a laptop on IoT at 10.10.20.137. Both have received their addresses from pfSense DHCP. I believe I have both LAN and IoT fully open to Pass everything (in the rules for each.) I can ping each from within pfSense Diagnostics -> Ping, but I cannot ping the laptop (on IoT) from the main computer (on LAN) - nor vice versa.
Here is a screenshot of the Firewall log showing a successful connection at 19:19:55 (10.10.10.125 to 10.10.20.137 ICMP), yet I still can't get them to talk to each other.
Though I don't have a screenshot, I did see that there was a successful connection the other direction as well, This leads me to believe that rules are not interfering, but I'm missing something somewhere why I can't ping either direction. Once I get them talking, then I'll set up restrictive rules as needed. . .
Sooooo. . . what am I missing???
Thanks!
-
@lkh Does any firewall on each device allow the other subnet?
-
@SteveITS
Wow, hadn't thought about that. Just now turned off "Real-time Protection" in Windows Defender, but no change pinging either direction. . . -
@lkh that’s more a/v…look for Advanced Firewall. Ensure Windows doesn’t think you’re on a Public network.
https://docs.netgate.com/pfsense/en/latest/troubleshooting/connectivity.html#client-tests may help.
-
@SteveITS said in Separate LANs unable to see each other:
https://docs.netgate.com/pfsense/en/latest/troubleshooting/connectivity.html#client-tests may help
I went through the Netgate troubleshooting docs previously, no joy.
Going through and following the Windows Docs on Defender did not change anything (most settings remain unchanged). If it's to be found in there, gotta do some studying - I've never dug that deeply into Windows Defender before, I thought just disabling Defender would eliminate any restrictions - not so?
Gee, is it just me, or do all nubees have these problems?
-
@lkh did you disable Defender firewall or antivirus? They keep reusing the name. Anyway that would affect incoming pings not outgoing.
Does your rule allow any protocol or just the default TCP? Screen cap?
Gateway on all devices is that pfSense interface IP?
-
@lkh here are the common issues that come to mind that users have when wanting device in network A to talk to network B through pfsense.
In no particular order.
Device(s) not using pfsense as their gateway.
Rules are not correct on which interface you want the creation of the traffic to come from.. The destination network doesn't matter because the state would allow the return traffic.. So for example if your lan was any any rule, and your IOT network had no rules you could still create a conversation from lan to iot, even if iot had zero rules on its interface. You might have tcp only, or tcp/udp and trying to ping.
Mask is not correct on device, and he thinks the source of the traffic trying to talk to him is local and never sends answer back to pfsense. Or the device is multihomed and you run into the same sort of problem.
Or you have a firewall running on the device(s) that prevents the traffic because its not local network traffic, etc.
Your doing policy routing.. So say your lan you force traffic out your gateway/vpn - well that gateway isn't going to be able to get to you iot network, etc.. If your doing policy based routing, you need bypass rules above that allow to the local networks you want to get to before shoving traffic out a specific gateway/vpn, etc.
-
@SteveITS said in Separate LANs unable to see each other:
Does your rule allow any protocol or just the default TCP? Screen cap?
LAN Rule ("out of the box")
IoT Rule
Gateway on all devices is that pfSense interface IP?
Yup (if I understand your Q correctly)
did you disable Defender firewall or antivirus? They keep reusing the name. Anyway that would affect incoming pings not outgoing.
Yes, now. Thought I had done that last night, but evidently not.
Sooooo. . .
HAPPY DAYS!!! The good news is that disabling Windows Defender Firewall on both main computer and laptop seems to have done the trick. Successfully pinging in both directions. That leads to one final question:
1 - How should Defender Firewall be configured to still be useful, while still allowing desired access here? What settings, etc?2 - Once I get that set, gonna set the restrictive rules to keep IoT stuff out of LAN stuff
Thanks for your help - seemed like Defender never got in the way before and I had not even thought about it being the issue!
-
@johnpoz said in Separate LANs unable to see each other:
Or you have a firewall running on the device(s) that prevents the traffic because its not local network traffic, etc.
As mentioned in the reply above to SteveITS, looks like that was the problem!
Now I need to hear recommendations about setting Windows Defender correctly. Or other suggestions/recommendations/etc. . .
Thanks!
-
@lkh said in Separate LANs unable to see each other:
setting Windows Defender correctly
My firewall is just off..
-
@lkh said in Separate LANs unable to see each other:
@johnpoz said in Separate LANs unable to see each other:
Or you have a firewall running on the device(s) that prevents the traffic because its not local network traffic, etc.
As mentioned in the reply above to SteveITS, looks like that was the problem!
Now I need to hear recommendations about setting Windows Defender correctly. Or other suggestions/recommendations/etc. . .
Thanks!
Control Panel/ Windows Defender Firewall.
Click "advanced".
Add an inbound rule to allow the subnets you want.But same as John, I just turn it off.
-
@lkh allow windows firewall to approve ping you shouldn’t need to disable defender. Make one rule in windows firewall to approve pings.
