Unable to connect between lan1 and lan2

[sutha]

@viragomann Sorry for any misinterpretation. I have disabled the firewall on my Windows system.
Firewall image below here:

[SteveITS]

@sutha Do all devices use pfSense as their gateway?

Rules allow protocol * or ICMP not just TCP? (Picture?)

https://docs.netgate.com/pfsense/en/latest/troubleshooting/connectivity.html#firewall-rules

[johnpoz]

@sutha Policy routing can also be a reason for this.. Be nice to actually see your rules, screenshot. And do you have any rules in floating?

If your forcing traffic out your wan or vpn via a policy route, then no you wouldn't actually be able to get to your other networks.

[sutha]

@SteveITS Hi Steve, for test pupose I have open the rule for any(source=any, destination=any)

[sutha]

@johnpoz Are you saying, I'm unable to communicate with my second lan when I have a vpn connection. I don't have any floating rule.

[johnpoz]

@sutha only if you are policy routing out it..

If your doing that, then you would have to create rules to allow to get to your other networks before you force it out the vpn gateway.

https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html#bypassing-policy-routing

[sutha]

@johnpozYes, my policy is routing out. However, only certain IPs are affected, which are not included in the routing rule at all. Before activating this second LAN on my pfSense, I had a working site-to-site VPN. Now, with the addition of a second area, I aim to connect only specific computers to this network. Therefore, I equipped PCs with two network cards, one for connecting to Area 1 (192.168.50.0/24) and another for connecting to the other network (192.168.60.0/24). My LAN rule already allows any-to-any traffic, and I replicated this same rule for the newly created LAN2 as well.
However, I am able to connect from my pfSense web interface to both LAN and subnets, but not from a local PC.

[SteveITS]

@sutha said in Unable to connect between lan1 and lan2:

@SteveITS Hi Steve, for test pupose I have open the rule for any(source=any, destination=any)

The protocol…show us a screen cap.

[SteveITS]

@sutha

equipped PCs with two network cards, one for connecting to Area 1 (192.168.50.0/24) and another for connecting to the other network (192.168.60.0/24).

If a PC has two networks traffic for them would not go through pfSense, the gateway.

If that’s not the case they presumably don’t have two gateways and static routes so the reply is going out the wrong network.
https://docs.netgate.com/pfsense/en/latest/troubleshooting/asymmetric-routing.html

If you unplug the “other” network from a few so they each have one network does it work?

[johnpoz]

@sutha said in Unable to connect between lan1 and lan2:

herefore, I equipped PCs with two network cards, one for connecting to Area 1 (192.168.50.0/24) and another for connecting to the other network (192.168.60.0/24)

That is horrible solution.. And you have now created asymmetrical traffic flow..

And if "both" your devices have interfaces in both networks.. Why would the traffic even flow through pfsense.. The traffic would go out the interface connected to the network the IP is on.

[sutha]

@SteveITS
Lan1

Lan2

[sutha]

@sutha They have to flow through pfsense, because they are connected on pfsense lan 1 and lan 2 port.

[johnpoz]

@sutha said in Unable to connect between lan1 and lan2:

They have to flow through pfsense, because they are connected on pfsense lan 1 and lan 2 port.

That is NOT what you stated..

I equipped PCs with two network cards, one for connecting to Area 1 (192.168.50.0/24) and another for connecting to the other network (192.168.60.0/24)

[sutha]

@johnpoz Yes, because of the gateway. I have mentioned above, I'm using 2 different gateway.

[johnpoz]

@sutha said in Unable to connect between lan1 and lan2:

I'm using 2 different gateway.

Doesn't work that way..

There is no reason to send traffic to a gateway if the IP is on the network your attached too..

If I have an IP in network 192.168.50.0/24 and I want to talk to 192.168.50.X why would I send traffic to a gateway.. Gateways are for getting off a specific network.

I would suggest you disable the 2nd interface on each machine... So you have machine A in only lan 1, and machine B only on lan 2..

[sutha]

@johnpoz You're right, but I'd like to go to the second lan which is 192.168.60.X.
I don't know, if there's a way to communicate without the second card to this ip range. I'm happy to remove my card.

[johnpoz]

@sutha That is what pfsense is there for - it is the router, it routes traffic between 192.168.50 and 192.168.60..

[sutha]

@johnpoz Yes, this what I want. After creation of lan2, I didn’t get any internet access and I couldn’t ping from pfsense web interface either but after I created an any rule. It was fine, only I’m unable to connect from local pc.

[SteveITS]

@sutha Firewall rules control access between networks (as packets arrive at an interface). One NIC on each PC and routing through pfSense would simplify everything and it will work that way.

[sutha]

@SteveITS Thanks Steve, but any suggestions how?
I have open all possible blocking via any rule and disabled my system firewall.