Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Unable to connect between lan1 and lan2

    Scheduled Pinned Locked Moved General pfSense Questions
    80 Posts 5 Posters 8.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator @sutha
      last edited by

      @sutha only if you are policy routing out it..

      If your doing that, then you would have to create rules to allow to get to your other networks before you force it out the vpn gateway.

      https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html#bypassing-policy-routing

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      S 1 Reply Last reply Reply Quote 0
      • S
        sutha @johnpoz
        last edited by

        @johnpozYes, my policy is routing out. However, only certain IPs are affected, which are not included in the routing rule at all. Before activating this second LAN on my pfSense, I had a working site-to-site VPN. Now, with the addition of a second area, I aim to connect only specific computers to this network. Therefore, I equipped PCs with two network cards, one for connecting to Area 1 (192.168.50.0/24) and another for connecting to the other network (192.168.60.0/24). My LAN rule already allows any-to-any traffic, and I replicated this same rule for the newly created LAN2 as well.
        However, I am able to connect from my pfSense web interface to both LAN and subnets, but not from a local PC.

        S johnpozJ 2 Replies Last reply Reply Quote 0
        • S
          SteveITS Galactic Empire @sutha
          last edited by

          @sutha said in Unable to connect between lan1 and lan2:

          @SteveITS Hi Steve, for test pupose I have open the rule for any(source=any, destination=any)

          The protocol…show us a screen cap.

          Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
          When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
          Upvote 👍 helpful posts!

          1 Reply Last reply Reply Quote 0
          • S
            SteveITS Galactic Empire @sutha
            last edited by

            @sutha

            equipped PCs with two network cards, one for connecting to Area 1 (192.168.50.0/24) and another for connecting to the other network (192.168.60.0/24).

            If a PC has two networks traffic for them would not go through pfSense, the gateway.

            If that’s not the case they presumably don’t have two gateways and static routes so the reply is going out the wrong network.
            https://docs.netgate.com/pfsense/en/latest/troubleshooting/asymmetric-routing.html

            If you unplug the “other” network from a few so they each have one network does it work?

            Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
            When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
            Upvote 👍 helpful posts!

            S 1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator @sutha
              last edited by

              @sutha said in Unable to connect between lan1 and lan2:

              herefore, I equipped PCs with two network cards, one for connecting to Area 1 (192.168.50.0/24) and another for connecting to the other network (192.168.60.0/24)

              That is horrible solution.. And you have now created asymmetrical traffic flow..

              And if "both" your devices have interfaces in both networks.. Why would the traffic even flow through pfsense.. The traffic would go out the interface connected to the network the IP is on.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • S
                sutha @SteveITS
                last edited by

                @SteveITS
                Lan1
                lan1.png

                Lan2
                lan2.png

                S 1 Reply Last reply Reply Quote 0
                • S
                  sutha @sutha
                  last edited by

                  @sutha They have to flow through pfsense, because they are connected on pfsense lan 1 and lan 2 port.

                  johnpozJ 1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator @sutha
                    last edited by

                    @sutha said in Unable to connect between lan1 and lan2:

                    They have to flow through pfsense, because they are connected on pfsense lan 1 and lan 2 port.

                    That is NOT what you stated..

                    I equipped PCs with two network cards, one for connecting to Area 1 (192.168.50.0/24) and another for connecting to the other network (192.168.60.0/24)

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    S 1 Reply Last reply Reply Quote 0
                    • S
                      sutha @johnpoz
                      last edited by

                      @johnpoz Yes, because of the gateway. I have mentioned above, I'm using 2 different gateway.

                      johnpozJ 1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator @sutha
                        last edited by

                        @sutha said in Unable to connect between lan1 and lan2:

                        I'm using 2 different gateway.

                        Doesn't work that way..

                        There is no reason to send traffic to a gateway if the IP is on the network your attached too..

                        If I have an IP in network 192.168.50.0/24 and I want to talk to 192.168.50.X why would I send traffic to a gateway.. Gateways are for getting off a specific network.

                        I would suggest you disable the 2nd interface on each machine... So you have machine A in only lan 1, and machine B only on lan 2..

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        S 1 Reply Last reply Reply Quote 0
                        • S
                          sutha @johnpoz
                          last edited by

                          @johnpoz You're right, but I'd like to go to the second lan which is 192.168.60.X.
                          I don't know, if there's a way to communicate without the second card to this ip range. I'm happy to remove my card.

                          johnpozJ 1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator @sutha
                            last edited by

                            @sutha That is what pfsense is there for - it is the router, it routes traffic between 192.168.50 and 192.168.60..

                            nework.jpg

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            S 1 Reply Last reply Reply Quote 0
                            • S
                              sutha @johnpoz
                              last edited by

                              @johnpoz Yes, this what I want. After creation of lan2, I didn’t get any internet access and I couldn’t ping from pfsense web interface either but after I created an any rule. It was fine, only I’m unable to connect from local pc.

                              S 1 Reply Last reply Reply Quote 0
                              • S
                                SteveITS Galactic Empire @sutha
                                last edited by

                                @sutha Firewall rules control access between networks (as packets arrive at an interface). One NIC on each PC and routing through pfSense would simplify everything and it will work that way.

                                Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                                When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                                Upvote 👍 helpful posts!

                                S johnpozJ 2 Replies Last reply Reply Quote 0
                                • S
                                  sutha @SteveITS
                                  last edited by

                                  @SteveITS Thanks Steve, but any suggestions how?
                                  I have open all possible blocking via any rule and disabled my system firewall.

                                  S 1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator @SteveITS
                                    last edited by johnpoz

                                    @SteveITS so you removed the 2nd interface from these devices?

                                    And from device in A, you try and ping IP address of device in network B?

                                    Can you ping pfsense IP address on network B? Does that work?

                                    You have this

                                    network.jpg

                                    So 50.100 can ping pfsense IP 60.1 but can not ping 60.50?

                                    And you have any any rules on both lan 1 and lan 2 interfaces of pfsense.. No policy routing out any gateways on pfsense. No GW actually set on lan 1 or 2 interface in pfsense?

                                    If you can ping 60.1 from 50.100, but can not ping 60.50 - this screams firewall on 60.50..

                                    Sniff on pfsense 60.1 interface while you ping from 50.100 device to 60.50.. So you see pfsense send the ping request to 60.50? If you do and you get no response that is 60.50 not answering, or not using pfsense 60.1 as its gateway.

                                    example... Here is me pinging from my Pc on 192.168.9.100 to an IP in one of my other network 192.168.3.10, now doing a packet capture on my pfsense 192.168.3 interface you can see the traffic sent on to 192.168.3.10 from 192.168.9.100

                                    If you see this but no response - that SCREAMS firewall on the destination IP device... or its not using pfsense as its gateway, or its mask is wrong and thinks the source IP is on its own network, so it doesn't send traffic back to pfsense, etc.

                                    ping.jpg

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      SteveITS Galactic Empire @sutha
                                      last edited by

                                      @sutha ^that, start small and work your way up.

                                      Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                                      When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                                      Upvote 👍 helpful posts!

                                      S 1 Reply Last reply Reply Quote 0
                                      • S
                                        sutha @SteveITS
                                        last edited by

                                        @SteveITS Thanks!
                                        I'm a bit confused, so just to clarify.
                                        When I remove the second interface, how will communication occur from 192.168.50.x to 192.168.60.x ? Typically, for communication within a network, devices need to be on the same network with a unique IP range. For example:

                                        PC1:
                                        IP: 192.168.50.100
                                        Subnet: 255.255.255.0
                                        Gateway: 192.168.50.1

                                        PC2:
                                        IP: 192.168.60.50
                                        Subnet: 255.255.255.0
                                        Gateway: 192.168.60.1

                                        When I want to communicate from PC1 to PC2, I need another IP within the range of PC2. Therefore, I have added another network card to PC1 and assigned the following IP to it:

                                        PC1 - 2nd network card:
                                        IP: 192.168.60.100
                                        Subnet: 255.255.255.0
                                        Gateway: 192.168.60.1 (This is optional)

                                        Current situation, I'm able to ping from pfsense diagnostic both devices(Lan1 and Lan2).

                                        johnpozJ 1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator @sutha
                                          last edited by johnpoz

                                          @sutha said in Unable to connect between lan1 and lan2:

                                          how will communication occur from 192.168.50.x to 192.168.60.x

                                          How exactly do you think you communicate with any IP off your network, like google or this forum? it gets routed by your gateway, in the case of the internet your gateway (pfsense) says oh I am not connected to that network, but hey my default route (your isp) I will send the traffic there, and he can figure out how to route it to get where its going.

                                          In the case where its just also attached to pfsense, pfsense say oh you want to go to 192.168.60.x - hey I am attached to that network I will send the traffic to that IP out my interface attached to that network..

                                          Pfsense will say I am attached to 192.168.60/24 - this 192.168.60.x falls into that network, let me arp for that 192.168.60.x address - oh he is at mac address abc.. Send the traffic to that mac address.

                                          I am a bit confused how anyone setting up a router/firewall and adding multiple networks to it doesn't understand that it can route between them?

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          S 1 Reply Last reply Reply Quote 1
                                          • S
                                            sutha @johnpoz
                                            last edited by

                                            @johnpoz
                                            Don't take me wrong, it's my silly question.

                                            Normally, I install E-Pos system and connect card machines. Typically, all E-Pos systems have an IP like 192.x.x.100, while card machines have their own IP range like 10.x.x.x.
                                            When I want to connect the card machine, I add an additional IP to my E-Pos system within the range 10.x.x.100 and subnet. This setup usually works fine.
                                            However, in my current situation, I'm unable to add a gateway to route my traffic to the 192.168.60.x network. Pfsense wouldn't allow to create a gateway.
                                            This is where I'm stuck.

                                            S stephenw10S 2 Replies Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.