Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Unable to connect between lan1 and lan2

    Scheduled Pinned Locked Moved General pfSense Questions
    80 Posts 5 Posters 7.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      SteveITS Galactic Empire @sutha
      last edited by

      @sutha Firewall rules control access between networks (as packets arrive at an interface). One NIC on each PC and routing through pfSense would simplify everything and it will work that way.

      Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
      When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
      Upvote 👍 helpful posts!

      S johnpozJ 2 Replies Last reply Reply Quote 0
      • S
        sutha @SteveITS
        last edited by

        @SteveITS Thanks Steve, but any suggestions how?
        I have open all possible blocking via any rule and disabled my system firewall.

        S 1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator @SteveITS
          last edited by johnpoz

          @SteveITS so you removed the 2nd interface from these devices?

          And from device in A, you try and ping IP address of device in network B?

          Can you ping pfsense IP address on network B? Does that work?

          You have this

          network.jpg

          So 50.100 can ping pfsense IP 60.1 but can not ping 60.50?

          And you have any any rules on both lan 1 and lan 2 interfaces of pfsense.. No policy routing out any gateways on pfsense. No GW actually set on lan 1 or 2 interface in pfsense?

          If you can ping 60.1 from 50.100, but can not ping 60.50 - this screams firewall on 60.50..

          Sniff on pfsense 60.1 interface while you ping from 50.100 device to 60.50.. So you see pfsense send the ping request to 60.50? If you do and you get no response that is 60.50 not answering, or not using pfsense 60.1 as its gateway.

          example... Here is me pinging from my Pc on 192.168.9.100 to an IP in one of my other network 192.168.3.10, now doing a packet capture on my pfsense 192.168.3 interface you can see the traffic sent on to 192.168.3.10 from 192.168.9.100

          If you see this but no response - that SCREAMS firewall on the destination IP device... or its not using pfsense as its gateway, or its mask is wrong and thinks the source IP is on its own network, so it doesn't send traffic back to pfsense, etc.

          ping.jpg

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

          1 Reply Last reply Reply Quote 0
          • S
            SteveITS Galactic Empire @sutha
            last edited by

            @sutha ^that, start small and work your way up.

            Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
            When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
            Upvote 👍 helpful posts!

            S 1 Reply Last reply Reply Quote 0
            • S
              sutha @SteveITS
              last edited by

              @SteveITS Thanks!
              I'm a bit confused, so just to clarify.
              When I remove the second interface, how will communication occur from 192.168.50.x to 192.168.60.x ? Typically, for communication within a network, devices need to be on the same network with a unique IP range. For example:

              PC1:
              IP: 192.168.50.100
              Subnet: 255.255.255.0
              Gateway: 192.168.50.1

              PC2:
              IP: 192.168.60.50
              Subnet: 255.255.255.0
              Gateway: 192.168.60.1

              When I want to communicate from PC1 to PC2, I need another IP within the range of PC2. Therefore, I have added another network card to PC1 and assigned the following IP to it:

              PC1 - 2nd network card:
              IP: 192.168.60.100
              Subnet: 255.255.255.0
              Gateway: 192.168.60.1 (This is optional)

              Current situation, I'm able to ping from pfsense diagnostic both devices(Lan1 and Lan2).

              johnpozJ 1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @sutha
                last edited by johnpoz

                @sutha said in Unable to connect between lan1 and lan2:

                how will communication occur from 192.168.50.x to 192.168.60.x

                How exactly do you think you communicate with any IP off your network, like google or this forum? it gets routed by your gateway, in the case of the internet your gateway (pfsense) says oh I am not connected to that network, but hey my default route (your isp) I will send the traffic there, and he can figure out how to route it to get where its going.

                In the case where its just also attached to pfsense, pfsense say oh you want to go to 192.168.60.x - hey I am attached to that network I will send the traffic to that IP out my interface attached to that network..

                Pfsense will say I am attached to 192.168.60/24 - this 192.168.60.x falls into that network, let me arp for that 192.168.60.x address - oh he is at mac address abc.. Send the traffic to that mac address.

                I am a bit confused how anyone setting up a router/firewall and adding multiple networks to it doesn't understand that it can route between them?

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                S 1 Reply Last reply Reply Quote 1
                • S
                  sutha @johnpoz
                  last edited by

                  @johnpoz
                  Don't take me wrong, it's my silly question.

                  Normally, I install E-Pos system and connect card machines. Typically, all E-Pos systems have an IP like 192.x.x.100, while card machines have their own IP range like 10.x.x.x.
                  When I want to connect the card machine, I add an additional IP to my E-Pos system within the range 10.x.x.100 and subnet. This setup usually works fine.
                  However, in my current situation, I'm unable to add a gateway to route my traffic to the 192.168.60.x network. Pfsense wouldn't allow to create a gateway.
                  This is where I'm stuck.

                  S stephenw10S 2 Replies Last reply Reply Quote 0
                  • S
                    SteveITS Galactic Empire @sutha
                    last edited by SteveITS

                    @sutha pfSense doesn’t need a gateway for an internal network. It “knows” where they are.

                    .60 sends traffic for .50 to its gateway, pfSense, which sends it onto the .50 network.

                    Broadcast/multicast are different things but ping/tcp/udp work fine.

                    Edit: you can do it with multiple IPs or NICs but the traffic wouldn’t go through pfSense. And there’s nothing in your scenario to prevent a Pc from adding an IP for the card network.

                    Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                    When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                    Upvote 👍 helpful posts!

                    1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator @sutha
                      last edited by

                      @sutha said in Unable to connect between lan1 and lan2:

                      I add an additional IP to my E-Pos system within the range 10.x.x.100 and subnet.

                      That only works when both subnets are using the same netwok segment. That isn't the case here, you have two segments with pfSense between them. Also two subnets on one segment is generally considered a bad idea!

                      1 Reply Last reply Reply Quote 1
                      • S
                        sutha
                        last edited by

                        This is my ping result from pfsense diagnostics.
                        Lan1:
                        ping result lan1.png

                        Lan2:
                        ping result lan2.png

                        S johnpozJ 2 Replies Last reply Reply Quote 0
                        • S
                          SteveITS Galactic Empire @sutha
                          last edited by

                          @sutha that seems fine. Are these networks on different switches?

                          Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                          When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                          Upvote 👍 helpful posts!

                          S 1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator @sutha
                            last edited by johnpoz

                            @sutha yeah you expect that... Now do the simple sniff test I did to validate pfsense sends the traffic on..

                            Can almost promise you its a host firewall issue.. If both devices use pfsense as their gateway. And your firewall rule allows client on A to talk to network B, or even just client Bs address then it will send it on.. If you do not get an answer it just SCREAMS!!! that device did not answer..

                            A simple 10 second test will prove that to you..

                            Another possible problem is your masks are wrong on the clients.. If say client A is using a /16 mask vs /24, then it would think 192.168.60.x is local and never send the traffic to pfsense. Or even if client A mask puts the 192.168.60.x address on a different network and sends it to pfsense, and pfsense sends it on.. If client Bs mask think 192.168.50.x is on its local network - it will never send its answer back to pfsense.

                            pfsense would prevent you from creating 2 networks that overlap like that - but maybe you set the IPs manually on the devices and using the wrong mask?

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                            S 1 Reply Last reply Reply Quote 0
                            • S
                              sutha @SteveITS
                              last edited by

                              @SteveITS Yes, They are on different switch. Switch a connected to lan1 and switch b connected to lan2. Therfore, I have opened a rule on both lan "Any to Any".

                              1 Reply Last reply Reply Quote 0
                              • S
                                sutha @johnpoz
                                last edited by

                                @johnpoz Do you think, if I have disabled my total firewall on my system can block anything.
                                Everyone talking about sniff test, how do I do it. Any instruction.

                                johnpozJ 1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator @sutha
                                  last edited by

                                  @sutha got to packet capture under the diagnostic menu.. pick your interface (destination network interface) and any filters you want to put in like icmp or the IP of one of the devices.. Click start..

                                  Now send your ping from your client in network A to your IP in network B.

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                  S 1 Reply Last reply Reply Quote 0
                                  • S
                                    sutha @johnpoz
                                    last edited by

                                    @johnpoz This is my result:
                                    Something is not right.
                                    After sniffing with packet capture, I'm able to capture packets between pfsense only.
                                    My pfsense is on 192.168.50.1, I'll get traffic captured if I send anything to this ip.
                                    Packet capture:
                                    packet capture.png
                                    These are my ping result from lan1:
                                    If try my lan2 network, nothing happend.

                                    Pfsense:
                                    18:17:41.297565 IP 192.168.50.100 > 192.168.50.1: ICMP echo request, id 1, seq 114, length 40
                                    18:17:41.297603 IP 192.168.50.1 > 192.168.50.100: ICMP echo reply, id 1, seq 114, length 40
                                    18:17:42.316326 IP 192.168.50.100 > 192.168.50.1: ICMP echo request, id 1, seq 115, length 40
                                    18:17:42.316343 IP 192.168.50.1 > 192.168.50.100: ICMP echo reply, id 1, seq 115, length 40
                                    18:17:43.332647 IP 192.168.50.100 > 192.168.50.1: ICMP echo request, id 1, seq 116, length 40
                                    18:17:43.332661 IP 192.168.50.1 > 192.168.50.100: ICMP echo reply, id 1, seq 116, length 40
                                    18:17:44.345138 IP 192.168.50.100 > 192.168.50.1: ICMP echo request, id 1, seq 117, length 40
                                    18:17:44.345153 IP 192.168.50.1 > 192.168.50.100: ICMP echo reply, id 1, seq 117, length 40

                                    ISP:
                                    18:17:53.333221 IP 192.168.50.100 > 192.168.1.1: ICMP echo request, id 1, seq 118, length 40
                                    18:17:53.333890 IP 192.168.1.1 > 192.168.50.100: ICMP echo reply, id 1, seq 118, length 40
                                    18:17:54.346585 IP 192.168.50.100 > 192.168.1.1: ICMP echo request, id 1, seq 119, length 40
                                    18:17:54.347073 IP 192.168.1.1 > 192.168.50.100: ICMP echo reply, id 1, seq 119, length 40
                                    18:17:55.362542 IP 192.168.50.100 > 192.168.1.1: ICMP echo request, id 1, seq 120, length 40
                                    18:17:55.363027 IP 192.168.1.1 > 192.168.50.100: ICMP echo reply, id 1, seq 120, length 40
                                    18:17:56.375135 IP 192.168.50.100 > 192.168.1.1: ICMP echo request, id 1, seq 121, length 40
                                    18:17:56.375467 IP 192.168.1.1 > 192.168.50.100: ICMP echo reply, id 1, seq 121, length 40

                                    Google:
                                    18:18:28.443341 IP 192.168.50.100 > 142.250.187.195: ICMP echo request, id 1, seq 126, length 40
                                    18:18:28.445510 IP 142.250.187.195 > 192.168.50.100: ICMP echo reply, id 1, seq 126, length 40
                                    18:18:29.459627 IP 192.168.50.100 > 142.250.187.195: ICMP echo request, id 1, seq 127, length 40
                                    18:18:29.461912 IP 142.250.187.195 > 192.168.50.100: ICMP echo reply, id 1, seq 127, length 40
                                    18:18:30.478792 IP 192.168.50.100 > 142.250.187.195: ICMP echo request, id 1, seq 128, length 40
                                    18:18:30.481679 IP 142.250.187.195 > 192.168.50.100: ICMP echo reply, id 1, seq 128, length 40
                                    18:18:31.498252 IP 192.168.50.100 > 142.250.187.195: ICMP echo request, id 1, seq 129, length 40
                                    18:18:31.501290 IP 142.250.187.195 > 192.168.50.100: ICMP echo reply, id 1, seq 129, length 40
                                    18:20:27.374903 IP 192.168.50.100 > 192.168.50.1: ICMP 192.168.50.100 udp port 52048 unreachable, length 286

                                    S 1 Reply Last reply Reply Quote 0
                                    • S
                                      sutha @sutha
                                      last edited by sutha

                                      @sutha These all ping belongs to lan1 port, even if I try to ping another pc on the same network. I'll get a ping result on command prompt but nothing will be captured.
                                      Lan2 port got nothing captured.

                                      johnpozJ 1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        If you are trying to ping something on LAN2 from 192.168.50.100 and it doesn't appear in that capture then the client is not sending it to the gateway.

                                        It would only do that if it has a bad route to that subnet. So if it has the wrong subnet mask. Or if it is still dual homed with a second IP in that subnet.

                                        What error is shown on on the host when it fails?

                                        1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator @sutha
                                          last edited by

                                          @sutha So sniffing on the lan interface, this is where the 192.168.50.x box is and pfsense is IP is 192.168.50.1 and you ping 192.168.60.50 and you get nothing?

                                          Lets see the output of your ipconfig /all

                                          You sure you turned off this boxes 192.168.60 interface you said it had, or did you just remove the gateway from the interface?

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                          S 1 Reply Last reply Reply Quote 0
                                          • S
                                            sutha @johnpoz
                                            last edited by

                                            @johnpoz Sorry for the late reply. I'll try to disable my tunnel tomorrow and let you know the outcome.

                                            johnpozJ 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.