Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Unable to connect between lan1 and lan2

    Scheduled Pinned Locked Moved General pfSense Questions
    80 Posts 5 Posters 7.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      sutha @SteveITS
      last edited by

      @SteveITS Yes, They are on different switch. Switch a connected to lan1 and switch b connected to lan2. Therfore, I have opened a rule on both lan "Any to Any".

      1 Reply Last reply Reply Quote 0
      • S
        sutha @johnpoz
        last edited by

        @johnpoz Do you think, if I have disabled my total firewall on my system can block anything.
        Everyone talking about sniff test, how do I do it. Any instruction.

        johnpozJ 1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator @sutha
          last edited by

          @sutha got to packet capture under the diagnostic menu.. pick your interface (destination network interface) and any filters you want to put in like icmp or the IP of one of the devices.. Click start..

          Now send your ping from your client in network A to your IP in network B.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

          S 1 Reply Last reply Reply Quote 0
          • S
            sutha @johnpoz
            last edited by

            @johnpoz This is my result:
            Something is not right.
            After sniffing with packet capture, I'm able to capture packets between pfsense only.
            My pfsense is on 192.168.50.1, I'll get traffic captured if I send anything to this ip.
            Packet capture:
            packet capture.png
            These are my ping result from lan1:
            If try my lan2 network, nothing happend.

            Pfsense:
            18:17:41.297565 IP 192.168.50.100 > 192.168.50.1: ICMP echo request, id 1, seq 114, length 40
            18:17:41.297603 IP 192.168.50.1 > 192.168.50.100: ICMP echo reply, id 1, seq 114, length 40
            18:17:42.316326 IP 192.168.50.100 > 192.168.50.1: ICMP echo request, id 1, seq 115, length 40
            18:17:42.316343 IP 192.168.50.1 > 192.168.50.100: ICMP echo reply, id 1, seq 115, length 40
            18:17:43.332647 IP 192.168.50.100 > 192.168.50.1: ICMP echo request, id 1, seq 116, length 40
            18:17:43.332661 IP 192.168.50.1 > 192.168.50.100: ICMP echo reply, id 1, seq 116, length 40
            18:17:44.345138 IP 192.168.50.100 > 192.168.50.1: ICMP echo request, id 1, seq 117, length 40
            18:17:44.345153 IP 192.168.50.1 > 192.168.50.100: ICMP echo reply, id 1, seq 117, length 40

            ISP:
            18:17:53.333221 IP 192.168.50.100 > 192.168.1.1: ICMP echo request, id 1, seq 118, length 40
            18:17:53.333890 IP 192.168.1.1 > 192.168.50.100: ICMP echo reply, id 1, seq 118, length 40
            18:17:54.346585 IP 192.168.50.100 > 192.168.1.1: ICMP echo request, id 1, seq 119, length 40
            18:17:54.347073 IP 192.168.1.1 > 192.168.50.100: ICMP echo reply, id 1, seq 119, length 40
            18:17:55.362542 IP 192.168.50.100 > 192.168.1.1: ICMP echo request, id 1, seq 120, length 40
            18:17:55.363027 IP 192.168.1.1 > 192.168.50.100: ICMP echo reply, id 1, seq 120, length 40
            18:17:56.375135 IP 192.168.50.100 > 192.168.1.1: ICMP echo request, id 1, seq 121, length 40
            18:17:56.375467 IP 192.168.1.1 > 192.168.50.100: ICMP echo reply, id 1, seq 121, length 40

            Google:
            18:18:28.443341 IP 192.168.50.100 > 142.250.187.195: ICMP echo request, id 1, seq 126, length 40
            18:18:28.445510 IP 142.250.187.195 > 192.168.50.100: ICMP echo reply, id 1, seq 126, length 40
            18:18:29.459627 IP 192.168.50.100 > 142.250.187.195: ICMP echo request, id 1, seq 127, length 40
            18:18:29.461912 IP 142.250.187.195 > 192.168.50.100: ICMP echo reply, id 1, seq 127, length 40
            18:18:30.478792 IP 192.168.50.100 > 142.250.187.195: ICMP echo request, id 1, seq 128, length 40
            18:18:30.481679 IP 142.250.187.195 > 192.168.50.100: ICMP echo reply, id 1, seq 128, length 40
            18:18:31.498252 IP 192.168.50.100 > 142.250.187.195: ICMP echo request, id 1, seq 129, length 40
            18:18:31.501290 IP 142.250.187.195 > 192.168.50.100: ICMP echo reply, id 1, seq 129, length 40
            18:20:27.374903 IP 192.168.50.100 > 192.168.50.1: ICMP 192.168.50.100 udp port 52048 unreachable, length 286

            S 1 Reply Last reply Reply Quote 0
            • S
              sutha @sutha
              last edited by sutha

              @sutha These all ping belongs to lan1 port, even if I try to ping another pc on the same network. I'll get a ping result on command prompt but nothing will be captured.
              Lan2 port got nothing captured.

              johnpozJ 1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                If you are trying to ping something on LAN2 from 192.168.50.100 and it doesn't appear in that capture then the client is not sending it to the gateway.

                It would only do that if it has a bad route to that subnet. So if it has the wrong subnet mask. Or if it is still dual homed with a second IP in that subnet.

                What error is shown on on the host when it fails?

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @sutha
                  last edited by

                  @sutha So sniffing on the lan interface, this is where the 192.168.50.x box is and pfsense is IP is 192.168.50.1 and you ping 192.168.60.50 and you get nothing?

                  Lets see the output of your ipconfig /all

                  You sure you turned off this boxes 192.168.60 interface you said it had, or did you just remove the gateway from the interface?

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                  S 1 Reply Last reply Reply Quote 0
                  • S
                    sutha @johnpoz
                    last edited by

                    @johnpoz Sorry for the late reply. I'll try to disable my tunnel tomorrow and let you know the outcome.

                    johnpozJ 1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @sutha
                      last edited by

                      @sutha said in Unable to connect between lan1 and lan2:

                      I'll try to disable my tunnel tomorrow

                      tunnel? No freaking wonder your not seeing anything.. Its going out your vpn.. uggghhhh - you have wasted everyones time not stating that in post 1..

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                      S 1 Reply Last reply Reply Quote 0
                      • S
                        sutha @johnpoz
                        last edited by

                        @johnpoz Actually, that's not true. When I trace the ping, only the tunnel IP goes through the tunnel. Everything else showing the local system ip with the message unreachable.

                        johnpozJ 1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @sutha
                          last edited by johnpoz

                          @sutha dude turn off your vpn client on this box and your issues will go away!!

                          A vpn client will route traffic not set to the local network out the vpn.. So yeah trying to go to 192.168.60 vs 192.168.50 will go your vpn client tunnel... Pfsense can not route traffic its never seeing.. Ie your sniff on your lan not showing any traffic when trying to go to 192.168.60 because its being routed out your tunnel

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                          S 1 Reply Last reply Reply Quote 0
                          • S
                            sutha @johnpoz
                            last edited by

                            @johnpoz Does this mean I'm unable to create another interface for my local system as I was planning now?

                            My scenario:

                            A tunnel exists: site-to-site VPN connection.

                            I'd like to have another area for locally separated traffic. I don't want, as I mentioned earlier, Area 2 to communicate with Area 1, but I have users in Area 1 who need to access Area 2.

                            Do you think this is possible?

                            johnpozJ 1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @sutha
                              last edited by

                              @sutha if you want a site to site tunnel - create that on pfsense..

                              Yes you can filter traffic that pfsense routes.. If you want client X to be able to get to vlan Y, you can allow that, if you want client A not to go to vlan Y from vlan X you can block them..

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                              S 1 Reply Last reply Reply Quote 0
                              • S
                                sutha @johnpoz
                                last edited by

                                @johnpoz Yes, that's what I'm looking for. Currently, I have disabled two of the rules, and after reboot, my system suddenly went offline. I need to go to my office to see what happened. Once I have my system back online, I can provide you with some more details.

                                S 1 Reply Last reply Reply Quote 0
                                • S
                                  sutha @sutha
                                  last edited by

                                  @sutha So, now I have removed all the rules and disabled the tunnel as well. I've also removed the lan1 and lan2 rules. Currently, I have no internet access and no connectivity to any system. Since I have no internet, I enabled an 'any' rule on lan1, and now I can see there is internet access for lan1 PCs. However, I still have no internet access on lan2. Therefore, I repeated the same steps I took for lan1 on lan2, and now I have internet access on both interfaces.

                                  I'm now able to ping from 192.168.50.100 to 192.168.50.1, and when I enter this IP:192.168.50.1 in my browser, it took me to the pfSense web configurator. However, when I attempted to ping a pc on lan2, it failed. I moved to over to lan2 pc and did the ping to an ip 192.168.60.1 and it was successful. Furthermore, I tried to access the pfSense web configurator from lan2 using the IP 192.168.60.1, and it successfully redirected me to the web configurator.

                                  At this point, I don't have any rules other than these two. Anyone got any idea what is blocking here, I have disabled my windows own firewall tatally on both system.

                                  S johnpozJ 2 Replies Last reply Reply Quote 0
                                  • S
                                    SteveITS Galactic Empire @sutha
                                    last edited by

                                    @sutha Realistically there’s only a handful of things it can be:

                                    • Incorrect subnet mask on pfSense or PC
                                    • Incorrect gateway on either PC
                                    • firewall on either PC
                                    • firewall rule on pfSense

                                    If it was a VLAN, VLAN/switch config.

                                    Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                                    When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                                    Upvote 👍 helpful posts!

                                    S 1 Reply Last reply Reply Quote 0
                                    • stephenw10S
                                      stephenw10 Netgate Administrator
                                      last edited by stephenw10

                                      It's almost certainly not a gateway problem since hosts on both LANs can reach the internet.

                                      It could be a subnet mask problem if hosts are configured statically. If they use DHCP it probably isn't since you cannot configure conflicting subnets in pfSense.

                                      If any hosts still have two NICs or additional IPs in both subnet they will be unable to connect to the other subnet.

                                      Try to ping 192.168.60.1 (the pfSense interface address) from a host in the 192.168.50.X subnet. If that works then routing and firewall rules are fine and it's almost certainly the hosts themselves blocking the traffic.

                                      S S 2 Replies Last reply Reply Quote 0
                                      • S
                                        SteveITS Galactic Empire @stephenw10
                                        last edited by

                                        @stephenw10 I was talking in general and wasn’t clear. Low on coffee. :)

                                        Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                                        When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                                        Upvote 👍 helpful posts!

                                        1 Reply Last reply Reply Quote 1
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator @sutha
                                          last edited by johnpoz

                                          @sutha said in Unable to connect between lan1 and lan2:

                                          . Anyone got any idea what is blocking here

                                          Now do the sniff.. When you ping a 60.x IP from a 50.x device.. Do you see the traffic get to pfsense?

                                          And like to see the output of ipconfig /all from a device.. This will validate your mask is no messed up. And for good measure output of route print..

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                          1 Reply Last reply Reply Quote 1
                                          • S
                                            sutha @SteveITS
                                            last edited by

                                            @SteveITS This is my network and interface setting.
                                            PC on Lan1:
                                            Lan-1_Pc_IP.png

                                            PC on Lan2:
                                            Lan-2_Pc_IP.png

                                            Interface Lan1:
                                            Lan1-interface.png
                                            Interface Lan2:
                                            Lan2-interface.png

                                            johnpozJ 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.