Unable to connect between lan1 and lan2
-
@sutha So, now I have removed all the rules and disabled the tunnel as well. I've also removed the lan1 and lan2 rules. Currently, I have no internet access and no connectivity to any system. Since I have no internet, I enabled an 'any' rule on lan1, and now I can see there is internet access for lan1 PCs. However, I still have no internet access on lan2. Therefore, I repeated the same steps I took for lan1 on lan2, and now I have internet access on both interfaces.
I'm now able to ping from 192.168.50.100 to 192.168.50.1, and when I enter this IP:192.168.50.1 in my browser, it took me to the pfSense web configurator. However, when I attempted to ping a pc on lan2, it failed. I moved to over to lan2 pc and did the ping to an ip 192.168.60.1 and it was successful. Furthermore, I tried to access the pfSense web configurator from lan2 using the IP 192.168.60.1, and it successfully redirected me to the web configurator.
At this point, I don't have any rules other than these two. Anyone got any idea what is blocking here, I have disabled my windows own firewall tatally on both system.
-
@sutha Realistically there’s only a handful of things it can be:
- Incorrect subnet mask on pfSense or PC
- Incorrect gateway on either PC
- firewall on either PC
- firewall rule on pfSense
If it was a VLAN, VLAN/switch config.
-
It's almost certainly not a gateway problem since hosts on both LANs can reach the internet.
It could be a subnet mask problem if hosts are configured statically. If they use DHCP it probably isn't since you cannot configure conflicting subnets in pfSense.
If any hosts still have two NICs or additional IPs in both subnet they will be unable to connect to the other subnet.
Try to ping 192.168.60.1 (the pfSense interface address) from a host in the 192.168.50.X subnet. If that works then routing and firewall rules are fine and it's almost certainly the hosts themselves blocking the traffic.
-
@stephenw10 I was talking in general and wasn’t clear. Low on coffee. :)
-
@sutha said in Unable to connect between lan1 and lan2:
. Anyone got any idea what is blocking here
Now do the sniff.. When you ping a 60.x IP from a 50.x device.. Do you see the traffic get to pfsense?
And like to see the output of ipconfig /all from a device.. This will validate your mask is no messed up. And for good measure output of route print..
-
@SteveITS This is my network and interface setting.
PC on Lan1:
PC on Lan2:
Interface Lan1:
Interface Lan2:
-
@stephenw10 I'm able to ping from lan1 IP:192.168.50.100 to lan2 ip: 192.168.60.1 and from lan2 ip: 192.168.60.50 to lan1 ip:192.168.50.1.
Works fine, but I'm unable to ping any other local pc. Example:
from 192.168.50.100 to 192.168.60.50, not working.
from 192.168.60.50 to 192.168.50.100, not working as well. -
@sutha And you could have 14 other interfaces.. On this machine and 3 different vpn interfaces.. How about a simple ipconfig /all output and a route print..
$ ipconfig /all Windows IP Configuration Host Name . . . . . . . . . . . . : i9-win Primary Dns Suffix . . . . . . . : home.arpa Node Type . . . . . . . . . . . . : Broadcast IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No DNS Suffix Search List. . . . . . : home.arpa Ethernet adapter Local: Connection-specific DNS Suffix . : home.arpa Description . . . . . . . . . . . : Killer E2600 Gigabit Ethernet Controller Physical Address. . . . . . . . . : B0-4F-13-0B-FD-16 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes IPv4 Address. . . . . . . . . . . : 192.168.9.100(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Lease Obtained. . . . . . . . . . : Friday, March 15, 2024 11:21:05 PM Lease Expires . . . . . . . . . . : Thursday, March 21, 2024 11:21:05 PM Default Gateway . . . . . . . . . : 192.168.9.253 DHCP Server . . . . . . . . . . . : 192.168.9.253 DNS Servers . . . . . . . . . . . : 192.168.3.10 NetBIOS over Tcpip. . . . . . . . : Enabled Ethernet adapter Nas-San: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Realtek USB 2.5GbE Family Controller Physical Address. . . . . . . . . : A0-CE-C8-CC-57-DE DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes IPv4 Address. . . . . . . . . . . : 192.168.10.9(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : NetBIOS over Tcpip. . . . . . . . : Disabled Ethernet adapter vEthernet (WSL): Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Hyper-V Virtual Ethernet Adapter Physical Address. . . . . . . . . : 00-15-5D-2F-73-DB DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes Link-local IPv6 Address . . . . . : fe80::41b8:afee:a2a0:27e2%25(Preferred) IPv4 Address. . . . . . . . . . . : 172.29.64.1(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.240.0 Default Gateway . . . . . . . . . : DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1 fec0:0:0:ffff::2%1 fec0:0:0:ffff::3%1 NetBIOS over Tcpip. . . . . . . . : Enabled$ route print =========================================================================== Interface List 15...b0 4f 13 0b fd 16 ......Killer E2600 Gigabit Ethernet Controller 1...........................Software Loopback Interface 1 7...a0 ce c8 cc 57 de ......Realtek USB 2.5GbE Family Controller 25...00 15 5d 2f 73 db ......Hyper-V Virtual Ethernet Adapter =========================================================================== IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 192.168.9.253 192.168.9.100 40 127.0.0.0 255.0.0.0 On-link 127.0.0.1 331 127.0.0.1 255.255.255.255 On-link 127.0.0.1 331 127.255.255.255 255.255.255.255 On-link 127.0.0.1 331 172.29.64.0 255.255.240.0 On-link 172.29.64.1 5256 172.29.64.1 255.255.255.255 On-link 172.29.64.1 5256 172.29.79.255 255.255.255.255 On-link 172.29.64.1 5256 192.168.9.0 255.255.255.0 On-link 192.168.9.100 276 192.168.9.100 255.255.255.255 On-link 192.168.9.100 276 192.168.9.255 255.255.255.255 On-link 192.168.9.100 276 192.168.10.0 255.255.255.0 On-link 192.168.10.9 556 192.168.10.9 255.255.255.255 On-link 192.168.10.9 556 192.168.10.255 255.255.255.255 On-link 192.168.10.9 556 224.0.0.0 240.0.0.0 On-link 127.0.0.1 331 224.0.0.0 240.0.0.0 On-link 192.168.9.100 276 224.0.0.0 240.0.0.0 On-link 192.168.10.9 556 224.0.0.0 240.0.0.0 On-link 172.29.64.1 5256 255.255.255.255 255.255.255.255 On-link 127.0.0.1 331 255.255.255.255 255.255.255.255 On-link 192.168.9.100 276 255.255.255.255 255.255.255.255 On-link 192.168.10.9 556 255.255.255.255 255.255.255.255 On-link 172.29.64.1 5256 =========================================================================== Persistent Routes: NoneHow about the 30 seconds it takes to do a packet capture? To validate traffic is actually going to pfsense and not some vpn tunnel you have that failed to mention..
-
@sutha said in Unable to connect between lan1 and lan2:
Works fine, but I'm unable to ping any other local pc. Example:
If you can ping pfsense 192.168.60.1 from your 50.x device but not some other 60.x this SCREAMS!!!! firewall on the 60.x device..
Again simple packet captures that take all of 30 seconds will finally prove to you its your device and not pfsense..
-
Yup that^. Almost certainly a local firewall on the device you're trying to ping blocking it.
-
@johnpoz This is my ipconfig/all setting:
-
@stephenw10 This is my windows firewall setting, I don't have any other firewall setting between pfsense and my sysstem.
-
@johnpoz All I can see in the packet capture, when Isent a ping to 192.168.50.1 or 192.168.60.1.
I get a reply from the destination, but when I ping a local pc: 192.168.50.100 or 192.168.60.50.
I get no reply from other side. -
Need to see the complete output from 'ipconfig /all', all interfaces.
-
@sutha said in Unable to connect between lan1 and lan2:
but when I ping a local pc: 192.168.50.100 or 192.168.60.50.
I get no reply from other side.But you do the see the ping request in the pcap?
-
@sutha said in Unable to connect between lan1 and lan2:
I get no reply from other side.
But you see the request go out to 60.50 from from pfsense 60 interface? Or do you not even see the request come in from the 50.x device to pfsense 50 interface like you were seeing before when you had the tunnel?
If you see pfsense send on the ping request to 60.50 and you get no answer that is not pfsense problem.. If you do not even see the ping request come into the 50 interface of pfsense interface - again not pfsense issue. Pfsense can not route traffic it never sees.
Where we would need to look at pfsense for something is if you see the ping request come in on its 50 interface, but you don't see it sending anything out the 60 interface..
why is this showing your connected to 2 networks.. But your ipconfig /all that I ask for you only show 1 network
The output of route print would be most helpful here.
edit: I turned on my wifi to check if it might show that even if disconnected like your snipped output shows. It doesn't so from what you posted I would assume you have some other connection on this box.. That you didn't include in the ipconfig /all output, and we would of seen as well in the route print which you didn't post?
btw public would block ping that is for sure.. Put your interface in private, even if your going to turn off the firewall.. windows firewall has been known to be flacky... But the output of your pcap would tell us right away where the problem is - pfsense is either not seeing it at all, or pfsense is sending it on and the box being sent to is not answering.
-
@johnpoz Currently, I'm unable to provide you with the complete ping test results. While I was conducting the test, the LAN2 PC suddenly went offline. I won't be able to fix it until tomorrow. Here are the results from LAN1 and partial test results from LAN2.
SUCCESS:FROM 192.168.50.100 TO 192.168.50.1
19:20:27.895657 IP 192.168.50.100 > 192.168.50.1: ICMP echo request, id 1, seq 372, length 40
19:20:27.895683 IP 192.168.50.1 > 192.168.50.100: ICMP echo reply, id 1, seq 372, length 40
19:20:28.900444 IP 192.168.50.100 > 192.168.50.1: ICMP echo request, id 1, seq 373, length 40
19:20:28.900460 IP 192.168.50.1 > 192.168.50.100: ICMP echo reply, id 1, seq 373, length 40
19:20:29.912394 IP 192.168.50.100 > 192.168.50.1: ICMP echo request, id 1, seq 374, length 40
19:20:29.912403 IP 192.168.50.1 > 192.168.50.100: ICMP echo reply, id 1, seq 374, length 40
19:20:30.926227 IP 192.168.50.100 > 192.168.50.1: ICMP echo request, id 1, seq 375, length 40
19:20:30.926236 IP 192.168.50.1 > 192.168.50.100: ICMP echo reply, id 1, seq 375, length 40SUCCESS:FROM 192.168.50.100 TO 192.168.60.1
19:20:41.101865 IP 192.168.50.100 > 192.168.25.1: ICMP echo request, id 1, seq 376, length 40
19:20:41.101895 IP 192.168.25.1 > 192.168.50.100: ICMP echo reply, id 1, seq 376, length 40
19:20:42.114214 IP 192.168.50.100 > 192.168.25.1: ICMP echo request, id 1, seq 377, length 40
19:20:42.114230 IP 192.168.25.1 > 192.168.50.100: ICMP echo reply, id 1, seq 377, length 40
19:20:43.125485 IP 192.168.50.100 > 192.168.25.1: ICMP echo request, id 1, seq 378, length 40
19:20:43.125502 IP 192.168.25.1 > 192.168.50.100: ICMP echo reply, id 1, seq 378, length 40
19:20:44.135603 IP 192.168.50.100 > 192.168.25.1: ICMP echo request, id 1, seq 379, length 40
19:20:44.135617 IP 192.168.25.1 > 192.168.50.100: ICMP echo reply, id 1, seq 379, length 40FAILED:FROM 192.168.50.100 TO 192.168.60.50
19:27:39.002010 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 380, length 40
19:27:43.977069 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 381, length 40
19:27:48.961347 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 382, length 40
19:27:53.959670 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 383, length 40SUCCESS:FROM 192.168.60.50 TO 192.168.60.1
19:33:24.608437 IP 192.168.60.50 > 192.168.60.1: ICMP echo request, id 1, seq 142, length 40
19:33:24.608474 IP 192.168.60.1 > 192.168.60.50: ICMP echo reply, id 1, seq 142, length 40
19:33:25.624431 IP 192.168.60.50 > 192.168.60.1: ICMP echo request, id 1, seq 143, length 40
19:33:25.624450 IP 192.168.60.1 > 192.168.60.50: ICMP echo reply, id 1, seq 143, length 40
19:33:26.647458 IP 192.168.60.50 > 192.168.60.1: ICMP echo request, id 1, seq 144, length 40
19:33:26.647486 IP 192.168.60.1 > 192.168.60.50: ICMP echo reply, id 1, seq 144, length 40
19:33:27.662241 IP 192.168.60.50 > 192.168.60.1: ICMP echo request, id 1, seq 145, length 40
19:33:27.662258 IP 192.168.60.1 > 192.168.60.50: ICMP echo reply, id 1, seq 145, length 40
My pc went offline,
The reason for showing network2 is see this image:
I'll update rest of the test tomorrow. -
@stephenw10 This is my Lan1 ipconfig/all.
Windows IP Configuration
Host Name . . . . . . . . . . . . : DESKTOP-QBMK4M9
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : NoEthernet adapter Ethernet:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) Ethernet Connection (5) I219-LM
Physical Address. . . . . . . . . : AC-E2-D3-10-DB-8C
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::3968:80d2:4d5:9bb0%2(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.50.100(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.50.1
DHCPv6 IAID . . . . . . . . . . . : 44884038
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-23-14-88-BC-5C-E2-D3-10-D8-8C
DNS Servers . . . . . . . . . . . : 9.9.9.9
8.8.8.8
NetBIOS over Tcpip. . . . . . . . : EnabledWireless LAN adapter Local Area Connection* 1:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter
Physical Address. . . . . . . . . : xx.xx.xx.xx.xx.10
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : YesWireless LAN adapter Local Area Connection* 10:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter #2
Physical Address. . . . . . . . . : xx.xx.xx.xx.xx.11
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : YesEthernet adapter Bluetooth Network Connection:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network)
Physical Address. . . . . . . . . : xx.xx.xx.xx.xx.12
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : YesWireless LAN adapter WiFi:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : communityfibre.co.uk
Description . . . . . . . . . . . : Intel(R) Dual Band Wireless-AC 8265
Physical Address. . . . . . . . . : xx.xx.xx.xx.xx.13
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes -
@sutha said in Unable to connect between lan1 and lan2:
FAILED:FROM 192.168.50.100 TO 192.168.60.50
19:27:39.002010 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 380, length 40
19:27:43.977069 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 381, length 40OK, that all looks good. Was that capture run on the LAN1 interface?
Run the same ping test but capture on LAN2 and make sure you see the same traffic there so you know the pings are leaving LAN2 as expected.
If that is the case the problem is almost certainly that the host at 192.168.60.50 is blocking that ping because it's coming from outside it's subnet. What is that host?
-
where did you sniff this
FAILED:FROM 192.168.50.100 TO 192.168.60.50 19:27:39.002010 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 380, length 40 19:27:43.977069 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 381, length 40 19:27:48.961347 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 382, length 40 19:27:53.959670 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 383, length 40On the 50 interface of pfsense or the 60? If on the 60.. That right there is PROOF! that your device at 60.50 is just not answering..
