Unable to connect between lan1 and lan2

johnpoz

@sutha said in Unable to connect between lan1 and lan2:

Works fine, but I'm unable to ping any other local pc. Example:

If you can ping pfsense 192.168.60.1 from your 50.x device but not some other 60.x this SCREAMS!!!! firewall on the 60.x device..

Again simple packet captures that take all of 30 seconds will finally prove to you its your device and not pfsense..

stephenw10

Yup that^. Almost certainly a local firewall on the device you're trying to ping blocking it.

sutha

@johnpoz This is my ipconfig/all setting:

sutha

@stephenw10 This is my windows firewall setting, I don't have any other firewall setting between pfsense and my sysstem.

sutha

@johnpoz All I can see in the packet capture, when Isent a ping to 192.168.50.1 or 192.168.60.1.
I get a reply from the destination, but when I ping a local pc: 192.168.50.100 or 192.168.60.50.
I get no reply from other side.

stephenw10

Need to see the complete output from 'ipconfig /all', all interfaces.

stephenw10

@sutha said in Unable to connect between lan1 and lan2:

but when I ping a local pc: 192.168.50.100 or 192.168.60.50.
I get no reply from other side.

But you do the see the ping request in the pcap?

johnpoz

@sutha said in Unable to connect between lan1 and lan2:

I get no reply from other side.

But you see the request go out to 60.50 from from pfsense 60 interface? Or do you not even see the request come in from the 50.x device to pfsense 50 interface like you were seeing before when you had the tunnel?

If you see pfsense send on the ping request to 60.50 and you get no answer that is not pfsense problem.. If you do not even see the ping request come into the 50 interface of pfsense interface - again not pfsense issue. Pfsense can not route traffic it never sees.

Where we would need to look at pfsense for something is if you see the ping request come in on its 50 interface, but you don't see it sending anything out the 60 interface..

why is this showing your connected to 2 networks.. But your ipconfig /all that I ask for you only show 1 network

The output of route print would be most helpful here.

edit: I turned on my wifi to check if it might show that even if disconnected like your snipped output shows. It doesn't so from what you posted I would assume you have some other connection on this box.. That you didn't include in the ipconfig /all output, and we would of seen as well in the route print which you didn't post?

btw public would block ping that is for sure.. Put your interface in private, even if your going to turn off the firewall.. windows firewall has been known to be flacky... But the output of your pcap would tell us right away where the problem is - pfsense is either not seeing it at all, or pfsense is sending it on and the box being sent to is not answering.

sutha

@johnpoz Currently, I'm unable to provide you with the complete ping test results. While I was conducting the test, the LAN2 PC suddenly went offline. I won't be able to fix it until tomorrow. Here are the results from LAN1 and partial test results from LAN2.

SUCCESS:FROM 192.168.50.100 TO 192.168.50.1
19:20:27.895657 IP 192.168.50.100 > 192.168.50.1: ICMP echo request, id 1, seq 372, length 40
19:20:27.895683 IP 192.168.50.1 > 192.168.50.100: ICMP echo reply, id 1, seq 372, length 40
19:20:28.900444 IP 192.168.50.100 > 192.168.50.1: ICMP echo request, id 1, seq 373, length 40
19:20:28.900460 IP 192.168.50.1 > 192.168.50.100: ICMP echo reply, id 1, seq 373, length 40
19:20:29.912394 IP 192.168.50.100 > 192.168.50.1: ICMP echo request, id 1, seq 374, length 40
19:20:29.912403 IP 192.168.50.1 > 192.168.50.100: ICMP echo reply, id 1, seq 374, length 40
19:20:30.926227 IP 192.168.50.100 > 192.168.50.1: ICMP echo request, id 1, seq 375, length 40
19:20:30.926236 IP 192.168.50.1 > 192.168.50.100: ICMP echo reply, id 1, seq 375, length 40

SUCCESS:FROM 192.168.50.100 TO 192.168.60.1
19:20:41.101865 IP 192.168.50.100 > 192.168.25.1: ICMP echo request, id 1, seq 376, length 40
19:20:41.101895 IP 192.168.25.1 > 192.168.50.100: ICMP echo reply, id 1, seq 376, length 40
19:20:42.114214 IP 192.168.50.100 > 192.168.25.1: ICMP echo request, id 1, seq 377, length 40
19:20:42.114230 IP 192.168.25.1 > 192.168.50.100: ICMP echo reply, id 1, seq 377, length 40
19:20:43.125485 IP 192.168.50.100 > 192.168.25.1: ICMP echo request, id 1, seq 378, length 40
19:20:43.125502 IP 192.168.25.1 > 192.168.50.100: ICMP echo reply, id 1, seq 378, length 40
19:20:44.135603 IP 192.168.50.100 > 192.168.25.1: ICMP echo request, id 1, seq 379, length 40
19:20:44.135617 IP 192.168.25.1 > 192.168.50.100: ICMP echo reply, id 1, seq 379, length 40

FAILED:FROM 192.168.50.100 TO 192.168.60.50
19:27:39.002010 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 380, length 40
19:27:43.977069 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 381, length 40
19:27:48.961347 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 382, length 40
19:27:53.959670 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 383, length 40

SUCCESS:FROM 192.168.60.50 TO 192.168.60.1
19:33:24.608437 IP 192.168.60.50 > 192.168.60.1: ICMP echo request, id 1, seq 142, length 40
19:33:24.608474 IP 192.168.60.1 > 192.168.60.50: ICMP echo reply, id 1, seq 142, length 40
19:33:25.624431 IP 192.168.60.50 > 192.168.60.1: ICMP echo request, id 1, seq 143, length 40
19:33:25.624450 IP 192.168.60.1 > 192.168.60.50: ICMP echo reply, id 1, seq 143, length 40
19:33:26.647458 IP 192.168.60.50 > 192.168.60.1: ICMP echo request, id 1, seq 144, length 40
19:33:26.647486 IP 192.168.60.1 > 192.168.60.50: ICMP echo reply, id 1, seq 144, length 40
19:33:27.662241 IP 192.168.60.50 > 192.168.60.1: ICMP echo request, id 1, seq 145, length 40
19:33:27.662258 IP 192.168.60.1 > 192.168.60.50: ICMP echo reply, id 1, seq 145, length 40
My pc went offline,
The reason for showing network2 is see this image:
adapter setting.png
I'll update rest of the test tomorrow.

sutha

@stephenw10 This is my Lan1 ipconfig/all.

Windows IP Configuration

Host Name . . . . . . . . . . . . : DESKTOP-QBMK4M9
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Ethernet:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) Ethernet Connection (5) I219-LM
Physical Address. . . . . . . . . : AC-E2-D3-10-DB-8C
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::3968:80d2:4d5:9bb0%2(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.50.100(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.50.1
DHCPv6 IAID . . . . . . . . . . . : 44884038
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-23-14-88-BC-5C-E2-D3-10-D8-8C
DNS Servers . . . . . . . . . . . : 9.9.9.9
8.8.8.8
NetBIOS over Tcpip. . . . . . . . : Enabled

Wireless LAN adapter Local Area Connection* 1:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter
Physical Address. . . . . . . . . : xx.xx.xx.xx.xx.10
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Local Area Connection* 10:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter #2
Physical Address. . . . . . . . . : xx.xx.xx.xx.xx.11
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Bluetooth Network Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network)
Physical Address. . . . . . . . . : xx.xx.xx.xx.xx.12
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter WiFi:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : communityfibre.co.uk
Description . . . . . . . . . . . : Intel(R) Dual Band Wireless-AC 8265
Physical Address. . . . . . . . . : xx.xx.xx.xx.xx.13
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

stephenw10

@sutha said in Unable to connect between lan1 and lan2:

FAILED:FROM 192.168.50.100 TO 192.168.60.50
19:27:39.002010 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 380, length 40
19:27:43.977069 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 381, length 40

OK, that all looks good. Was that capture run on the LAN1 interface?

Run the same ping test but capture on LAN2 and make sure you see the same traffic there so you know the pings are leaving LAN2 as expected.

If that is the case the problem is almost certainly that the host at 192.168.60.50 is blocking that ping because it's coming from outside it's subnet. What is that host?

johnpoz

where did you sniff this

FAILED:FROM 192.168.50.100 TO 192.168.60.50
19:27:39.002010 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 380, length 40
19:27:43.977069 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 381, length 40
19:27:48.961347 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 382, length 40
19:27:53.959670 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 383, length 40

On the 50 interface of pfsense or the 60? If on the 60.. That right there is PROOF! that your device at 60.50 is just not answering..

sutha

@johnpoz 60.50 went offline. This system is on lan2 and I can’t access now. I’ll try tomorrow.

stephenw10

Any host on the 192.168.60.X subnet would be the same except the pfSense interface at .1 itself.

johnpoz

Yeah doesn't have to be 60.50 - you got nothing else on this vlan you can ping?

How about just answering the question on what interface you took that sniff? Starting to think we are just being trolled to be honest.. Going on 3 days something, that is a 30 second test.

sutha

@johnpoz actually, I’m using this as a test system therefore I didn’t take others remote access details.

johnpoz

@sutha What freaking interface did you take the sniff on where you showed 50.100 sending traffic to 60.50?

What does that have to do with "test" system..

This is really simple

Device A ----> (a) pfsense (b) ----> Device B

You sniffed where interface a or b of pfsense.. If a we know your client is sending the traffic trying to get to device b to pfsense.

If you sniffed on b you know that pfsense sent the traffic on to device B IP address. If you do not get an answer, that has zero to do with pfsense.. And again SCREAMS firewall on device B.

This test takes all of 30 seconds at most..

sutha

@johnpoz I have a switch on lan 1 and a switch on lan 2, on these switches I have pc‘s connected. I have a pc on both side for my own use, you can call as personal use, administrative or test use. I need these pc to access each side when something goes wrong like now. Because this is a new environment, I don’t have all remote access details now.

If I’m wrong correct me, for sniffing the packages you need to access the pfsense open the packet capture and switch between lan1 and lan2. Only the ping should be done from the pc, which is on lan1 and lan2. Those complete sniffing which I have sent is from lan 1, I couldn’t send you the sniffing from lan 2 because the pc went offline. I’ll do it half an hour .

johnpoz

@sutha dude your sniffing on pfsense interfaces..

Its as simple as changing the interface on pfsense. You do not need to take the sniff on the device.. Its right therein pfsense - you can select any of the pfsense interfaces.. You can access pfsense from anywhere.. Could even be in from the internet.. Anything that can access the pfsense gui..

Its all of 3 seconds to change the interface your capturing the data that is flowing in or out of pfsense... Yes the device in network B needs to be up so pfsense knows what mac to send to but when you took that sniff it would of been 3 more seconds to look at the traffic that was leaving B..

stephenw10

Yes if any other hosts exist on the 192.168.60.X subnet then you can try pinging them. If they are using DHCP you can those hosts in Status > DHCP and try to ping those IPs.

Even if the hosts don't respond you will still see the ping traffic in a capture on the .60 interface proving that pfSense is routing it as expected.