Unable to connect between lan1 and lan2

johnpoz

@sutha said in Unable to connect between lan1 and lan2:

I get no reply from other side.

But you see the request go out to 60.50 from from pfsense 60 interface? Or do you not even see the request come in from the 50.x device to pfsense 50 interface like you were seeing before when you had the tunnel?

If you see pfsense send on the ping request to 60.50 and you get no answer that is not pfsense problem.. If you do not even see the ping request come into the 50 interface of pfsense interface - again not pfsense issue. Pfsense can not route traffic it never sees.

Where we would need to look at pfsense for something is if you see the ping request come in on its 50 interface, but you don't see it sending anything out the 60 interface..

why is this showing your connected to 2 networks.. But your ipconfig /all that I ask for you only show 1 network

The output of route print would be most helpful here.

edit: I turned on my wifi to check if it might show that even if disconnected like your snipped output shows. It doesn't so from what you posted I would assume you have some other connection on this box.. That you didn't include in the ipconfig /all output, and we would of seen as well in the route print which you didn't post?

btw public would block ping that is for sure.. Put your interface in private, even if your going to turn off the firewall.. windows firewall has been known to be flacky... But the output of your pcap would tell us right away where the problem is - pfsense is either not seeing it at all, or pfsense is sending it on and the box being sent to is not answering.

sutha

@johnpoz Currently, I'm unable to provide you with the complete ping test results. While I was conducting the test, the LAN2 PC suddenly went offline. I won't be able to fix it until tomorrow. Here are the results from LAN1 and partial test results from LAN2.

SUCCESS:FROM 192.168.50.100 TO 192.168.50.1
19:20:27.895657 IP 192.168.50.100 > 192.168.50.1: ICMP echo request, id 1, seq 372, length 40
19:20:27.895683 IP 192.168.50.1 > 192.168.50.100: ICMP echo reply, id 1, seq 372, length 40
19:20:28.900444 IP 192.168.50.100 > 192.168.50.1: ICMP echo request, id 1, seq 373, length 40
19:20:28.900460 IP 192.168.50.1 > 192.168.50.100: ICMP echo reply, id 1, seq 373, length 40
19:20:29.912394 IP 192.168.50.100 > 192.168.50.1: ICMP echo request, id 1, seq 374, length 40
19:20:29.912403 IP 192.168.50.1 > 192.168.50.100: ICMP echo reply, id 1, seq 374, length 40
19:20:30.926227 IP 192.168.50.100 > 192.168.50.1: ICMP echo request, id 1, seq 375, length 40
19:20:30.926236 IP 192.168.50.1 > 192.168.50.100: ICMP echo reply, id 1, seq 375, length 40

SUCCESS:FROM 192.168.50.100 TO 192.168.60.1
19:20:41.101865 IP 192.168.50.100 > 192.168.25.1: ICMP echo request, id 1, seq 376, length 40
19:20:41.101895 IP 192.168.25.1 > 192.168.50.100: ICMP echo reply, id 1, seq 376, length 40
19:20:42.114214 IP 192.168.50.100 > 192.168.25.1: ICMP echo request, id 1, seq 377, length 40
19:20:42.114230 IP 192.168.25.1 > 192.168.50.100: ICMP echo reply, id 1, seq 377, length 40
19:20:43.125485 IP 192.168.50.100 > 192.168.25.1: ICMP echo request, id 1, seq 378, length 40
19:20:43.125502 IP 192.168.25.1 > 192.168.50.100: ICMP echo reply, id 1, seq 378, length 40
19:20:44.135603 IP 192.168.50.100 > 192.168.25.1: ICMP echo request, id 1, seq 379, length 40
19:20:44.135617 IP 192.168.25.1 > 192.168.50.100: ICMP echo reply, id 1, seq 379, length 40

FAILED:FROM 192.168.50.100 TO 192.168.60.50
19:27:39.002010 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 380, length 40
19:27:43.977069 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 381, length 40
19:27:48.961347 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 382, length 40
19:27:53.959670 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 383, length 40

SUCCESS:FROM 192.168.60.50 TO 192.168.60.1
19:33:24.608437 IP 192.168.60.50 > 192.168.60.1: ICMP echo request, id 1, seq 142, length 40
19:33:24.608474 IP 192.168.60.1 > 192.168.60.50: ICMP echo reply, id 1, seq 142, length 40
19:33:25.624431 IP 192.168.60.50 > 192.168.60.1: ICMP echo request, id 1, seq 143, length 40
19:33:25.624450 IP 192.168.60.1 > 192.168.60.50: ICMP echo reply, id 1, seq 143, length 40
19:33:26.647458 IP 192.168.60.50 > 192.168.60.1: ICMP echo request, id 1, seq 144, length 40
19:33:26.647486 IP 192.168.60.1 > 192.168.60.50: ICMP echo reply, id 1, seq 144, length 40
19:33:27.662241 IP 192.168.60.50 > 192.168.60.1: ICMP echo request, id 1, seq 145, length 40
19:33:27.662258 IP 192.168.60.1 > 192.168.60.50: ICMP echo reply, id 1, seq 145, length 40
My pc went offline,
The reason for showing network2 is see this image:
adapter setting.png
I'll update rest of the test tomorrow.

sutha

@stephenw10 This is my Lan1 ipconfig/all.

Windows IP Configuration

Host Name . . . . . . . . . . . . : DESKTOP-QBMK4M9
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Ethernet:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) Ethernet Connection (5) I219-LM
Physical Address. . . . . . . . . : AC-E2-D3-10-DB-8C
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::3968:80d2:4d5:9bb0%2(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.50.100(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.50.1
DHCPv6 IAID . . . . . . . . . . . : 44884038
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-23-14-88-BC-5C-E2-D3-10-D8-8C
DNS Servers . . . . . . . . . . . : 9.9.9.9
8.8.8.8
NetBIOS over Tcpip. . . . . . . . : Enabled

Wireless LAN adapter Local Area Connection* 1:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter
Physical Address. . . . . . . . . : xx.xx.xx.xx.xx.10
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Local Area Connection* 10:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter #2
Physical Address. . . . . . . . . : xx.xx.xx.xx.xx.11
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Bluetooth Network Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network)
Physical Address. . . . . . . . . : xx.xx.xx.xx.xx.12
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter WiFi:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : communityfibre.co.uk
Description . . . . . . . . . . . : Intel(R) Dual Band Wireless-AC 8265
Physical Address. . . . . . . . . : xx.xx.xx.xx.xx.13
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

stephenw10

@sutha said in Unable to connect between lan1 and lan2:

FAILED:FROM 192.168.50.100 TO 192.168.60.50
19:27:39.002010 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 380, length 40
19:27:43.977069 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 381, length 40

OK, that all looks good. Was that capture run on the LAN1 interface?

Run the same ping test but capture on LAN2 and make sure you see the same traffic there so you know the pings are leaving LAN2 as expected.

If that is the case the problem is almost certainly that the host at 192.168.60.50 is blocking that ping because it's coming from outside it's subnet. What is that host?

johnpoz

where did you sniff this

FAILED:FROM 192.168.50.100 TO 192.168.60.50
19:27:39.002010 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 380, length 40
19:27:43.977069 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 381, length 40
19:27:48.961347 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 382, length 40
19:27:53.959670 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 383, length 40

On the 50 interface of pfsense or the 60? If on the 60.. That right there is PROOF! that your device at 60.50 is just not answering..

sutha

@johnpoz 60.50 went offline. This system is on lan2 and I can’t access now. I’ll try tomorrow.

stephenw10

Any host on the 192.168.60.X subnet would be the same except the pfSense interface at .1 itself.

johnpoz

Yeah doesn't have to be 60.50 - you got nothing else on this vlan you can ping?

How about just answering the question on what interface you took that sniff? Starting to think we are just being trolled to be honest.. Going on 3 days something, that is a 30 second test.

sutha

@johnpoz actually, I’m using this as a test system therefore I didn’t take others remote access details.

johnpoz

@sutha What freaking interface did you take the sniff on where you showed 50.100 sending traffic to 60.50?

What does that have to do with "test" system..

This is really simple

Device A ----> (a) pfsense (b) ----> Device B

You sniffed where interface a or b of pfsense.. If a we know your client is sending the traffic trying to get to device b to pfsense.

If you sniffed on b you know that pfsense sent the traffic on to device B IP address. If you do not get an answer, that has zero to do with pfsense.. And again SCREAMS firewall on device B.

This test takes all of 30 seconds at most..

sutha

@johnpoz I have a switch on lan 1 and a switch on lan 2, on these switches I have pc‘s connected. I have a pc on both side for my own use, you can call as personal use, administrative or test use. I need these pc to access each side when something goes wrong like now. Because this is a new environment, I don’t have all remote access details now.

If I’m wrong correct me, for sniffing the packages you need to access the pfsense open the packet capture and switch between lan1 and lan2. Only the ping should be done from the pc, which is on lan1 and lan2. Those complete sniffing which I have sent is from lan 1, I couldn’t send you the sniffing from lan 2 because the pc went offline. I’ll do it half an hour .

johnpoz

@sutha dude your sniffing on pfsense interfaces..

Its as simple as changing the interface on pfsense. You do not need to take the sniff on the device.. Its right therein pfsense - you can select any of the pfsense interfaces.. You can access pfsense from anywhere.. Could even be in from the internet.. Anything that can access the pfsense gui..

Its all of 3 seconds to change the interface your capturing the data that is flowing in or out of pfsense... Yes the device in network B needs to be up so pfsense knows what mac to send to but when you took that sniff it would of been 3 more seconds to look at the traffic that was leaving B..

stephenw10

Yes if any other hosts exist on the 192.168.60.X subnet then you can try pinging them. If they are using DHCP you can those hosts in Status > DHCP and try to ping those IPs.

Even if the hosts don't respond you will still see the ping traffic in a capture on the .60 interface proving that pfSense is routing it as expected.

sutha

@stephenw10
First of all, I would like to thank everyone who helped to succeed with my connection.
The problem was in two places: the firewall and an IP. I disabled the Windows firewall, but even if you disable the firewall, you have to enable the "Echo-request-ICMPv4" in the firewall inbound rule under advanced settings. The second problem resided with the IP, I had set up an additional IP and forgot to remove it.
While capturing the pings independently, I found as you guys said, that something is blocking on this machine. I tried to enable the echo request even though the firewall is off, and I'm still facing the same issue. Finally, I put the IP in auto setting and it suddenly started to working. Then I realized the additional IP was causing the problem.
I have enabled my tunnel and the rules one by one, it's working fine.

stephenw10

Ah, sounds like you hit the common issues there then.

sutha

@stephenw10
Thanks again !
I don't understand how pfSense is handling the traffic between two interfaces without a unique IP. I thought I needed a unique IP, which is why I added the second IP on my machine (192.168.60.50). Now I have removed the ip on all devices.

stephenw10

That's how IP routing works. Both hosts do not have a direct route to the other subnet so they send traffic via their default route/gateway which is the pfSense interface. pfSense has an interface in both subnets so it knows how to reach them, it has a route. So when traffic comes in with a destination of the other subnet it routes it correctly out of the other interface.

johnpoz

@sutha said in Unable to connect between lan1 and lan2:

handling the traffic between two interfaces without a unique IP.

You don't seem to grasp the basic concept of a router?? How do you think your soho router works - routes you to the internet? Does your client have an IP in every single network out on the internet?

sutha

@johnpoz Actually, I have seen many routers, but they are very complicated to set up. I have never set up a site-to-site VPN in a short period of time, but with pfSense, it was so easy, and many advanced and secure methods are available. That's why I like pfSense.
Anyway, Thanks again!