can't ping or reach host from same vlan, but can from other vlan

[johnpoz]

@Cloudless-Smart-Home do you have some wireless card in pfsense or is there an AP or wireless router being used.

devices on the same network don't talk to the gateway (pfsense) to talk to each other.

[Cloudless Smart Home]

@johnpoz pfsense is the router / gateway connected to unifi switch and ap. I think I updated unifi a few days ago, so maybe I lied about not changing anything, lol. I think that was a week ago though and the problem started less than 24 hours ago. I don't have any isolation settings turned on, but maybe I will think about doing a restore to the previous version, or try to figure out what new feature may have caused the issue. it's weird that I can ping the wired device but not the wireless. okay, I can't ping any wireless devices

[johnpoz]

@Cloudless-Smart-Home I run unifi APs, I am always running the that latest beta firmware and controller software. My wireless devices can talk to each other.

This is the setting that would isolate your clients

[Cloudless Smart Home]

This post is deleted!

[Cloudless Smart Home]

This post is deleted!

[Cloudless Smart Home]

@johnpoz said in can't ping or reach host from same vlan, but can from other vlan:

devices on the same network don't talk to the gateway (pfsense) to talk to each other.

then why am I able to create vlans and firewall rules that block or allow traffic? not saying you're wrong and I'm also not saying that I know any of my firewall rules are working as intended. I have always had a lot of strange behavior from pfsense that makes no sense to me. turning on and off rules to figure stuff out. like I often have to turn off the RFC1819 rule for traffic to be seen on the same vlan. maybe I don't have my vlans set up right or something else.

[Cloudless Smart Home]

@johnpoz said in can't ping or reach host from same vlan, but can from other vlan:

This is the setting that would isolate your clients

I checked that when you talked about it earlier in the thread. It was off. It has never been on.

[johnpoz]

@Cloudless-Smart-Home said in can't ping or reach host from same vlan, but can from other vlan:

RFC1819 rule for traffic to be seen on the same vlan

That rule would make no sense on a local network.. That is going to cause you all kinds of issues, unless you had rules that allowed access to pfsense IPs, or even internet before them etc. The built in block rfc1918 rule blocks source traffic of rfc1918..

Can you post up rules you have set on your local network(s)

Rules are evaluated top down, first rule to trigger wins, no other rules are evaluated.. As traffic enters the interface from the network its attached too.

Block rfc and block bogon should have zero use on a local network.. Unless this network was not rfc1918, but how would anything other than your local network name, ie like lan subnet ever even be on that interface, same goes for bogon.. How would some source network that is bogon ever be inbound into say your lan interface?

Most lan side rules should have your "network subnets" as the source, which would block all other traffic anyway, ie not that network rfc1918 space or bogon. Really the only time network subnet should not be the source is if you were using the interface as a transit/connector network.

If you post up your rules - we could go over if they make sense or not, etc.

Example - here is say a locked down vlan/network sort of rules

[Cloudless Smart Home]

@johnpoz said in can't ping or reach host from same vlan, but can from other vlan:

Can you post up rules you have set on your local network(s)

will do, thanks! I was instructed on a youtube video that rfc1918 was to prevent cross talk between vlans, which was my initial reason for creating vlans. to isolate IoT devices from my network. Just take a few screen shots?

[johnpoz]

@Cloudless-Smart-Home yeah screenshots like my example above are perfect. It shows you what interface its on, and the rules - quick and easy to see what is going on in just a glance.

Also do you have any rules in floating?

Sure if you want to block access to your other vlans, problem with the auto rule is it gets placed on top.. See in my above example I created an alias of my own that contains rfc1918 address space. And I use that to block access to my other vlans. But the built in tool, like the bogon one would be placed at the very top and evaluated before any of your other rules.

[Cloudless Smart Home]

@johnpoz

[Cloudless Smart Home]

This post is deleted!

[johnpoz]

@Cloudless-Smart-Home what advance option are you setting on the rules with the gear icon? Your rules on iot_150 - most of those doesn't seem to be getting any evaluations.. So either your source IP is not right, or your aliases not right - or not matching destination.

Your first set a rules - not sure why you would have for ntp and dns the net alias for the address alias?

[Cloudless Smart Home]

@johnpoz this fixed it... https://help.ui.com/hc/en-us/articles/16230412350487-UniFi-Isolated-Devices

but I really could use some help setting up my pfsense firewall rules correctly, lol. thank you so much for helping me John.