communication between vlan
-
@johnpoz said in communication between vlan:
Looks like pfsense has this one interface em0 is connected to a switch and everything is tagged.
That's exactly what it is. The appliance has an on-board switch that must be setup via serial port. See:
https://forum.netgate.com/topic/154826/install-pfsense-on-stormshield-sn300/It's not a layer 3 switch though AFAIK so if no states are created but the ping works between subnets I'd check that one of those device doesn't have IPs in both subnets.
That would imply the switch is leaking traffic between ports however.
-
I redid a configuration from scratch and I still have no state in States.
I tried to ping 8.8.8.8 from the LAN and still don't see anything in States.
I only have the WAN interface which continually receives icmp packets.
And I checked none of these devices have IP addresses in both subnets. moreover in DHCP leases there are only two IPs distributed to two different stations
-
Ok so that ping is not going through the firewall at all. I assume it must be going directly to your upstream router since that appears to be providing a private IP address to pfSense.
So either that client has more than one NIC or it's connecting to the other router directly through the on-board switch. In both cases though the client would have an IP address in the 192.168.138..0/24 subnet. Does it?
-
@Nimizu said in communication between vlan:
WAN interface which continually receives icmp packets.
I would assume that is pfsense checking if its gateway is alive. Not pfsense being pinged.
If you do not see states in pfsense - then the traffic isn't flowing through pfsense.. Lets see the output of one of these clients on one of your vlans, windows ipconfig /all or linux ifconfig, etc.
But if you ping 8.8.8.8 and you see no state, then the traffic didn't go through pfsense.. what about a traceroute from one of these clients to 8.8.8.8
example - here is trace from one of my clients behind pfsense - clearly see 1st hop is pfsense, and then next hop is my isp, etc.
Your trace should show either the 102.1 or 103.1 ip address of pfsense lan and opt1 interface depending on which client your tracing from, then that 192.168.138.254 which I assume is the isp router/gateway in front of pfsense then your isp network, internet, etc..
-
effectively, pfSense is connected directly to the upstream router via a switch which delivers the DHCP address via ethernet cable.
I could have an address of this router via WIFI but when I do the pping I disconnect from this WIFI and only leave the connection via ethernet.
Here is my ipconfig of the client connected on the LAN. I only have this interface connected:
when I do a traceroute of 8.8.8.8 :
and when I do a traceroute of my other client's IP I get this :
and of course no ping marked in States
-
@Nimizu said in communication between vlan:
and of course no ping marked in States
the icmp states wont be there long.. get a constant ping going
ping ipaddres -t
is windows way to do it..
Now while that ping is running look in your states..
You sure you have firewall running? The only way I could see that working is if firewall is off, but that would disable nat, these clients have internet access while like that, or only if you enable wifi on them? But if you were using pfsense as router only.. It wouldn't be showing you the states for the pings you showed either.
The only other way it could work with firewall off is if your upstream device was natting downstream networks.
-
I don't have a NAT rule to configure and yes my firewall is activated. I tried pinging 192.168.102.102 -t but no apparent change.
For the LAN, internet access was automatic but for the WIFI vlan I had to put rules in place to have internet access
-
Where 192.168.102.1 is the pfSense interface in that VLAN?
If you just ping that directly do you see a state opened for it?
-
@Nimizu well if there are no states being created, there would be no way to block the traffic with a firewall rule.. Because how the firewall blocks the traffic is prevention of a state being created.
So your client on lan or opt can ping 8.8.8.8 - and you see no states with that either?
-
the 192.168.102.1 interface is the gateway for port 2 which corresponds to my LAN.
I tried to ping 8.8.8.8 with the pfsense tool using the LAN interface as the source. But no open state.
All my firewall rules are Pass and not Block or Reject.
-
@Nimizu said in communication between vlan:
I tried to ping 8.8.8.8 with the pfsense tool using the LAN interface as the source. But no open state.
Hmm, you should definitely see a state for that. As long as you are looking whilst the ping is running because the ICMP states expire quickly as johnpoz said.
Try running it from the pfSense command line:
ping -S 192.168.102.1 8.8.8.8Then check for a state in the gui.
-
@stephenw10 said in communication between vlan:
ping -S 192.168.102.1 8.8.8.8
I tried, but again the same result.
I pinged directly into the pfsense shell:
mais je vois toujours uniquement ce résultat meme en regardant en meme temps que le ping :
-
Hmm, are you 100% sure that's the same firewall? There is almost no way to have it not open a state for that ping whilst also opening a state for the monitoring pings. You would have to set a rule to pass pings without opening a state. Which is possible but pretty advanced!
Unless that state view is filtered?
You should see like:
[24.08-DEVELOPMENT][admin@6100.stevew.lan]/root: ping 1.1.1.1 PING 1.1.1.1 (1.1.1.1): 56 data bytes 64 bytes from 1.1.1.1: icmp_seq=0 ttl=56 time=25.121 ms 64 bytes from 1.1.1.1: icmp_seq=1 ttl=56 time=5.349 ms 64 bytes from 1.1.1.1: icmp_seq=2 ttl=56 time=5.644 ms 64 bytes from 1.1.1.1: icmp_seq=3 ttl=56 time=5.487 ms 64 bytes from 1.1.1.1: icmp_seq=4 ttl=56 time=6.221 ms[24.08-DEVELOPMENT][admin@6100.stevew.lan]/root: pfctl -vss | grep -A 1 1.1.1.1: ix3 icmp 172.21.16.246:64122 -> 1.1.1.1:8 0:0 age 00:00:58, expires in 00:00:10, 59:59 pkts, 4956:4956 bytes, rule 119, allow-opts -
yes I am indeed on the same firewall.
I tried to do what you just did and I got this result :
-
Ok, good. You should see that in the gui also if it's not filtered.
You should also see states for pings between VLANs with the correct filtering.
If not try that at the command line too.
-
yes indeed on the graphical interface I see this clearly but as I showed you this is what is there on the graphical interface and which corresponds to the result that I sent previously.
I receive dozens of packets every second in this state even though no ping is in progress
-
@Nimizu said in communication between vlan:
I receive dozens of packets every second in this state even though no ping is in progress
Again you are not receiving those, that is the monitoring that pfsense does where it send 1 ping every half second. You must of setup your monitoring to use 8.8.8.8 vs your actual default gateway.. You can clearly see the destination is 8.8.8.8 so its the dpinger service doing its monitoring.
-
Start a ping from some client on one of the internal VLANs to 1.1.1.1.
Then look for the states created in the GUI and at the CLI like you just did.
-
-
@Nimizu so something wrong with the gui not showing the states.. But something odd.. is looks like that output shows ALL for the interface?
Which maybe explains why gui not showing them???
Notice mine shows igb0 and igb1 my lan and wan interfaces.. Not sure why your output shows all vs some specific interface.
