Intervlan traffic being blocked
-
@johnpoz the mac address is 98:fc:84:d1:db:44.
I used the filer 'eth.addr == 98:fc:84:d1:db:44' and searched the other pcap files but the only thing that shows up is the echo ping request.
For some reason its not reach the 172.16.64.1 interface.
-
@greatbush Can you send us your entire routing table under Diagnostics > Routes?
No need to send the IPv6 one but the IPv4 one would be good.
Since the allow rule is in place, and it doesn't sound like any floating rules are being used, I'm thinking this is a routing issue.
-
@greatbush Please show the pcap from pinging pfsense IP address on the server network?
We know you can not get to this server - but you also said you can not even ping pfsense IP address on the server network..
And yes like to see your full route table - from what you posted no there is no way your going to get to this other network because from your routing table pfsense doesn't even think its connected to this network.
What is this a about a ipsec tunnel - this 10.20 network is via a ipsec tunnel? What about your 2 unifi switches - no where did you say this network was from other site via a tunnel??
-
@johnpoz @planedrop I will send you a pm
-
@johnpoz The network was at another site. I tore it down and rebuilt the config at my current location.
-
@greatbush said in Intervlan traffic being blocked:
For some reason its not reach the 172.16.64.1 interface.
that is pinging the server at .200 - ping pfsense IP on the server network 172.16.64.1 I believe is what you have posted.
There is a huge difference between not getting an answer from server, and not being able to ping pfsense IP on that network.
All kinds of other issues could be going on to why that server doesn't answer - but pfsense no answering when you ping one of its IPs and your firewall rules allow it, and traffic gets to pfsense is something going on in pfsense.
-
@johnpoz i have tried pinging both .200 and .64.1 and i got the exact same result despite me adding rules for both on the S interface. Pfsense isn't dying, right?
-
@greatbush I have no idea what is going on to be honest - if your rules allow it, and traffic is getting there.. you should get an answer.
Your routing table shows the interfaces there.. Only thing that comes to mind is something wrong with the tag. But your doing the packet capture on the actual vlan interface right. Not the parent interface.
You can ping pfsense IP on the S interface right?
-
@johnpoz yep. my test pc can ping its pfsense interface ip
-
-
@greatbush but that test PC that is different IP 160.100 can not ping the server IP of 64.1 ?
You changed the rules to any S subnet to Server subnet I believe. So yeah you should be able to ping the pfsense server interface IP.
Can we see the full ruleset on the S interface of pfsense.
-
-
@greatbush I might be way off here, haven't had time to read all of the updates since yesterday.
But, does the Unifi network side of things have any Layer 3 capable switches that might be getting in the way and attempting to route one of those networks?
-
@planedrop Nope Unifi is not doing anything layer 3.
-
@greatbush well you can ping other interfaces on pfsense, just not the 172.16.64 one.
At a loss.. You have no floating rules.. And looks like your rule triggered and state are created there in that top rule you posted trying to talk to it.
You have no floating rules - and no current vpn tunnels..
Yeah at a loss to what would cause that.
Can you talk to any of the other 172.16.x interfaces you have via the route table you sent..
