Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Multi LAN - one behind router, other not

    Scheduled Pinned Locked Moved
    NAT
    4
    23
    11.0k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • E
      eethore
      last edited by

      yes, i did.

      i modify this
      [click to toggle enabled/disabled status]  *  LAN net  *  *  *  *      Default LAN -> any

      to disable, so all traffic being blocked at the end.
      and i'm using the white list for user access, so i'm having less difficult to giving them policy.

      ya, when i see the log…most of them are blocked by default
      it said : @146 block drop in log quick all label "Default block all just to be sure."

      what should i do???

      1 Reply Last reply Reply Quote 0
      • GruensFroeschliG
        GruensFroeschli
        last edited by

        Read this sticky:
        http://forum.pfsense.org/index.php/topic,7001.0.html

        @http://forum.pfsense.org/index.php/topic:

        Rules are processed from top to down.
        If a rule catches the rest of the rules is no longer considered.
        Per default a "block all" rule is always in place (invisible below your own rules).

        Since the default rule blocks your access attempts you obviously didnt create the right rules to allow your users out.
        –> Create firewall-rules that allow your 3 subnets.

        We do what we must, because we can.

        Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

        1 Reply Last reply Reply Quote 0
        • E
          eethore
          last edited by

          O MY GOD !!!!  :o :o :o :o :o :o :o
          i really read that line, but i couldnt understand what its meaning.
          now, my eyes are opened.

          "so, by default there is INVISIBLE RULE that block all traffic.
          and i just need to make rules that PASS what user can access the internet"

          is my sentence right?

          i'll try this right away.

          1. Turning PASS for Default rule
          2. Turning to Automatic Outbond NAT, not Advanced

          i'll submit the result right away…

          1 Reply Last reply Reply Quote 0
          • E
            eethore
            last edited by

            ok, the rules are right now.

            but…..

            still...

            accessing from 192.168.5.0/24 network didnt work.

            it only could browse the front page only. When clicking the link inside the page, it become "Page could be displayed..."

            1 Reply Last reply Reply Quote 0
            • GruensFroeschliG
              GruensFroeschli
              last edited by

              Can you ping the LAN IP of the pfSense?
              Can you ping the WAN IP of the pfSense?
              Are you able to resolve DNS names? (What is your DNS entry on the client?)

              We do what we must, because we can.

              Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

              1 Reply Last reply Reply Quote 0
              • E
                eethore
                last edited by

                ping from 192.168.5.0 network to 192.168.7.3 REPLY
                ping from 192.168.5.0 network to pfSense WAN RTO

                my internal DNS is 192.168.7.1.

                1 Reply Last reply Reply Quote 0
                • E
                  eethore
                  last edited by

                  THANKS for still here with me…
                  i'm very grateful for this forum...
                  expecially for GruensFroeschli, i always waiting for your reply in my days...hope there will be a bright sight about this...i know i will get through it...

                  still can't get it right ... hiks  :'(

                  maybe my firewall rules aren't right?

                  here i attaching my screenshoot...

                  the LAN default, i put it down to the bottom...
                  the rules for pass the access to the client i put it on the very top.
                  and for blocking the network, i put it at the top of the LAN default.

                  is there any problems with the WAN rules?
                  so i can post it to...

                  or maybe you wanna see the .xml ?

                  pfsense1.jpg
                  pfsense1.jpg_thumb
                  pfsense2.jpg
                  pfsense2.jpg_thumb

                  1 Reply Last reply Reply Quote 0
                  • E
                    eethore
                    last edited by

                    while waiting for your reply, i'm traceroute the traffic from 192.168.5.0 network.

                    the result :
                    Microsoft Windows XP [Version 5.1.2600]
                    (C) Copyright 1985-2001 Microsoft Corp.

                    C:\Documents and Settings\a>tracert 192.168.7.3

                    Tracing route to 192.168.7.3 over a maximum of 30 hops

                    1    3 ms    2 ms    2 ms  192.168.5.1
                      2  563 ms  495 ms  496 ms  192.168.255.5
                      3  499 ms  497 ms  497 ms  192.168.7.3

                    Trace complete.

                    seems the traceroute have no problem accessing 192.168.7.3 (LAN pfsense).

                    but when traceroute the website

                    C:\Documents and Settings\adhyastu.rahmantyo>tracert google.com

                    Tracing route to google.com [64.233.187.99]
                    over a maximum of 30 hops:

                    1    4 ms    2 ms    2 ms  192.168.5.1
                      2  496 ms  496 ms  507 ms  192.168.255.5
                      3    *        *    ^C
                    C:\Documents and Settings\a>

                    it stops there…

                    1 Reply Last reply Reply Quote 0
                    • GruensFroeschliG
                      GruensFroeschli
                      last edited by

                      Your rule only allows TCP. A ping (aka traceroute) is ICMP.
                      Change the protocol to "any"

                      We do what we must, because we can.

                      Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                      1 Reply Last reply Reply Quote 0
                      • E
                        eethore
                        last edited by

                        i've change the protocol to ANY.

                        But still no result to the goodness…

                        hiks...

                        any other ways to figure it out?

                        ::)

                        1 Reply Last reply Reply Quote 0
                        • E
                          eethore
                          last edited by

                          hello there?

                          the problem isn't solved yet…
                          i'm desperated :(
                          :-[ :'( :'(

                          1 Reply Last reply Reply Quote 0
                          • P
                            Perry
                            last edited by

                            Then Commercial support might be what you need.

                            /Perry
                            doc.pfsense.org

                            1 Reply Last reply Reply Quote 0
                            • E
                              eethore
                              last edited by

                              hiks…

                              maybe i'll migrate to Mikrotik again, since in Mikrotik there was no problem like this.

                              thanks anyway.

                              1 Reply Last reply Reply Quote 0
                              • E
                                eethore
                                last edited by

                                i found the solution.

                                i contact the VSAT technicians. So, we try up the topologi.

                                MTU is the PROBLEM !!!

                                so, we have to give the same MTU at the cisco router and so the pfsense, so they can communicate.

                                Previous setting, MTU at pfsense 1500, and the cisco router 512.
                                So, i set the MTU at pfsense 576, and the cisco router 576.

                                The technicians said, it strange. Because in cisco router, it's already been set up that the cisco router will negotiate the MTU if its below it or above it. But when trying communicate with pfsense, the policy seems not working.

                                But, well…it's already been solved now. It's not the NAT problem, policy problem, or anything else.
                                It's the MTU setting.

                                Thanks for all.

                                If anyone can give me how we can negotiate the MTU and communicate with cisco smoothly, please don't hesitate.

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.