Adding addtional interface

GruensFroeschli

Additional information:

I've disabled filtering for a test which as I understand it shoudl turn the box into an unrestricted router and rule out the firewall rules stopping this (I may be wrong?) and I still cant communicate from OPT1 to LAN

Does this mean it's a routing issue?

I'd rather bet on a firewall on the device you're trying to access.

@stuartc:

Also I've just been able to ping from LAN to OPt1 but not back?

You dont have a rule allowing pings from OPT1 to LAN. (ping = ICMP =/= TCP,UDP)

stuartc

Thanks for reply, I have a rule now which allows anything, from anywhere to anything on any protol in the DMZ tab and still cant ping out of OPT1 into LAN

As a test I've got a laptop on LAN that I can ping the device Im trying to ping from OPT1 and have just doible checked the windows firewall is disabled on the OPT1 laptop.

have attached new OPT1 rules screenshot - reset state and rebooted pfsense box after applying it just encase

Any input much appreciated it's got me well and truely stumped at the moment

fw_opt1rules.gif_thumb

AhnHEL

Way too many redundant rules. Set up only one rule on your OPT interface

* OPT Net * * * * OPT -> Any

Leave the default LAN -> Any rule as is.

This should allow pings to go from LAN to OPT and from OPT to LAN.

If the pings are not getting through then check both firewalls on both laptops are disabled (you mentioned OPT's laptop firewall to be off but not the LAN laptop's firewall–double check)

Your initial post suggested setting up a DMZ so ultimately you dont want your DMZ/OPT to have LAN access so you will have to edit your OPT -> Any rule to look like this

* OPT Net * ! LAN Net * * OPT -> Any But LAN

Once this is done create your block rules one at a time and place them above your OPT -> Any But LAN rule, testing to make sure they are working properly.

stuartc

Thanks for your help, I will revise my rules and cut them down.

with the DMZ network I need to block all traffic to the lan bar a few ports for our remote access solution so it's not 100% seperated.

The LAN machines I'm attempting to ping from OPT have the firewall disabled, have just double checked (rule 1, never assume :))

So once I am able to ping through to prove connectivity I will be adding additional rules for particular traffic.

Will post back when I can access the OPT1 laptop

Eugene

Can you ping LAN machines from the firewall itself?

stuartc

I'd not actually thought of that, just tried now form the ping tool on the web gui

when the interface is set to the LAN I can ping the server on the LAN, when it's set to OPT1 I cannot ping the LAN server

Thanks fo ryoru input, I feel like I'm geting somewhere with everyones help, I fear it may have driven me to an early grave otherwise.

Eugene

Does the server on LAN have default gateway as pfSense's LAN address?

stuartc

hmmm, it would appear I've overlooked something fairly major here - I've changed a few non priority servers to use the PFsense default gateway rather then the other FW and it works fine!

Thanks for all your help everyone that would have taken me the rest of my life to find!

Eugene

so your issue is not firewalling but routing.
You not necesseraly need to change default gateway but you have to tell your server on LAN that it has to route network 192.168.10.0/24 to your pfSense.
You can add just one route on your server, from Windows cmd-window it would look like
route -p add 192.168.10.0 mask 255.255.255.0 10.1.1.1
… and leave your default non-changed.

stuartc

I know it's not ideal but if I were to add the route to the other firewall during the migration period would that route the traffic properly

so the servers currently pointed at the 10.1.1.1 gateway (old firewall) would forward 192.168.10 traffic onto PFSense?

ktims

@stuartc:

I know it's not ideal but if I were to add the route to the other firewall during the migration period would that route the traffic properly

so the servers currently pointed at the 10.1.1.1 gateway (old firewall) would forward 192.168.10 traffic onto PFSense?

Should work fine that way.

GruensFroeschli

Not sure if this is acceptable but:
You basically want to access stuff on the LAN from the OPT.
The problem is, that the server on the LAN doesnt know where to send the answer to.
If you enable NAT from OPT to LAN, then the requests appear as if from the IP of the pfSense on the LAN side.

Like this you dont need to change anything on the existing stuff.

howto: enable advanced outbound NAT under "firewall" –> "NAT".
there will be an autocreated rule for LAN-->WAN
copy this rule and change it to OPT-->LAN