Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    [SOLVED] WAN of pfsense box2 from LAN of psense box1?

    Scheduled Pinned Locked Moved General pfSense Questions
    16 Posts 4 Posters 4.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      jikjik101
      last edited by

      @wallabybob:

      From the console of box2 does a```
      ping 10.10.10.1

      Yes

      @wallabybob:

      From a LAN client of box2 does a```
      ping 10.10.10.1

      Yes
      My client IP is 192.168.100.13 from the DHCP of LAN of Box2.

      But from the console of box1,

      ping 10.10.10.2

      100% packet loss.

      And still no internet connection from the LAN client of Box2 or from Box2 itself.
      From a LAN client of box2 does a```
      ping google.com

      
From the console of box2 does a```
ping google.com
```100% packet loss.
      1 Reply Last reply Reply Quote 0
      • W
        wallabybob
        last edited by

        @jikjik101:

        But from the console of box1,

        ping 10.10.10.2

        100% packet loss.

        This is hard to explain in the light of the reports of successful pings from the box2 console.

        Please report the output from the following commands on the box1 console:```

        ping -c 5 10.10.10.2; arp -an; netstat -rn -f inet; ifconfig -a

        1 Reply Last reply Reply Quote 0
        • J
          jikjik101
          last edited by 

          $ ping -c 5 10.10.10.2; arp -an; netstat -rn -f inet; ifconfig -a
PING 10.10.10.2 (10.10.10.2): 56 data bytes

--- 10.10.10.2 ping statistics ---
5 packets transmitted, 0 packets received, 100.0% packet loss
? (10.10.10.2) at 00:0c:29:f5:5a:bb on le1 expires in 911 seconds [ethernet]
? (10.10.10.3) at 00:50:56:c0:00:04 on le1 expires in 1173 seconds [ethernet]
? (10.10.10.1) at 00:0c:29:93:27:ea on le1 permanent [ethernet]
? (10.10.10.5) at 00:0c:29:de:27:11 on le1 expires in 1002 seconds [ethernet]
? (192.168.20.1) at 00:13:49:98:39:44 on le0 expires in 906 seconds [ethernet]
? (192.168.20.33) at 00:0c:29:93:27:e0 on le0 permanent [ethernet]
Routing tables

Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
default            192.168.20.1       UGS         0      211    le0
8.8.8.8            192.168.20.1       UGHS        0      578    le0
10.10.10.0/24      link#2             U           0     1301    le1
10.10.10.1         link#2             UHS         0        0    lo0
127.0.0.1          link#4             UH          0       97    lo0
192.168.20.0/24    link#1             U           0        0    le0
192.168.20.33      link#1             UHS         0        0    lo0
202.84.96.1        00:0c:29:93:27:e0  UHS         0       29    le0
202.84.96.2        00:0c:29:93:27:e0  UHS         0       23    le0
le0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
	options=8 <vlan_mtu>ether 00:0c:29:93:27:e0
	inet6 fe80::20c:29ff:fe93:27e0%le0 prefixlen 64 scopeid 0x1 
	inet 192.168.20.33 netmask 0xffffff00 broadcast 192.168.20.255
	nd6 options=3 <performnud,accept_rtadv>media: Ethernet autoselect
	status: active
le1: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
	options=8 <vlan_mtu>ether 00:0c:29:93:27:ea
	inet 10.10.10.1 netmask 0xffffff00 broadcast 10.10.10.255
	inet6 fe80::20c:29ff:fe93:27ea%le1 prefixlen 64 scopeid 0x2 
	nd6 options=3 <performnud,accept_rtadv>media: Ethernet autoselect
	status: active
plip0: flags=8810 <pointopoint,simplex,multicast>metric 0 mtu 1500
lo0: flags=8049 <up,loopback,running,multicast>metric 0 mtu 16384
	options=3 <rxcsum,txcsum>inet 127.0.0.1 netmask 0xff000000 
	inet6 ::1 prefixlen 128 
	inet6 fe80::1%lo0 prefixlen 64 scopeid 0x4 
	nd6 options=3 <performnud,accept_rtadv>pflog0: flags=100 <promisc>metric 0 mtu 33200
pfsync0: flags=0<> metric 0 mtu 1460
	syncpeer: 224.0.0.240 maxupd: 128
enc0: flags=0<> metric 0 mtu 1536</promisc></performnud,accept_rtadv></rxcsum,txcsum></up,loopback,running,multicast></pointopoint,simplex,multicast></performnud,accept_rtadv></vlan_mtu></up,broadcast,running,simplex,multicast></performnud,accept_rtadv></vlan_mtu></up,broadcast,running,simplex,multicast>

          I am doing this inside a vm environment.

          1 Reply Last reply Reply Quote 0
          • W
            wallabybob
            last edited by

            Sorry I didn't think of this earlier. Do you have a firewall rule on WAN in box2 allowing icmp echo? Such a rule is necessary since the default is to block traffic initiated from the WAN side.

            1 Reply Last reply Reply Quote 0
            • J
              jikjik101
              last edited by

              No rules in WAN of box2.
              I thought it allows everything by default.

              I will put Allow All in WAN of box 2 and check if it works.

              My bad, I forgot this one:
              Rules are evaluated on a first-match basis (i.e. the action of the first rule to match a packet will be executed). This means that if you use block rules, you'll have to pay attention to the rule order. Everything that isn't explicitly passed is blocked by default.

              1 Reply Last reply Reply Quote 0
              • J
                jikjik101
                last edited by

                My suspicion is correct, DNS server.
                When I put the Google's DNS, bam, it works.

                Thanks alot wallybybob for your guidance.
                I will treat you with a beer someday.  ;D

                1 Reply Last reply Reply Quote 0
                • P
                  phil.davis
                  last edited by

                  I also do this all the time for testing. I have the DNS Forwarder and DHCP going on box 1 (the real internet connection).
                  On box 2 WAN I do one of:

                  • DHCP - then it gets an IP address and the DNS forwarder's address (box1 LAN IP) from box1 LAN; or
                  • specify a box1 LAN IP address for box2 WAN and give it gateway and DNS as box1 LAN IP.
                    box2 does NAT for clients on box2 LAN, then box1 does NAT again for box2 WAN, which it sees as a normal client on box1 LAN. The double-NAT works fine.

                  As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                  If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                  1 Reply Last reply Reply Quote 0
                  • W
                    wallabybob
                    last edited by

                    @phil.davis:

                    The double-NAT works fine.

                    If I recall correctly some people have reported problems with VoIP and double NAT. I have found that VoIP and double NAT has worked fine for me with recent enough versions of Twinkle and (possibly, I don't recall exactly) Ekiga.

                    1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by

                      I have also read about double NAT being a problem but I've never experienced it myself. Two pfSense boxes both NATing has always worked in testing for me. I also ran a separate router in front of my pfSense box for a WAN connection when 1.2.3 could only use one PPPoE connection directly, no problems.

                      Something to be aware of though.

                      Steve

                      1 Reply Last reply Reply Quote 0
                      • J
                        jikjik101
                        last edited by

                        Thanks for that info. Although I have no plans of using the double NAT since I don't know what is double NAT or single NAT ???

                        As long as my system works, no problem.

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.