Basic / Simple issue hopefully

broncoBrad

I have a very simple issue.

Devices on my LAN interface can't ping any other devices on the LAN interface or any other devices on other network interfaces I have set up.

I use to have a handful of rules on each interface, but last night I disabled all rules except for an any any any any rule on each interface.

I have reset my states.

I am even having trouble pinging using the webConfigurator interface that has a Ping tool and you can select the interface to ping from. Pretty much all of my devices are set up with static IP mappings via the DHCP servers. Would that cause a problem?

Another thing that happened yesterday was that the access point that is connected to my LAN nic and how my computer connects to the LAN via wireless use to have a manual IP set up in its firmware configuration and I could ping and get into the web interface just fine. Last night I changed it to get it's IP via DHCP and created a static mapping for it, but now I can't ping it or get into the web interface. It doesn't make any sense because I'm still connected to the internet and can talk to my pfSense box so I have to be talking through the access point. Plus the pfSense webconfigurator says it's online under dhcp leases.

Please help!

Thanks in advance! This doesn't make any sense.

stephenw10

@broncoBrad:

Devices on my LAN interface can't ping any other devices on the LAN interface

That traffic does not go through pfSense.
Either the devices are not correctly receiving dhcp information or something else is blocking traffic. A local software firewall perhaps?

Steve

broncoBrad

But here's the problem with that is that I should be able to ping from the pfSense NIC side to the devices and I can't. I'm getting no responses when I ping via the webConfigurator.

stephenw10

The devices are correctly receiving all the required IP from pfSense's dhcp server?
Are you using a switch?

Even so a local software firewall can block pings from pfSense.

Steve

broncoBrad

Okay so I figured out the pinging issue for the LAN devices. My LAN devices were connecting to pfSense through a Buffalo router/access point and apparently having WPS (WiFi-Protected setup) turned on even when it's in access point mode causes problems, so I just disabled WPS and it worked! And since doing that I can even ping between devices on my other pfSense networks which is what I would expect since I have all rules turned off except for the allow any rules. I do still have one pinging issue. My guess is that it is related to the slingbox. I have two wired NICs one that serves as the network for my web server and the other for my slingbox. Both use crossover cables since they are the only devices on each network I can ping and access my web server just fine from the LAN, but the same cannot be said for the slingbox. My guess is that nobody will respond to this because nobody seems to have any solutions when it comes to issues with the slingbox, but I'll still send a plea asking for anyone's help. I think I'll try resetting my slingbox tonight and see if that fixes it, I doubt it, but it doesn't hurt. I can ping my slingbox via the pfSense web configurator, I just can't ping it from another network.

Thanks for any help in advance!

stephenw10

You can ping it from pfSense but not from LAN, have you tried pinging it from your server subnet?
Check the firewall logs when you try to ping.

Assuming your slingbox is able to respond to pings it will either be the firewall blocking packets or a routing problem. Check the IP settings on the slingbox, does it have the correct gateway? subnet mask?

Regarding your previous problem you should check that you didn't have client isolation enabled on the access point. It may be tied in with WPS somehow.

Steve

broncoBrad

So what I know is this. I tried resetting the slingbox, no dice. I tried changing the subnet from a mask of 255.255.255.248 to 255.255.255.0, still no dice. Since I had it set up on a direct connect from a LAN nic there was no way for me to get my computer on the same network except via VPN which I'm not sure is set up correctly. (That's one of my next questions) But anyway, so because of this I decided since my LAN access point has wired ports available I will move the slingbox to my LAN network for the moment to see if I can ping it and what do you know it worked. So my guess is that the slingbox has some sort of block on pings from devices that are not on the same subnet. That is actually exactly what I want although I will probably set up firewall rules anyway to ensure no cross-network traffic.

So I will next post the VPN question over in the VPN section. Hopefully I can get that question answered which will allow my computer to be on the same network as the slingbox when direct connected and then I should be able to ping.

Here's the link to the VPN post: http://forum.pfsense.org/index.php/topic,49080.0.html

Thanks!

stephenw10

@broncoBrad:

So my guess is that the slingbox has some sort of block on pings from devices that are not on the same subnet.

That could certainly be true but it would be unusual. Are you able to access the slingbox video stream from another subnet? Since that is kind of the point of the device it seems a bit weird if you can't!

One option available to you is to enable NAT between LAN and your slingbox subnet. That way all traffic will appear to come from the pfSense box in the same subnet. However that is quite a lot more complex!

Steve

broncoBrad

So long story short I was having issues with my internet connection via the buffalo router/access point so I decided to remove that from my network set up, but in doing so I screwed up my system when I tried to change assigned interfaces and I ended up resetting to factory defaults. Problem is is that I'm back to my original problem. I can't ping other devices on the same subnet. I'm now connecting still wirelessly, but using a TP-Link USB adapter that has been very reliable, but the entire set up is in pfSense. So I'm confused as to why I'm not able to ping other devices. I have any any any rules on all interfaces except WAN and it is the only rule per interface.

Can someone help?

wallabybob

@broncoBrad:

I can't ping other devices on the same subnet. I'm now connecting still wirelessly, but using a TP-Link USB adapter that has been very reliable, but the entire set up is in pfSense.

You are connecting over wireless and can't ping other devices connecting via the same wireless network?

On Interfaces -> <name of="" your="" wireless="" interface="">, in the Network-specific wireless configuration section, do you have Allow intra-BSS communication ticked?</name>

broncoBrad

No I don't have that ticked because I wanted the traffic to go through the firewall rules. Doesn't checking that box skip over the firewall rules. Also, I can't ping other devices on other networks either.

Thanks!

stephenw10

Traffic between clients on your LAN would not ever (normally) go through your pfSense box and hence is not filtered by the firewall rules.
Each client on your LAN will have IP details something similar to:
IP 192.168.1.X/24
Gateway 192.168.1.1

When, say, 192.168.1.3 tries to ping 192.168.1.4 it will send the ping directly to 192.168.1.4 because the two clients are in the same subnet. There is no need for it to send traffic to its gateway. However your wifi access point, which is basically a switch, is set to block that traffic.

You need to allow intra-BSS communication or move clients into different subnets.

Just thinking out loud…..
You may get something to work by setting each client to a very small subnet, /32, forcing all traffic to go via the gateway. However using /32 would not include the gateway address, this isn't a problem for wan connections though. Also pfSense would have to route traffic in and out of the same interface and I don't think it can do that.
Another option maybe to run a pppoe server on pfSense and have all your LAN clients log into it. I've never done that but I believe that would allow pfSense to control traffic more closely.
.....end thinking!

Steve

broncoBrad

So now I can talk to all devices within the LAN network, but I still cannot talk to my other networks. I have any any any rules on each network interface. I can ping the network NICs but none of the devices on the other side.

Thanks!

stephenw10

Hmm weird.
Possible causes:
You have specified a gateway in the firewall rules so all traffic is routed via your WAN.
You have an incorrect subnet somewhere so local clients think they can send traffic directly without going through their gateway.
Something I can't imagine!

Steve

broncoBrad

When I go to Status->Gateways I see a gateway defined as Interface WAN Dynamic Gateway. I have set up DynamicDNS to route domain name always to the WAN IP of my pfSense box.

Should I see anything in the Gateways page?

stephenw10

No that sounds OK. What I meant was you may have added a gateway to your firewall rule. It's unlikely you would have done that by accident, it's in the advanced section of the firewall edit rule page. You would normally only use this feature to implement policy based routing if you have multiple WAN connections but having it set can produce exactly the sort of symptoms you are describing.
There is a column for 'gateway' on the firewall rules page, it should be set to 'default'.

Steve

broncoBrad

So if I wanted a network that prevented communication between clients like on a guest network and I was using a usb wireless adapter not checking the allow intra-BSS communication would prevent the communication. I wouldn't have to set up any firewall rules to prevent it because it would never reach the gateway correct?

Thanks!

stephenw10

Yes. :)

Exactly like you say the traffic between clients never reaches the firewall so rules would have no effect.
In a wifi network you are able to stop this traffic by not checking the 'allow intra-BSS communication' option. In a wired network you do not have that option.

Steve