Basic / Simple issue hopefully
-
You can ping it from pfSense but not from LAN, have you tried pinging it from your server subnet?
Check the firewall logs when you try to ping.Assuming your slingbox is able to respond to pings it will either be the firewall blocking packets or a routing problem. Check the IP settings on the slingbox, does it have the correct gateway? subnet mask?
Regarding your previous problem you should check that you didn't have client isolation enabled on the access point. It may be tied in with WPS somehow.
Steve
-
So what I know is this. I tried resetting the slingbox, no dice. I tried changing the subnet from a mask of 255.255.255.248 to 255.255.255.0, still no dice. Since I had it set up on a direct connect from a LAN nic there was no way for me to get my computer on the same network except via VPN which I'm not sure is set up correctly. (That's one of my next questions) But anyway, so because of this I decided since my LAN access point has wired ports available I will move the slingbox to my LAN network for the moment to see if I can ping it and what do you know it worked. So my guess is that the slingbox has some sort of block on pings from devices that are not on the same subnet. That is actually exactly what I want although I will probably set up firewall rules anyway to ensure no cross-network traffic.
So I will next post the VPN question over in the VPN section. Hopefully I can get that question answered which will allow my computer to be on the same network as the slingbox when direct connected and then I should be able to ping.
Here's the link to the VPN post: http://forum.pfsense.org/index.php/topic,49080.0.html
Thanks!
-
So my guess is that the slingbox has some sort of block on pings from devices that are not on the same subnet.
That could certainly be true but it would be unusual. Are you able to access the slingbox video stream from another subnet? Since that is kind of the point of the device it seems a bit weird if you can't!
One option available to you is to enable NAT between LAN and your slingbox subnet. That way all traffic will appear to come from the pfSense box in the same subnet. However that is quite a lot more complex!
Steve
-
So long story short I was having issues with my internet connection via the buffalo router/access point so I decided to remove that from my network set up, but in doing so I screwed up my system when I tried to change assigned interfaces and I ended up resetting to factory defaults. Problem is is that I'm back to my original problem. I can't ping other devices on the same subnet. I'm now connecting still wirelessly, but using a TP-Link USB adapter that has been very reliable, but the entire set up is in pfSense. So I'm confused as to why I'm not able to ping other devices. I have any any any rules on all interfaces except WAN and it is the only rule per interface.
Can someone help?
-
I can't ping other devices on the same subnet. I'm now connecting still wirelessly, but using a TP-Link USB adapter that has been very reliable, but the entire set up is in pfSense.
You are connecting over wireless and can't ping other devices connecting via the same wireless network?
On Interfaces -> <name of="" your="" wireless="" interface="">, in the Network-specific wireless configuration section, do you have Allow intra-BSS communication ticked?</name>
-
No I don't have that ticked because I wanted the traffic to go through the firewall rules. Doesn't checking that box skip over the firewall rules. Also, I can't ping other devices on other networks either.
Thanks!
-
Traffic between clients on your LAN would not ever (normally) go through your pfSense box and hence is not filtered by the firewall rules.
Each client on your LAN will have IP details something similar to:
IP 192.168.1.X/24
Gateway 192.168.1.1When, say, 192.168.1.3 tries to ping 192.168.1.4 it will send the ping directly to 192.168.1.4 because the two clients are in the same subnet. There is no need for it to send traffic to its gateway. However your wifi access point, which is basically a switch, is set to block that traffic.
You need to allow intra-BSS communication or move clients into different subnets.
Just thinking out loud…..
You may get something to work by setting each client to a very small subnet, /32, forcing all traffic to go via the gateway. However using /32 would not include the gateway address, this isn't a problem for wan connections though. Also pfSense would have to route traffic in and out of the same interface and I don't think it can do that.
Another option maybe to run a pppoe server on pfSense and have all your LAN clients log into it. I've never done that but I believe that would allow pfSense to control traffic more closely.
.....end thinking!Steve
-
So now I can talk to all devices within the LAN network, but I still cannot talk to my other networks. I have any any any rules on each network interface. I can ping the network NICs but none of the devices on the other side.
Thanks!
-
Hmm weird.
Possible causes:
You have specified a gateway in the firewall rules so all traffic is routed via your WAN.
You have an incorrect subnet somewhere so local clients think they can send traffic directly without going through their gateway.
Something I can't imagine!Steve
-
When I go to Status->Gateways I see a gateway defined as Interface WAN Dynamic Gateway. I have set up DynamicDNS to route domain name always to the WAN IP of my pfSense box.
Should I see anything in the Gateways page?
-
No that sounds OK. What I meant was you may have added a gateway to your firewall rule. It's unlikely you would have done that by accident, it's in the advanced section of the firewall edit rule page. You would normally only use this feature to implement policy based routing if you have multiple WAN connections but having it set can produce exactly the sort of symptoms you are describing.
There is a column for 'gateway' on the firewall rules page, it should be set to 'default'.Steve
-
So if I wanted a network that prevented communication between clients like on a guest network and I was using a usb wireless adapter not checking the allow intra-BSS communication would prevent the communication. I wouldn't have to set up any firewall rules to prevent it because it would never reach the gateway correct?
Thanks!
-
Yes. :)
Exactly like you say the traffic between clients never reaches the firewall so rules would have no effect.
In a wifi network you are able to stop this traffic by not checking the 'allow intra-BSS communication' option. In a wired network you do not have that option.Steve
