Basic / Simple issue hopefully
-
So my guess is that the slingbox has some sort of block on pings from devices that are not on the same subnet.
That could certainly be true but it would be unusual. Are you able to access the slingbox video stream from another subnet? Since that is kind of the point of the device it seems a bit weird if you can't!
One option available to you is to enable NAT between LAN and your slingbox subnet. That way all traffic will appear to come from the pfSense box in the same subnet. However that is quite a lot more complex!
Steve
-
So long story short I was having issues with my internet connection via the buffalo router/access point so I decided to remove that from my network set up, but in doing so I screwed up my system when I tried to change assigned interfaces and I ended up resetting to factory defaults. Problem is is that I'm back to my original problem. I can't ping other devices on the same subnet. I'm now connecting still wirelessly, but using a TP-Link USB adapter that has been very reliable, but the entire set up is in pfSense. So I'm confused as to why I'm not able to ping other devices. I have any any any rules on all interfaces except WAN and it is the only rule per interface.
Can someone help?
-
I can't ping other devices on the same subnet. I'm now connecting still wirelessly, but using a TP-Link USB adapter that has been very reliable, but the entire set up is in pfSense.
You are connecting over wireless and can't ping other devices connecting via the same wireless network?
On Interfaces -> <name of="" your="" wireless="" interface="">, in the Network-specific wireless configuration section, do you have Allow intra-BSS communication ticked?</name>
-
No I don't have that ticked because I wanted the traffic to go through the firewall rules. Doesn't checking that box skip over the firewall rules. Also, I can't ping other devices on other networks either.
Thanks!
-
Traffic between clients on your LAN would not ever (normally) go through your pfSense box and hence is not filtered by the firewall rules.
Each client on your LAN will have IP details something similar to:
IP 192.168.1.X/24
Gateway 192.168.1.1When, say, 192.168.1.3 tries to ping 192.168.1.4 it will send the ping directly to 192.168.1.4 because the two clients are in the same subnet. There is no need for it to send traffic to its gateway. However your wifi access point, which is basically a switch, is set to block that traffic.
You need to allow intra-BSS communication or move clients into different subnets.
Just thinking out loud…..
You may get something to work by setting each client to a very small subnet, /32, forcing all traffic to go via the gateway. However using /32 would not include the gateway address, this isn't a problem for wan connections though. Also pfSense would have to route traffic in and out of the same interface and I don't think it can do that.
Another option maybe to run a pppoe server on pfSense and have all your LAN clients log into it. I've never done that but I believe that would allow pfSense to control traffic more closely.
.....end thinking!Steve
-
So now I can talk to all devices within the LAN network, but I still cannot talk to my other networks. I have any any any rules on each network interface. I can ping the network NICs but none of the devices on the other side.
Thanks!
-
Hmm weird.
Possible causes:
You have specified a gateway in the firewall rules so all traffic is routed via your WAN.
You have an incorrect subnet somewhere so local clients think they can send traffic directly without going through their gateway.
Something I can't imagine!Steve
-
When I go to Status->Gateways I see a gateway defined as Interface WAN Dynamic Gateway. I have set up DynamicDNS to route domain name always to the WAN IP of my pfSense box.
Should I see anything in the Gateways page?
-
No that sounds OK. What I meant was you may have added a gateway to your firewall rule. It's unlikely you would have done that by accident, it's in the advanced section of the firewall edit rule page. You would normally only use this feature to implement policy based routing if you have multiple WAN connections but having it set can produce exactly the sort of symptoms you are describing.
There is a column for 'gateway' on the firewall rules page, it should be set to 'default'.Steve
-
So if I wanted a network that prevented communication between clients like on a guest network and I was using a usb wireless adapter not checking the allow intra-BSS communication would prevent the communication. I wouldn't have to set up any firewall rules to prevent it because it would never reach the gateway correct?
Thanks!
-
Yes. :)
Exactly like you say the traffic between clients never reaches the firewall so rules would have no effect.
In a wifi network you are able to stop this traffic by not checking the 'allow intra-BSS communication' option. In a wired network you do not have that option.Steve
