Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Cannot ping from OPT1 to OPT2 but can the other way…?

    Scheduled Pinned Locked Moved Firewalling
    25 Posts 2 Posters 5.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      burnsl
      last edited by

      Yes I have packages, but not anything that effects routing.
      Just charts and AVAHI for bonjour

      No NAT rules on these nets

      1 Reply Last reply Reply Quote 0
      • P
        podilarius
        last edited by

        Is the local firewalls off on the computers that you are testing with?

        1 Reply Last reply Reply Quote 0
        • B
          burnsl
          last edited by

          There are no firewalls on anything other than the PFsense device.

          1 Reply Last reply Reply Quote 0
          • B
            burnsl
            last edited by

            UPDATE:
            I can reach other devices on the .2 network from the .5  it's only the WAP that I cannot reach, however, the WAP cannot block traffic like this on its own.

            Its odd.

            I can get to the web interface from the same subnet, (.2)
            I cannot get to it from any other.
            I can get to any other device on the .2 net from the other subnets.

            It's maddening.

            Is there some ip blocking mechanism in the PFSENSE firewall if I haven't installed a IDS type package?

            1 Reply Last reply Reply Quote 0
            • P
              podilarius
              last edited by

              No, please see my earlier post. Some WAP GUI do not allow access except from the LAN subnet. You might check for a settings that allows for remote configuration.

              1 Reply Last reply Reply Quote 0
              • B
                burnsl
                last edited by

                podilarius…

                I know this, and can assure you that I have been able to get access to this interface from other networks without trouble before.
                I have bookmarks for it and everything.

                It seems that no matter what IP I place it on, nothing allows access to it though PFSense from other subnets.

                I placed my IPCop back online to test.
                I got to it with no issues.

                I'm about to call a priest in for an exorcism.

                1 Reply Last reply Reply Quote 0
                • P
                  podilarius
                  last edited by

                  IPCop probably NATed the connection. Add a NAT rule at the top that will change the source IP to the OPT2 (.2) network interface address of pfsense if coming from LAN or OPT1 subnets. Did the IPCop and pfSense share the same IP address?

                  1 Reply Last reply Reply Quote 0
                  • B
                    burnsl
                    last edited by

                    Yes they have the same ip topology and they are direct replacements for each other.

                    Is what you're suggesting going to reset something or clear the problem?
                    Why would it NAT communication from and OPT"A" to OPT"B" interface?!

                    1 Reply Last reply Reply Quote 0
                    • P
                      podilarius
                      last edited by

                      pfSense does not. It does not normally make sense to do so since they are local. What I am suggesting is that IPCop NATed and that is why it worked.
                      You will have to switch to manual outbound NAT so that you can add the rule to NAT traffic to the specific WAP GUI address. The traffic would "look" like it is coming from the pfSense machine and allow GUI access.
                      You could also power up IPCop and check the rules for NATing out (while not connected to a network).

                      1 Reply Last reply Reply Quote 0
                      • B
                        burnsl
                        last edited by

                        No NATting happens on ipcop either.

                        I also Know that I had access to it a few months ago with the same firewall rules.

                        1 Reply Last reply Reply Quote 0
                        • P
                          podilarius
                          last edited by

                          Then something must have changed on the WAP. Perhaps the default gateway, route, or subnet mask. If it worked with pfSense before and nothing changed, then it would work now.

                          1 Reply Last reply Reply Quote 0
                          • B
                            burnsl
                            last edited by

                            Agreed, but I have reset it and verified the right information in he setup.
                            Nada

                            1 Reply Last reply Reply Quote 0
                            • P
                              podilarius
                              last edited by

                              Are there any tools on the WAP that you can use? Like traceroute, ping, or anything? Have you recently upgraded the firmware or something? id you upgrade pfsense recently? Can you post your LAN, OPT1, and OPT2 rules?

                              1 Reply Last reply Reply Quote 0
                              • B
                                burnsl
                                last edited by

                                No tools on the wap.
                                I'll post my rules in a few moments.
                                Stand by…

                                1 Reply Last reply Reply Quote 0
                                • B
                                  burnsl
                                  last edited by

                                  @podilarius:

                                  Are there any tools on the WAP that you can use? Like traceroute, ping, or anything? Have you recently upgraded the firmware or something? id you upgrade pfsense recently? Can you post your LAN, OPT1, and OPT2 rules?

                                  Here they are, the two nets.  all rules but (* ANY) disabled.

                                  FW_RULES_2_NET.JPG
                                  FW_RULES_2_NET.JPG_thumb
                                  FW_RULES_5_NET.JPG
                                  FW_RULES_5_NET.JPG_thumb

                                  1 Reply Last reply Reply Quote 0
                                  • P
                                    podilarius
                                    last edited by

                                    So the rules are strait forward, okay … enable ssh on pfsense. using ssh login several times to pfsense. The purpose is to run tcpdump on each interface involved.
                                    Using tcpdump watch for the originating traffic from the client, then see if it makes it to the other side of pfsense (which according to the rules should work with no problem). The watch to see if you see any traffic returned from the WAP. You can setup 4 ssh sessions, two for each interface watching in and out on each.

                                    1 Reply Last reply Reply Quote 0
                                    • B
                                      burnsl
                                      last edited by

                                      Interesting idea.

                                      Will do.

                                      1 Reply Last reply Reply Quote 0
                                      • First post
                                        Last post
                                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.