Multi Lan issue

johnpoz

Well if wan is 192.168.1.1 you would be natting I assume to any of the lan networks, and would have to port forward. You can see from your traceroute something is not right.

Why do you have what looks like 2 items in hops 1 and 2?

Can you post up say screenshot of your interfaces..
Why do you have a 192.168.1.1 and 192.168.1.13, and why does gateway for 1.1 show a MAC address? Which seems to be 64:66:b3 owned by tp-link.

Can you post a drawing of this network.. Why do you have private IPs address on your WAN connections?

phil.davis

@elgaup0:

Hi,

I have added following rule, for all interfaces(excluding wan) still i can't ping.

ID Proto Source Port Destination Port Gateway Queue Schedule Description
IPv4 * * * * * * Failover none

The traceroute indicates that the traffic is being directed to a gateway by a rule somewhere, not using the ordinary routing table. Is "Failover" a gateway group? (the "*" don't line up nicely on the screen - but after counting them, it seems that "Failover" is in the "Schedule" column?)
If you are directing general internet traffic into a gateway group, then you also have to do something to pass local traffic between subnets without it getting forced into a gateway group and out on the public internet. One way is to make an alias for all your local LAN subnets, then put a pass rule before the general rule, pass source any, destination LAN-subnet-alias.

elgaup0

I am posting all the details requested.

AIRTEL_INTERNET (wan) -> re0 -> v4/DHCP4: 192.168.1.13/24
RSN_PBX1 (lan) -> vr1 -> v4: 192.168.6.1/24
BEAM_INTERNET (opt1) -> pppoe0 -> v4/PPPoE: 49.204.219.***/32
WIFI (opt2) -> ath0_wlan0 -> v4: 192.168.2.1/24
LAN (opt4) -> vr0 -> v4: 192.168.3.1/24

airtel_rules.png_thumb

beam_rules.png_thumb

lan.png_thumb

pbx_rules.png_thumb

wifi.png_thumb

elgaup0

Gateways

interfaces.png_thumb

gateways.png_thumb

Gateway-failover.png_thumb

johnpoz

Why do you have everything going out your internet??

You do understand setting up the gateways like that turns off the routing functions

"Leave as 'default' to use the system routing table. Or choose a gateway to utilize policy based routing."

There is no reason for those entries, the systems knows based upon its routing table how it can get to the internet. And how it can get to the other networks its connected to. What you are doing with that rule is saying – USE the internet.. Screw your other connections you have directly connected to specific networks.

elgaup0

The rules in Lan and Wifi are for the failover /load balancing i read it some where

johnpoz

Yes you use groups and stuff on multiwan for lots of different things.. But you don't have any rules ABOVE those that allow access to your other lans, so guess what happens. Everything tries to go out your wan.

Put rules above those that allow access to your lans.

https://doc.pfsense.org/index.php/Multi-WAN_2.0
Policy Route Negation

When a firewall rule directs traffic into the gateway, it bypasses the firewall's normal routing table. Policy route negation is just a rule that passes traffic to other local or VPN-connected networks that does not have a gateway set. By not setting a gateway on that rule it will bypass the gateway group and use the firewall's routing table. These rules should be at the top of the ruleset – or at least above any rules using gateways.

phil.davis

Yes, as johnpoz says, above each rule that passes traffic to the Failover gateway put an ordinary Pass rule that matches destination "local LANs". I would make an Alias for all the local LAN subnets, then use that alias as the destination.

elgaup0

Thanks guy's problem solved. I have deleted the failover rule, added general pass rule, then failover rule. now i can ping hosts.

phil.davis

@elgaup0:

Thanks guy's problem solved. I have deleted the failover rule, added general pass rule, then failover rule. now i can ping hosts.

Your "general pass rule" needs to not be too general - it should be like suggested by Johnpoz and myself - just for destination "local LAN subnets". If it is very general and matches destination any, then that rule will pass everything, and no packets will get processed by the next rule into the Failover gateway group. Just suggesting you check how "general" that rule is and that your Failover actually works when 1 WAN goes down.