Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    1 WAN 2 LAN

    Scheduled Pinned Locked Moved General pfSense Questions
    39 Posts 7 Posters 8.0k Views 2 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N Offline
      nevr0sed
      last edited by

      Hi all,

      I have been running PFSense for my home network for a year with 1 WAN and 1 LAN. I am a little of a noob, and starting to grasp the concepts as I try to configure my PFSense.

      I have recently upgraded the hardware and installed a new NIC.

      I have configured the Interface as well as the DHCP Server. I now have :

      1 WAN - getting Public IP from Router
      1 LAN (old) - 192.168.1.1 - DHCP Range ; 192.168.1.100 - 199 /24
      1 LAN (new) - 192.168.2.1 - DHCP Range ; 192.168.2.1 - 254 /24

      Although the computers on the LAN (new) do not get internet access. I have looked around but didn't manage to get i right. Nonetheless, the computer on LAN (new) are getting an IP, and I can connect to the PFSense from that part of the network.
      I haven't changed anything in the 'old' network.
      I am trying to have the new NIC for home guests and the 'old' NIC for private home network. The old NIC will be VPN'd in a near future as soon I get the 'new' NIC working properly.

      Can someone help me out here please ?

      If you need I can upload some screen upon request.

      Thank you very much all.

      nevr0sed

      1 Reply Last reply Reply Quote 0
      • A Offline
        AaronvaB
        last edited by

        Hi nevr0sed

        Have you made the Firewall Rules for the new LAN?

        Aaron

        1 Reply Last reply Reply Quote 0
        • N Offline
          nevr0sed
          last edited by

          Hello

          Yes this are the rules I have made.

          But I am really not sure about them.

          What kind of rule shall I put on the WAN interface ?

          Thanks.

          nevr0sed

          gkrellShoot_03-02-16_164855.jpg
          gkrellShoot_03-02-16_164855.jpg_thumb

          1 Reply Last reply Reply Quote 0
          • KOMK Offline
            KOM
            last edited by

            Your WAN should have no rules unless you are allowing access in for port forwards, for example.

            For testing purposes, you only need the very last rule that allows all traffic.  Once it's working, then you can worry about tightening up your rules.  Since the last rule will allow access to the Internet, I have to wonder if you have your problem is with your PUBLICLANINTERFACE clients or DHCP configuration.  From a client, can you ping 8.8.8.8?

            1 Reply Last reply Reply Quote 0
            • N Offline
              nevr0sed
              last edited by

              Hello KOM,

              No from a Client I cannot ping 8.8.8.8
              Request timeout for icmp_seq…

              Thanks

              1 Reply Last reply Reply Quote 0
              • KOMK Offline
                KOM
                last edited by

                1 LAN (new) - 192.168.2.1 - DHCP Range ; 192.168.2.1 - 254 /24

                What's the IP address of your client?  In the above DHCP detail, you seem to be including the PUBLICLANINTERFACE IP address in your DHCP pool.  I don't suppose your client is using the same IP address?  From your client, please run a command prompt and post the output of ipconfig if Windows, or run a terminal and post the output of ifconfig if Linux.

                1 Reply Last reply Reply Quote 0
                • N Offline
                  nevr0sed
                  last edited by

                  The IP address of my client on PUBLICLANINTERFACE is : 192.168.2.2

                  Here is the ifconfig output

                  
                  lo0: flags=8049 <up,loopback,running,multicast>mtu 16384
                          options=3 <rxcsum,txcsum>inet6 ::1 prefixlen 128 
                          inet 127.0.0.1 netmask 0xff000000 
                          inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 
                          nd6 options=1 <performnud>gif0: flags=8010 <pointopoint,multicast>mtu 1280
                  stf0: flags=0<> mtu 1280
                  en0: flags=8863 <up,broadcast,smart,running,simplex,multicast>mtu 1500
                          options=10b <rxcsum,txcsum,vlan_hwtagging,av>ether 00:00:00:00:0:00 
                          inet6 0000::0000:0000:0000:5764%en0 prefixlen 64 scopeid 0x4 
                          inet 192.168.2.2 netmask 0xffffff00 broadcast 192.168.2.255
                          nd6 options=1 <performnud>media: autoselect (1000baseT <full-duplex,flow-control,energy-efficient-ethernet>)
                          status: active
                  en1: flags=8823 <up,broadcast,smart,simplex,multicast>mtu 1500
                          ether 00:00:00:00:0:00
                          nd6 options=1 <performnud>media: autoselect (<unknown type="">)
                          status: inactive
                  en2: flags=8963 <up,broadcast,smart,running,promisc,simplex,multicast>mtu 1500
                          options=60 <tso4,tso6>ether 00:00:00:00:0:00 
                          media: autoselect <full-duplex>status: inactive
                  fw0: flags=8863 <up,broadcast,smart,running,simplex,multicast>mtu 4078
                          lladdr 00:00:00:00:0:00 
                          nd6 options=1 <performnud>media: autoselect <full-duplex>status: inactive
                  p2p0: flags=8802 <broadcast,simplex,multicast>mtu 2304
                          ether 00:00:00:00:0:00 
                          media: autoselect
                          status: inactive
                  awdl0: flags=8902 <broadcast,promisc,simplex,multicast>mtu 1452
                          ether 00:00:00:00:0:00 
                          nd6 options=1 <performnud>media: autoselect
                          status: inactive
                  bridge0: flags=8863 <up,broadcast,smart,running,simplex,multicast>mtu 1500
                          options=63 <rxcsum,txcsum,tso4,tso6>ether 00:00:00:00:0:00 
                          Configuration:
                                  id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
                                  maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
                                  root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
                                  ipfilter disabled flags 0x2
                          member: en2 flags=3 <learning,discover>ifmaxaddr 0 port 6 priority 0 path cost 0
                          nd6 options=1 <performnud>media: <unknown type="">status: inactive</unknown></performnud></learning,discover></rxcsum,txcsum,tso4,tso6></up,broadcast,smart,running,simplex,multicast></performnud></broadcast,promisc,simplex,multicast></broadcast,simplex,multicast></full-duplex></performnud></up,broadcast,smart,running,simplex,multicast></full-duplex></tso4,tso6></up,broadcast,smart,running,promisc,simplex,multicast></unknown></performnud></up,broadcast,smart,simplex,multicast></full-duplex,flow-control,energy-efficient-ethernet></performnud></rxcsum,txcsum,vlan_hwtagging,av></up,broadcast,smart,running,simplex,multicast></pointopoint,multicast></performnud></rxcsum,txcsum></up,loopback,running,multicast> 
                  

                  Thank you very much for your help.

                  1 Reply Last reply Reply Quote 0
                  • N Offline
                    nevr0sed
                    last edited by

                    Hello,

                    Any one can help ? I cannot figure out why it isn't working.

                    I is there anything to do with the DNS ?
                    What should be the DHCP server IP ?
                    What should be the DHCP server Range ?

                    Thanks for your help.

                    nevr0sed

                    1 Reply Last reply Reply Quote 0
                    • N Offline
                      nevr0sed
                      last edited by

                      Do I need to configure a Gateway specific for each LAN i have ?

                      1 Reply Last reply Reply Quote 0
                      • KOMK Offline
                        KOM
                        last edited by

                        No, only WAN needs a gateway.  Your clients on each LAN however DO need a gateway or they won't be able to send traffic out fro their local network.

                        Did you nuke all of your firewall rules and just keep the last one?

                        1 Reply Last reply Reply Quote 0
                        • N Offline
                          nevr0sed
                          last edited by

                          Hey,

                          Thanks for the reply

                          Here are the rules that I have currently modified as you said.

                          The weird thing is that I can ping from client on PUBLICLANINTERFACE any other clients on PRIVATELAN.

                          Find also my rules on my WAN.

                          Thank you

                          gkrellShoot_03-03-16_165931.jpg
                          gkrellShoot_03-03-16_165931.jpg_thumb
                          gkrellShoot_03-03-16_170026.jpg
                          gkrellShoot_03-03-16_170026.jpg_thumb

                          1 Reply Last reply Reply Quote 0
                          • KOMK Offline
                            KOM
                            last edited by

                            LAN source should be *.  You should delete WAN rules 3 and 4 (the ones that reference PUBLICLANINTERFACE).  Can your client ping 192.168.2.1?

                            1 Reply Last reply Reply Quote 0
                            • N Offline
                              nevr0sed
                              last edited by

                              Ok,
                              I have deleted the 2 rules mentioned.

                              Yes I can ping 192.168.2.1
                              I can also have access to the PFsense Web Client…

                              When I try to go on www.google.com I get "ERR_CONNECTION_TIMED_OUT" on the page from the client.

                              1 Reply Last reply Reply Quote 0
                              • KOMK Offline
                                KOM
                                last edited by

                                I'll get back to you after lunch.

                                1 Reply Last reply Reply Quote 0
                                • N Offline
                                  nevr0sed
                                  last edited by

                                  @KOM:

                                  I'll get back to you after lunch.

                                  Bon appétit ! :)

                                  1 Reply Last reply Reply Quote 0
                                  • KOMK Offline
                                    KOM
                                    last edited by

                                    OK, so your client that is timing everything out.  You already gave me the output of ifconfig.  Any difference if you manually configure the client with static IP, netmask, DNS and gateway?

                                    1 Reply Last reply Reply Quote 0
                                    • N Offline
                                      nevr0sed
                                      last edited by

                                      Ok,

                                      Just to be sure in the manual config:

                                      IP : 192.168.2.2
                                      netmask : 255.255.255.0
                                      DNS : 192.168.2.1 (?)
                                      Gateway: 192.168.2.1 (?)

                                      I'm not sure about the DNS and the GW.

                                      Thank you.

                                      n.

                                      1 Reply Last reply Reply Quote 0
                                      • N Offline
                                        nevr0sed
                                        last edited by

                                        @nevr0sed:

                                        Ok,

                                        Just to be sure in the manual config:

                                        IP : 192.168.2.2
                                        netmask : 255.255.255.0
                                        DNS : 192.168.2.1 (?)
                                        Gateway: 192.168.2.1 (?)

                                        I'm not sure about the DNS and the GW.

                                        Thank you.

                                        n.

                                        Ok with the config above, I still can ping the PFsense, the other lan (PRIVATELAN).
                                        Still no win with the pings on the www.
                                        Before this config, when I pinged www.google.com I got an IP address as return but ICMP fail. Now it tell me

                                        cannot resolve www.google.com : Unknown host. 
                                        

                                        So I guess that there is something to do with the DNS ?

                                        n.

                                        1 Reply Last reply Reply Quote 0
                                        • KOMK Offline
                                          KOM
                                          last edited by

                                          Gateway is correct, DNS can be the same as the gateway (pfsense) as long as you're running the DNS forwarder or resolver.  Just to be safe you could try setting DNS to 192.168.2.1 8.8.8.8 so that it falls back to Google DNS if pfSense DNS isn't running for whatever reason.

                                          1 Reply Last reply Reply Quote 0
                                          • T Offline
                                            tigs
                                            last edited by

                                            try deleting rule #1, 3, 4, and 5,  keep only rule #2.

                                            AND

                                            you can also define your gateway in the advanced section of the setting, instead of using "destinations"

                                            change PUBLICLAN address to PUBLICLAN net instead.

                                            You can also consider using two different rules for IPV4 and IPV6.

                                            this is what worked for me.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.