1 WAN 2 LAN

[AaronvaB]

Hi nevr0sed

Have you made the Firewall Rules for the new LAN?

Aaron

[nevr0sed]

Hello

Yes this are the rules I have made.

But I am really not sure about them.

What kind of rule shall I put on the WAN interface ?

Thanks.

nevr0sed

[KOM]

Your WAN should have no rules unless you are allowing access in for port forwards, for example.

For testing purposes, you only need the very last rule that allows all traffic.  Once it's working, then you can worry about tightening up your rules.  Since the last rule will allow access to the Internet, I have to wonder if you have your problem is with your PUBLICLANINTERFACE clients or DHCP configuration.  From a client, can you ping 8.8.8.8?

[nevr0sed]

Hello KOM,

No from a Client I cannot ping 8.8.8.8
Request timeout for icmp_seq…

Thanks

[KOM]

1 LAN (new) - 192.168.2.1 - DHCP Range ; 192.168.2.1 - 254 /24

What's the IP address of your client?  In the above DHCP detail, you seem to be including the PUBLICLANINTERFACE IP address in your DHCP pool.  I don't suppose your client is using the same IP address?  From your client, please run a command prompt and post the output of ipconfig if Windows, or run a terminal and post the output of ifconfig if Linux.

[nevr0sed]

The IP address of my client on PUBLICLANINTERFACE is : 192.168.2.2

Here is the ifconfig output

lo0: flags=8049 <up,loopback,running,multicast>mtu 16384
        options=3 <rxcsum,txcsum>inet6 ::1 prefixlen 128 
        inet 127.0.0.1 netmask 0xff000000 
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 
        nd6 options=1 <performnud>gif0: flags=8010 <pointopoint,multicast>mtu 1280
stf0: flags=0<> mtu 1280
en0: flags=8863 <up,broadcast,smart,running,simplex,multicast>mtu 1500
        options=10b <rxcsum,txcsum,vlan_hwtagging,av>ether 00:00:00:00:0:00 
        inet6 0000::0000:0000:0000:5764%en0 prefixlen 64 scopeid 0x4 
        inet 192.168.2.2 netmask 0xffffff00 broadcast 192.168.2.255
        nd6 options=1 <performnud>media: autoselect (1000baseT <full-duplex,flow-control,energy-efficient-ethernet>)
        status: active
en1: flags=8823 <up,broadcast,smart,simplex,multicast>mtu 1500
        ether 00:00:00:00:0:00
        nd6 options=1 <performnud>media: autoselect (<unknown type="">)
        status: inactive
en2: flags=8963 <up,broadcast,smart,running,promisc,simplex,multicast>mtu 1500
        options=60 <tso4,tso6>ether 00:00:00:00:0:00 
        media: autoselect <full-duplex>status: inactive
fw0: flags=8863 <up,broadcast,smart,running,simplex,multicast>mtu 4078
        lladdr 00:00:00:00:0:00 
        nd6 options=1 <performnud>media: autoselect <full-duplex>status: inactive
p2p0: flags=8802 <broadcast,simplex,multicast>mtu 2304
        ether 00:00:00:00:0:00 
        media: autoselect
        status: inactive
awdl0: flags=8902 <broadcast,promisc,simplex,multicast>mtu 1452
        ether 00:00:00:00:0:00 
        nd6 options=1 <performnud>media: autoselect
        status: inactive
bridge0: flags=8863 <up,broadcast,smart,running,simplex,multicast>mtu 1500
        options=63 <rxcsum,txcsum,tso4,tso6>ether 00:00:00:00:0:00 
        Configuration:
                id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
                maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
                root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
                ipfilter disabled flags 0x2
        member: en2 flags=3 <learning,discover>ifmaxaddr 0 port 6 priority 0 path cost 0
        nd6 options=1 <performnud>media: <unknown type="">status: inactive</unknown></performnud></learning,discover></rxcsum,txcsum,tso4,tso6></up,broadcast,smart,running,simplex,multicast></performnud></broadcast,promisc,simplex,multicast></broadcast,simplex,multicast></full-duplex></performnud></up,broadcast,smart,running,simplex,multicast></full-duplex></tso4,tso6></up,broadcast,smart,running,promisc,simplex,multicast></unknown></performnud></up,broadcast,smart,simplex,multicast></full-duplex,flow-control,energy-efficient-ethernet></performnud></rxcsum,txcsum,vlan_hwtagging,av></up,broadcast,smart,running,simplex,multicast></pointopoint,multicast></performnud></rxcsum,txcsum></up,loopback,running,multicast> 

Thank you very much for your help.

[nevr0sed]

Hello,

Any one can help ? I cannot figure out why it isn't working.

I is there anything to do with the DNS ?
What should be the DHCP server IP ?
What should be the DHCP server Range ?

Thanks for your help.

nevr0sed

[nevr0sed]

Do I need to configure a Gateway specific for each LAN i have ?

[KOM]

No, only WAN needs a gateway.  Your clients on each LAN however DO need a gateway or they won't be able to send traffic out fro their local network.

Did you nuke all of your firewall rules and just keep the last one?

[nevr0sed]

Hey,

Thanks for the reply

Here are the rules that I have currently modified as you said.

The weird thing is that I can ping from client on PUBLICLANINTERFACE any other clients on PRIVATELAN.

Find also my rules on my WAN.

Thank you

[KOM]

LAN source should be *.  You should delete WAN rules 3 and 4 (the ones that reference PUBLICLANINTERFACE).  Can your client ping 192.168.2.1?

[nevr0sed]

Ok,
I have deleted the 2 rules mentioned.

Yes I can ping 192.168.2.1
I can also have access to the PFsense Web Client…

When I try to go on www.google.com I get "ERR_CONNECTION_TIMED_OUT" on the page from the client.

[KOM]

I'll get back to you after lunch.

[nevr0sed]

@KOM:

I'll get back to you after lunch.

Bon appétit ! :)

[KOM]

OK, so your client that is timing everything out.  You already gave me the output of ifconfig.  Any difference if you manually configure the client with static IP, netmask, DNS and gateway?

[nevr0sed]

Ok,

Just to be sure in the manual config:

IP : 192.168.2.2
netmask : 255.255.255.0
DNS : 192.168.2.1 (?)
Gateway: 192.168.2.1 (?)

I'm not sure about the DNS and the GW.

Thank you.

n.

[nevr0sed]

@nevr0sed:

Ok,

Just to be sure in the manual config:

IP : 192.168.2.2
netmask : 255.255.255.0
DNS : 192.168.2.1 (?)
Gateway: 192.168.2.1 (?)

I'm not sure about the DNS and the GW.

Thank you.

n.

Ok with the config above, I still can ping the PFsense, the other lan (PRIVATELAN).
Still no win with the pings on the www.
Before this config, when I pinged www.google.com I got an IP address as return but ICMP fail. Now it tell me

cannot resolve www.google.com : Unknown host. 

So I guess that there is something to do with the DNS ?

n.

[KOM]

Gateway is correct, DNS can be the same as the gateway (pfsense) as long as you're running the DNS forwarder or resolver.  Just to be safe you could try setting DNS to 192.168.2.1 8.8.8.8 so that it falls back to Google DNS if pfSense DNS isn't running for whatever reason.

[tigs]

try deleting rule #1, 3, 4, and 5,  keep only rule #2.

AND

you can also define your gateway in the advanced section of the setting, instead of using "destinations"

change PUBLICLAN address to PUBLICLAN net instead.

You can also consider using two different rules for IPV4 and IPV6.

this is what worked for me.

[nevr0sed]

@KOM:

Gateway is correct, DNS can be the same as the gateway (pfsense) as long as you're running the DNS forwarder or resolver.  Just to be safe you could try setting DNS to 192.168.2.1 8.8.8.8 so that it falls back to Google DNS if pfSense DNS isn't running for whatever reason.

Thanks, ok just to be sure where shall I add this DNS ?
In the DHCP configuration or elsewhere ?

Find attached a couple of screens.