Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    1 WAN 2 LAN

    Scheduled Pinned Locked Moved General pfSense Questions
    39 Posts 7 Posters 8.0k Views 2 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N Offline
      nevr0sed
      last edited by

      Do I need to configure a Gateway specific for each LAN i have ?

      1 Reply Last reply Reply Quote 0
      • KOMK Offline
        KOM
        last edited by

        No, only WAN needs a gateway.  Your clients on each LAN however DO need a gateway or they won't be able to send traffic out fro their local network.

        Did you nuke all of your firewall rules and just keep the last one?

        1 Reply Last reply Reply Quote 0
        • N Offline
          nevr0sed
          last edited by

          Hey,

          Thanks for the reply

          Here are the rules that I have currently modified as you said.

          The weird thing is that I can ping from client on PUBLICLANINTERFACE any other clients on PRIVATELAN.

          Find also my rules on my WAN.

          Thank you

          gkrellShoot_03-03-16_165931.jpg
          gkrellShoot_03-03-16_165931.jpg_thumb
          gkrellShoot_03-03-16_170026.jpg
          gkrellShoot_03-03-16_170026.jpg_thumb

          1 Reply Last reply Reply Quote 0
          • KOMK Offline
            KOM
            last edited by

            LAN source should be *.  You should delete WAN rules 3 and 4 (the ones that reference PUBLICLANINTERFACE).  Can your client ping 192.168.2.1?

            1 Reply Last reply Reply Quote 0
            • N Offline
              nevr0sed
              last edited by

              Ok,
              I have deleted the 2 rules mentioned.

              Yes I can ping 192.168.2.1
              I can also have access to the PFsense Web Client…

              When I try to go on www.google.com I get "ERR_CONNECTION_TIMED_OUT" on the page from the client.

              1 Reply Last reply Reply Quote 0
              • KOMK Offline
                KOM
                last edited by

                I'll get back to you after lunch.

                1 Reply Last reply Reply Quote 0
                • N Offline
                  nevr0sed
                  last edited by

                  @KOM:

                  I'll get back to you after lunch.

                  Bon appétit ! :)

                  1 Reply Last reply Reply Quote 0
                  • KOMK Offline
                    KOM
                    last edited by

                    OK, so your client that is timing everything out.  You already gave me the output of ifconfig.  Any difference if you manually configure the client with static IP, netmask, DNS and gateway?

                    1 Reply Last reply Reply Quote 0
                    • N Offline
                      nevr0sed
                      last edited by

                      Ok,

                      Just to be sure in the manual config:

                      IP : 192.168.2.2
                      netmask : 255.255.255.0
                      DNS : 192.168.2.1 (?)
                      Gateway: 192.168.2.1 (?)

                      I'm not sure about the DNS and the GW.

                      Thank you.

                      n.

                      1 Reply Last reply Reply Quote 0
                      • N Offline
                        nevr0sed
                        last edited by

                        @nevr0sed:

                        Ok,

                        Just to be sure in the manual config:

                        IP : 192.168.2.2
                        netmask : 255.255.255.0
                        DNS : 192.168.2.1 (?)
                        Gateway: 192.168.2.1 (?)

                        I'm not sure about the DNS and the GW.

                        Thank you.

                        n.

                        Ok with the config above, I still can ping the PFsense, the other lan (PRIVATELAN).
                        Still no win with the pings on the www.
                        Before this config, when I pinged www.google.com I got an IP address as return but ICMP fail. Now it tell me

                        cannot resolve www.google.com : Unknown host. 
                        

                        So I guess that there is something to do with the DNS ?

                        n.

                        1 Reply Last reply Reply Quote 0
                        • KOMK Offline
                          KOM
                          last edited by

                          Gateway is correct, DNS can be the same as the gateway (pfsense) as long as you're running the DNS forwarder or resolver.  Just to be safe you could try setting DNS to 192.168.2.1 8.8.8.8 so that it falls back to Google DNS if pfSense DNS isn't running for whatever reason.

                          1 Reply Last reply Reply Quote 0
                          • T Offline
                            tigs
                            last edited by

                            try deleting rule #1, 3, 4, and 5,  keep only rule #2.

                            AND

                            you can also define your gateway in the advanced section of the setting, instead of using "destinations"

                            change PUBLICLAN address to PUBLICLAN net instead.

                            You can also consider using two different rules for IPV4 and IPV6.

                            this is what worked for me.

                            1 Reply Last reply Reply Quote 0
                            • N Offline
                              nevr0sed
                              last edited by

                              @KOM:

                              Gateway is correct, DNS can be the same as the gateway (pfsense) as long as you're running the DNS forwarder or resolver.  Just to be safe you could try setting DNS to 192.168.2.1 8.8.8.8 so that it falls back to Google DNS if pfSense DNS isn't running for whatever reason.

                              Thanks, ok just to be sure where shall I add this DNS ?
                              In the DHCP configuration or elsewhere ?

                              Find attached a couple of screens.

                              gkrellShoot_03-03-16_212334.jpg
                              gkrellShoot_03-03-16_212334.jpg_thumb
                              gkrellShoot_03-03-16_212406.jpg
                              gkrellShoot_03-03-16_212406.jpg_thumb

                              1 Reply Last reply Reply Quote 0
                              • N Offline
                                nevr0sed
                                last edited by

                                @tigs:

                                try deleting rule #1, 3, 4, and 5,  keep only rule #2.

                                AND

                                change PUBLICLAN address to PUBLICLAN net instead.

                                You can also consider using two different rules for IPV4 and IPV6.

                                Hi Tigs,
                                Thanks for your help.

                                This is the current rules I have. As I have modified some.

                                Let me know which ones to delete again, and on which interface.

                                Thank you very much !

                                n.

                                gkrellShoot_03-03-16_213103.jpg
                                gkrellShoot_03-03-16_213103.jpg_thumb
                                gkrellShoot_03-03-16_213113.jpg
                                gkrellShoot_03-03-16_213113.jpg_thumb

                                1 Reply Last reply Reply Quote 0
                                • KOMK Offline
                                  KOM
                                  last edited by

                                  Thanks, ok just to be sure where shall I add this DNS ?

                                  In your client's TCP/IP config.  I'm a little busy in my real job at the moment applying a bunch of ESXi patches so I can't give this much attention for the next little while.

                                  1 Reply Last reply Reply Quote 0
                                  • T Offline
                                    tigs
                                    last edited by

                                    @nevr0sed:

                                    @tigs:

                                    try deleting rule #1, 3, 4, and 5,  keep only rule #2.

                                    AND

                                    change PUBLICLAN address to PUBLICLAN net instead.

                                    You can also consider using two different rules for IPV4 and IPV6.

                                    Hi Tigs,
                                    Thanks for your help.

                                    This is the current rules I have. As I have modified some.

                                    Let me know which ones to delete again, and on which interface.

                                    Thank you very much !

                                    n.

                                    You need to define "source" which is the "PUBLICLANINTERFACE net".

                                    1 Reply Last reply Reply Quote 0
                                    • N Offline
                                      nevr0sed
                                      last edited by

                                      Ok,

                                      I have done what you said. I have tried putting other rules such as :
                                      But nothing works.

                                      • PUBLICLANINTERFACE

                                      • Source: * – Dest: *

                                      • Source: EXTERNALWAN – Dest: *

                                      • Source: * – Dest: EXTERNALWAN

                                      • EXTERNALWAN

                                      • Source: PUBLICLANINTERFACE – Dest: *

                                      • Source: * – Dest: PUBLICLANINTERFACE

                                      Maybe, but I am no expert, can't it be something related to the DNS or Gateway ?

                                      Thanks again for all the support guys.

                                      n.

                                      1 Reply Last reply Reply Quote 0
                                      • T Offline
                                        tigs
                                        last edited by

                                        @nevr0sed:

                                        Ok,

                                        I have done what you said. I have tried putting other rules such as :
                                        But nothing works.

                                        • PUBLICLANINTERFACE

                                        • Source: * – Dest: *

                                        • Source: EXTERNALWAN – Dest: *

                                        • Source: * – Dest: EXTERNALWAN

                                        • EXTERNALWAN

                                        • Source: PUBLICLANINTERFACE – Dest: *

                                        • Source: * – Dest: PUBLICLANINTERFACE

                                        Maybe, but I am no expert, can't it be something related to the DNS or Gateway ?

                                        Thanks again for all the support guys.

                                        n.

                                        1 Reply Last reply Reply Quote 0
                                        • N Offline
                                          nevr0sed
                                          last edited by

                                          @tigs:

                                          What you did is not what I said for sure. You need to read carefully.

                                          You are over-complicating things, which may not always be a good thing.

                                          You need:

                                          1, Get rid of all your WAN rules, at least for the sake of trouble shooting. Someone already mentioned that to you.
                                          2, you only need one rule for the PUBLICLANINTERFACE, Which I also said as well. I have attached a picture of what a working rule should look like.

                                          Yes sure, it's what I did. I have tried in the very first place what you guys told me, and redid it, with no success.

                                          I have tried with and without the Gateway.  Still the same, no internet connection. But all networks are pingable.

                                          Thanks again.

                                          n.

                                          1 Reply Last reply Reply Quote 0
                                          • KOMK Offline
                                            KOM
                                            last edited by

                                            This really shouldn't be this hard.  Let's start from the beginning.

                                            Your OPT1 interface, aka new NIC, is configured as 192.168.2.1.  You havea firewall rule on OPT1 tab that allows all for IPv4.  You have DHCP enabled with a range of 1-254, which isn't correct as the gateway address (192.168.2.1) should not be part of the DHCP address pool.  Your client gets its net config via DHCP (192.168.2.2), but attempts to access websites result in a timeout.

                                            How is your client connected to OPT1, via a switch?  What OS is your client running?

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.