• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Can't access pfsense web GUI from VLANs [Solved]

Scheduled Pinned Locked Moved General pfSense Questions
58 Posts 3 Posters 18.8k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • J
    johnpoz LAYER 8 Global Moderator
    last edited by May 29, 2016, 12:23 PM

    My the way that link is not something I would ever suggest anyone should ever be in.. He is running 2 layer 3 networks over the same layer 2.. That is BROKEN no matter how you look at it.. Period, your not in that sort of setup..

    An intelligent man is sometimes forced to be drunk to spend time with his fools
    If you get confused: Listen to the Music Play
    Please don't Chat/PM me for help, unless mod related
    SG-4860 24.11 | Lab VMs 2.8, 24.11

    1 Reply Last reply Reply Quote 0
    • P
      PFbest
      last edited by May 29, 2016, 12:27 PM

      @johnpoz:

      My the way that link is not something I would ever suggest anyone should ever be in.. He is running 2 layer 3 networks over the same layer 2.. That is BROKEN no matter how you look at it.. Period, your not in that sort of setup..

      Yep, cool, I don't have layer 3 switch
      Thanks for confirming!

      1 Reply Last reply Reply Quote 0
      • P
        PFbest
        last edited by May 29, 2016, 12:30 PM

        @johnpoz:

        So I have multiple vlans..  Comes down to your rules be it you can access or not..

        So see attached, on my wifi segment I can access gui on both my wlan pfsense IP, and my pfsense Lan IP..  This is because I have a specific rule for my ipad to go anywhere.  If I try it from my wifes laptop the block all to firewall ips block it, etc.

        Do you have any floating rules that would block this - that would be my guess!!

        My floating rules is not blocking anything I guess?
        I've attached as image.

        floating-a.png
        floating-a.png_thumb
        voip-a.png
        voip-a.png_thumb
        guest-a.png
        guest-a.png_thumb

        1 Reply Last reply Reply Quote 0
        • J
          johnpoz LAYER 8 Global Moderator
          last edited by May 29, 2016, 1:59 PM

          Not sure what you thought that article had to do with a layer 3 switch.. That idiot was running 2 different networks on the same layer 2 with just trying to put a vip on the interface in the other network..

          Ok you sure your just not having a problem accessing the web gui from this client, something wrong with its browser, the cert you have on the gui, you runnint it on some odd port?  You using a proxy on this client?  Do you have transparent proxy setup on psfense?

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • P
            PFbest
            last edited by May 29, 2016, 2:15 PM

            @johnpoz:

            Not sure what you thought that article had to do with a layer 3 switch.. That idiot was running 2 different networks on the same layer 2 with just trying to put a vip on the interface in the other network..

            Ok you sure your just not having a problem accessing the web gui from this client, something wrong with its browser, the cert you have on the gui, you runnint it on some odd port?  You using a proxy on this client?  Do you have transparent proxy setup on psfense?

            Ok, forget about the link haha  ;D
            Um, client should be fine I think, previously I tried on physical laptop, now I'm using windows in my VM workstation in my laptop.
            (I passed the same module of USB nic directly to this VM, so eliminate bridge/NAT etc.)
            But same results anyway. Can't access to web gui but no problem to ping.
            Actually I do have proxy on 192.168.0.102 (I promise I eliminated proxy), but I did not use the proxy for testing web gui. (BTW, 192.168.3.1 can't access proxy as well, but it can access 192.168.101, I guess it's the iptable's problem) (Again, browsers are setted to not using proxy, not even auto proxy) (It's not transparent as well, so should be fine I think)
            Now the pfsense cert part, it's the default one comes with pfsense, so it's invalid, I used it for 2 years, just click ignore in browser you know. (Will that be problem??  :o)
            Odd port? Um, shouldn't be I think. all things should be normal I guess.
            No transparent proxy, and in pfsense there's no proxy at all  :P (squid is not installed on pfsense and pfsense is not using proxy from 192.168.0.102)

            1 Reply Last reply Reply Quote 0
            • P
              PFbest
              last edited by May 29, 2016, 2:36 PM May 29, 2016, 2:19 PM

              Also this is what I get when I hit enter key in browser url input filed.
              (url is https://192.168.3.1)
              (Two times)

              wire.png
              wire.png_thumb
              wire_error2.png
              wire_error2.png_thumb

              1 Reply Last reply Reply Quote 0
              • P
                PFbest
                last edited by May 29, 2016, 2:26 PM

                from 192.168.0.74
                (ignore cert error already clicked)

                wire_.0.74.png
                wire_.0.74.png_thumb

                1 Reply Last reply Reply Quote 0
                • J
                  johnpoz LAYER 8 Global Moderator
                  last edited by May 29, 2016, 2:45 PM

                  looks like your seeing dup.. I would turn off https for testing.. And then can you post up the actual pcap so I can open it in wireshark.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  1 Reply Last reply Reply Quote 0
                  • P
                    PFbest
                    last edited by May 29, 2016, 2:52 PM

                    Not a problem.
                    I'm on it.
                    Heaps thanks man!!!!

                    1 Reply Last reply Reply Quote 0
                    • P
                      PFbest
                      last edited by May 29, 2016, 3:09 PM May 29, 2016, 3:05 PM

                      This is the pcap from PC on port 7.
                      (The icon on browser tab just turning and turning, no pfsense page title showing, weird thing is it's not like when we don't have internet, it will show you error page directly.)
                      Eventually the browser will show ERR_TIMED_OUT.
                      (For this pcap, I didn't wait untill the browser come up with that error, it's going to be long)
                      I I just start wireshark, put address in browser hit enter, wait 5/10 seconds, then save the pcap.
                      If wait until the error shows up will help I can do that, just say it.
                      (Also I tried to connect to 192.168.3.1, and 192.168.0.1)
                      (Last thing, https turned off in this pcap)
                      Thank you!!!

                      [PC on port 7, 192.168.3.10.pcap](/public/imported_attachments/1/PC on port 7, 192.168.3.10.pcap)

                      1 Reply Last reply Reply Quote 0
                      • J
                        johnpoz LAYER 8 Global Moderator
                        last edited by May 29, 2016, 3:18 PM May 29, 2016, 3:15 PM

                        ok just started looking at it, but why your browser try so many connections at the same time?? to 443?

                        What browser are you using?

                        User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36

                        whyyourbrowser.png
                        whyyourbrowser.png_thumb

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        1 Reply Last reply Reply Quote 0
                        • P
                          PFbest
                          last edited by May 29, 2016, 3:47 PM

                          Thanks man!
                          It's chrome, google chrome  :o
                          And yes, that's exactly the user-agent string for chrome 50.0.2661.102 m

                          1 Reply Last reply Reply Quote 0
                          • P
                            PFbest
                            last edited by May 29, 2016, 4:20 PM

                            It's late night here, I need to go to bed, sorry  :-.
                            I will back here tomorrow, many thanks to you!!!!

                            1 Reply Last reply Reply Quote 0
                            • P
                              PFbest
                              last edited by May 29, 2016, 4:24 PM

                              Oh, another weird thing is
                              If I do nslookup google.com 192.168.0.1 or nslookup google.com 192.168.3.1 nslookup google.com 192.168.0.101
                              They all work.

                              1 Reply Last reply Reply Quote 0
                              • P
                                PFbest
                                last edited by May 29, 2016, 4:31 PM

                                Another finding:
                                On the pc on port 7
                                If I do telnet 192.168.0.1 80 or telnet 192.168.3.1 80
                                as you see in p1, it seems I can get reply.
                                If I do telnet 192.168.100.1 80, it will fail, of course 192.168.100.1 does not exist on my network.

                                p1.png
                                p1.png_thumb
                                p2.png
                                p2.png_thumb

                                1 Reply Last reply Reply Quote 0
                                • P
                                  PFbest
                                  last edited by May 30, 2016, 9:15 AM

                                  More finding
                                  If I set rules in firewall for GUEST_AP_VL like this.

                                  reject GUEST_AP_VL net to any destination any port.

                                  I try to open 192.168.0.1 and 192.168.3.1 in PC on port 7, the browser returns ERR_CONNECTION_REFUSED, which is right.

                                  Any ideas?  ??? ??? ???

                                  1 Reply Last reply Reply Quote 0
                                  • P
                                    PFbest
                                    last edited by May 30, 2016, 10:11 AM

                                    Interesting, I think I've found problem.
                                    I changed the MTU for vlan 12 to 1492. (My adsl MTU is 1492, but I don't understand why vlan MTU is related to gateway/ADSL MTU) (By default MTU it set to 1500)
                                    But it works now. As long as I change the MTU to 1492, pc on part 7 can go to 192.168.0.1, 192.168.3.1, 192.168.2.1, eben with https on for pfsense web gui, it works.
                                    Would you mind to confirm your MTU on vlans and your gateway for me and other on this forum please? So other won't get stuck like me  ;D
                                    Now I can move on on other rules etc. :P

                                    Your effort, help and time is appreciated!!

                                    Thank you johnpoz!!!

                                    1 Reply Last reply Reply Quote 0
                                    • K
                                      kpa
                                      last edited by May 30, 2016, 10:25 AM

                                      I bet this has something to with the USB nics you're using, there's a reason why pros avoid them at all costs.

                                      1 Reply Last reply Reply Quote 0
                                      • P
                                        PFbest
                                        last edited by May 30, 2016, 11:16 AM May 30, 2016, 11:11 AM

                                        @kpa:

                                        I bet this has something to with the USB nics you're using, there's a reason why pros avoid them at all costs.

                                        You mean the MTU issue is caused by USB NIC?
                                        Well, pros would have proper server, rack, UPS etc. don't they  8)
                                        I'm still study though, but I would go PRO stuff if I have the money to buy and can afford bills etc. for sure  :D
                                        That's the dream of every or at least most of the tech savvies isn't it  ;)

                                        1 Reply Last reply Reply Quote 0
                                        • J
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by May 30, 2016, 11:38 AM

                                          My mtu is 1500.. on all devices.

                                          There clearly was something going on in your trace.. Its like you just lost connection packets, possible it could of been large packet that got fragged..

                                          USB interfaces are utter crap, why would you use them, you can pick up normal nics for like $10 that would be better than some usb nic.

                                          Glad you got it sorted, for sure it was strange.  But you can see in your sniff that your client is talking, you have a good handshake but when then its like something was missing.. And that packet you did get was not the next one..

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          1 Reply Last reply Reply Quote 0
                                          30 out of 58
                                          • First post
                                            30/58
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received