Can't access pfsense web GUI from VLANs [Solved]
-
looks like your seeing dup.. I would turn off https for testing.. And then can you post up the actual pcap so I can open it in wireshark.
-
Not a problem.
I'm on it.
Heaps thanks man!!!! -
This is the pcap from PC on port 7.
(The icon on browser tab just turning and turning, no pfsense page title showing, weird thing is it's not like when we don't have internet, it will show you error page directly.)
Eventually the browser will show ERR_TIMED_OUT.
(For this pcap, I didn't wait untill the browser come up with that error, it's going to be long)
I I just start wireshark, put address in browser hit enter, wait 5/10 seconds, then save the pcap.
If wait until the error shows up will help I can do that, just say it.
(Also I tried to connect to 192.168.3.1, and 192.168.0.1)
(Last thing, https turned off in this pcap)
Thank you!!
-
ok just started looking at it, but why your browser try so many connections at the same time?? to 443?
What browser are you using?
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
-
Thanks man!
It's chrome, google chrome :o
And yes, that's exactly the user-agent string for chrome 50.0.2661.102 m -
It's late night here, I need to go to bed, sorry :-.
I will back here tomorrow, many thanks to you!!!! -
Oh, another weird thing is
If I do nslookup google.com 192.168.0.1 or nslookup google.com 192.168.3.1 nslookup google.com 192.168.0.101
They all work. -
Another finding:
On the pc on port 7
If I do telnet 192.168.0.1 80 or telnet 192.168.3.1 80
as you see in p1, it seems I can get reply.
If I do telnet 192.168.100.1 80, it will fail, of course 192.168.100.1 does not exist on my network.
-
More finding
If I set rules in firewall for GUEST_AP_VL like this.reject GUEST_AP_VL net to any destination any port.
I try to open 192.168.0.1 and 192.168.3.1 in PC on port 7, the browser returns ERR_CONNECTION_REFUSED, which is right.
Any ideas? ??? ??? ???
-
Interesting, I think I've found problem.
I changed the MTU for vlan 12 to 1492. (My adsl MTU is 1492, but I don't understand why vlan MTU is related to gateway/ADSL MTU) (By default MTU it set to 1500)
But it works now. As long as I change the MTU to 1492, pc on part 7 can go to 192.168.0.1, 192.168.3.1, 192.168.2.1, eben with https on for pfsense web gui, it works.
Would you mind to confirm your MTU on vlans and your gateway for me and other on this forum please? So other won't get stuck like me ;D
Now I can move on on other rules etc. :PYour effort, help and time is appreciated!!
Thank you johnpoz!!!
-
I bet this has something to with the USB nics you're using, there's a reason why pros avoid them at all costs.
-
@kpa:
I bet this has something to with the USB nics you're using, there's a reason why pros avoid them at all costs.
You mean the MTU issue is caused by USB NIC?
Well, pros would have proper server, rack, UPS etc. don't they 8)
I'm still study though, but I would go PRO stuff if I have the money to buy and can afford bills etc. for sure :D
That's the dream of every or at least most of the tech savvies isn't it ;) -
My mtu is 1500.. on all devices.
There clearly was something going on in your trace.. Its like you just lost connection packets, possible it could of been large packet that got fragged..
USB interfaces are utter crap, why would you use them, you can pick up normal nics for like $10 that would be better than some usb nic.
Glad you got it sorted, for sure it was strange. But you can see in your sniff that your client is talking, you have a good handshake but when then its like something was missing.. And that packet you did get was not the next one..
-
My mtu is 1500.. on all devices.
There clearly was something going on in your trace.. Its like you just lost connection packets, possible it could of been large packet that got fragged..
USB interfaces are utter crap, why would you use them, you can pick up normal nics for like $10 that would be better than some usb nic.
Glad you got it sorted, for sure it was strange. But you can see in your sniff that your client is talking, you have a good handshake but when then its like something was missing.. And that packet you did get was not the next one..
Cool, so there must be something wrong with my stuff.
Oh, did I mention the server/host of pfsense virtual machine resides in is a laptop? ;D
It's a retired laptop, and yes again, it's been like this for 2 years.
Otherwise I'd go with proper NIC for absolutely sure
I know you will be like this :o haha(BTW, all of my other devices are all running with 1500 MTU as well, but ADLS is PPPoE so been forced to MTU 1492 for adsl gateway)
Thanks anyway ;D
-
My mtu is 1500.. on all devices.
There clearly was something going on in your trace.. Its like you just lost connection packets, possible it could of been large packet that got fragged..
USB interfaces are utter crap, why would you use them, you can pick up normal nics for like $10 that would be better than some usb nic.
Glad you got it sorted, for sure it was strange. But you can see in your sniff that your client is talking, you have a good handshake but when then its like something was missing.. And that packet you did get was not the next one..
Well, heaps of trial and error + some luck, finally it's working now :P
-
Why don't you just run vlans on your physical nic vs damn usb nics?
You can get a 8 port gig switch that does vlans for like $30…
-
Why don't you just run vlans on your physical nic vs damn usb nics?
You can get a 8 port gig switch that does vlans for like $30…
The physical nic is been used for DNS/email/file sharing stuff from windows server haha ;D
Oh, the switch has 24 ports (gig), I bought it when it was on discount ;D, currently ports are enough I think -
does it do vlans?? If so then you don't need usb nics to run pfsense on your laptop. Just vlan the traffic into the one physical nic.
-
does it do vlans?? If so then you don't need usb nics to run pfsense on your laptop. Just vlan the traffic into the one physical nic.
What? Sorry probably I don't get it.
But I think the answer is yes? I've attached the screen of the configuration GUI for the switch.
You mean port based? If so, actually I was running on port based vlan from switch.
But now I have an AP which can do vlan and only via vlan tags I guess, but with only 1 NIC port. That's why I'm switching from port based vlan to tag based vlan.
Port based vlan, is that what you mean? ;)
-
No I mean tagged based.. Just run your wan and lan and whatever other networks you want on vlans. Connect this to your laptop physical nic. Throw away the crap usb nics.
