Can't access pfsense web GUI from VLANs [Solved]
-
My the way that link is not something I would ever suggest anyone should ever be in.. He is running 2 layer 3 networks over the same layer 2.. That is BROKEN no matter how you look at it.. Period, your not in that sort of setup..
-
My the way that link is not something I would ever suggest anyone should ever be in.. He is running 2 layer 3 networks over the same layer 2.. That is BROKEN no matter how you look at it.. Period, your not in that sort of setup..
Yep, cool, I don't have layer 3 switch
Thanks for confirming! -
So I have multiple vlans.. Comes down to your rules be it you can access or not..
So see attached, on my wifi segment I can access gui on both my wlan pfsense IP, and my pfsense Lan IP.. This is because I have a specific rule for my ipad to go anywhere. If I try it from my wifes laptop the block all to firewall ips block it, etc.
Do you have any floating rules that would block this - that would be my guess!!
My floating rules is not blocking anything I guess?
I've attached as image.
-
Not sure what you thought that article had to do with a layer 3 switch.. That idiot was running 2 different networks on the same layer 2 with just trying to put a vip on the interface in the other network..
Ok you sure your just not having a problem accessing the web gui from this client, something wrong with its browser, the cert you have on the gui, you runnint it on some odd port? You using a proxy on this client? Do you have transparent proxy setup on psfense?
-
Not sure what you thought that article had to do with a layer 3 switch.. That idiot was running 2 different networks on the same layer 2 with just trying to put a vip on the interface in the other network..
Ok you sure your just not having a problem accessing the web gui from this client, something wrong with its browser, the cert you have on the gui, you runnint it on some odd port? You using a proxy on this client? Do you have transparent proxy setup on psfense?
Ok, forget about the link haha ;D
Um, client should be fine I think, previously I tried on physical laptop, now I'm using windows in my VM workstation in my laptop.
(I passed the same module of USB nic directly to this VM, so eliminate bridge/NAT etc.)
But same results anyway. Can't access to web gui but no problem to ping.
Actually I do have proxy on 192.168.0.102 (I promise I eliminated proxy), but I did not use the proxy for testing web gui. (BTW, 192.168.3.1 can't access proxy as well, but it can access 192.168.101, I guess it's the iptable's problem) (Again, browsers are setted to not using proxy, not even auto proxy) (It's not transparent as well, so should be fine I think)
Now the pfsense cert part, it's the default one comes with pfsense, so it's invalid, I used it for 2 years, just click ignore in browser you know. (Will that be problem?? :o)
Odd port? Um, shouldn't be I think. all things should be normal I guess.
No transparent proxy, and in pfsense there's no proxy at all :P (squid is not installed on pfsense and pfsense is not using proxy from 192.168.0.102) -
Also this is what I get when I hit enter key in browser url input filed.
(url is https://192.168.3.1)
(Two times)
-
from 192.168.0.74
(ignore cert error already clicked)
-
looks like your seeing dup.. I would turn off https for testing.. And then can you post up the actual pcap so I can open it in wireshark.
-
Not a problem.
I'm on it.
Heaps thanks man!!!! -
This is the pcap from PC on port 7.
(The icon on browser tab just turning and turning, no pfsense page title showing, weird thing is it's not like when we don't have internet, it will show you error page directly.)
Eventually the browser will show ERR_TIMED_OUT.
(For this pcap, I didn't wait untill the browser come up with that error, it's going to be long)
I I just start wireshark, put address in browser hit enter, wait 5/10 seconds, then save the pcap.
If wait until the error shows up will help I can do that, just say it.
(Also I tried to connect to 192.168.3.1, and 192.168.0.1)
(Last thing, https turned off in this pcap)
Thank you!!![PC on port 7, 192.168.3.10.pcap](/public/imported_attachments/1/PC on port 7, 192.168.3.10.pcap)
-
ok just started looking at it, but why your browser try so many connections at the same time?? to 443?
What browser are you using?
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
-
Thanks man!
It's chrome, google chrome :o
And yes, that's exactly the user-agent string for chrome 50.0.2661.102 m -
It's late night here, I need to go to bed, sorry :-.
I will back here tomorrow, many thanks to you!!!! -
Oh, another weird thing is
If I do nslookup google.com 192.168.0.1 or nslookup google.com 192.168.3.1 nslookup google.com 192.168.0.101
They all work. -
Another finding:
On the pc on port 7
If I do telnet 192.168.0.1 80 or telnet 192.168.3.1 80
as you see in p1, it seems I can get reply.
If I do telnet 192.168.100.1 80, it will fail, of course 192.168.100.1 does not exist on my network.
-
More finding
If I set rules in firewall for GUEST_AP_VL like this.reject GUEST_AP_VL net to any destination any port.
I try to open 192.168.0.1 and 192.168.3.1 in PC on port 7, the browser returns ERR_CONNECTION_REFUSED, which is right.
Any ideas? ??? ??? ???
-
Interesting, I think I've found problem.
I changed the MTU for vlan 12 to 1492. (My adsl MTU is 1492, but I don't understand why vlan MTU is related to gateway/ADSL MTU) (By default MTU it set to 1500)
But it works now. As long as I change the MTU to 1492, pc on part 7 can go to 192.168.0.1, 192.168.3.1, 192.168.2.1, eben with https on for pfsense web gui, it works.
Would you mind to confirm your MTU on vlans and your gateway for me and other on this forum please? So other won't get stuck like me ;D
Now I can move on on other rules etc. :PYour effort, help and time is appreciated!!
Thank you johnpoz!!!
-
I bet this has something to with the USB nics you're using, there's a reason why pros avoid them at all costs.
-
@kpa:
I bet this has something to with the USB nics you're using, there's a reason why pros avoid them at all costs.
You mean the MTU issue is caused by USB NIC?
Well, pros would have proper server, rack, UPS etc. don't they 8)
I'm still study though, but I would go PRO stuff if I have the money to buy and can afford bills etc. for sure :D
That's the dream of every or at least most of the tech savvies isn't it ;) -
My mtu is 1500.. on all devices.
There clearly was something going on in your trace.. Its like you just lost connection packets, possible it could of been large packet that got fragged..
USB interfaces are utter crap, why would you use them, you can pick up normal nics for like $10 that would be better than some usb nic.
Glad you got it sorted, for sure it was strange. But you can see in your sniff that your client is talking, you have a good handshake but when then its like something was missing.. And that packet you did get was not the next one..
-
My mtu is 1500.. on all devices.
There clearly was something going on in your trace.. Its like you just lost connection packets, possible it could of been large packet that got fragged..
USB interfaces are utter crap, why would you use them, you can pick up normal nics for like $10 that would be better than some usb nic.
Glad you got it sorted, for sure it was strange. But you can see in your sniff that your client is talking, you have a good handshake but when then its like something was missing.. And that packet you did get was not the next one..
Cool, so there must be something wrong with my stuff.
Oh, did I mention the server/host of pfsense virtual machine resides in is a laptop? ;D
It's a retired laptop, and yes again, it's been like this for 2 years.
Otherwise I'd go with proper NIC for absolutely sure
I know you will be like this :o haha(BTW, all of my other devices are all running with 1500 MTU as well, but ADLS is PPPoE so been forced to MTU 1492 for adsl gateway)
Thanks anyway ;D
-
My mtu is 1500.. on all devices.
There clearly was something going on in your trace.. Its like you just lost connection packets, possible it could of been large packet that got fragged..
USB interfaces are utter crap, why would you use them, you can pick up normal nics for like $10 that would be better than some usb nic.
Glad you got it sorted, for sure it was strange. But you can see in your sniff that your client is talking, you have a good handshake but when then its like something was missing.. And that packet you did get was not the next one..
Well, heaps of trial and error + some luck, finally it's working now :P
-
Why don't you just run vlans on your physical nic vs damn usb nics?
You can get a 8 port gig switch that does vlans for like $30…
-
Why don't you just run vlans on your physical nic vs damn usb nics?
You can get a 8 port gig switch that does vlans for like $30…
The physical nic is been used for DNS/email/file sharing stuff from windows server haha ;D
Oh, the switch has 24 ports (gig), I bought it when it was on discount ;D, currently ports are enough I think -
does it do vlans?? If so then you don't need usb nics to run pfsense on your laptop. Just vlan the traffic into the one physical nic.
-
does it do vlans?? If so then you don't need usb nics to run pfsense on your laptop. Just vlan the traffic into the one physical nic.
What? Sorry probably I don't get it.
But I think the answer is yes? I've attached the screen of the configuration GUI for the switch.
You mean port based? If so, actually I was running on port based vlan from switch.
But now I have an AP which can do vlan and only via vlan tags I guess, but with only 1 NIC port. That's why I'm switching from port based vlan to tag based vlan.
Port based vlan, is that what you mean? ;)
-
No I mean tagged based.. Just run your wan and lan and whatever other networks you want on vlans. Connect this to your laptop physical nic. Throw away the crap usb nics.
-
No I mean tagged based.. Just run your wan and lan and whatever other networks you want on vlans. Connect this to your laptop physical nic. Throw away the crap usb nics.
Oh, you mean with the switch + tag based vlan, I can go -> 1 laptop + 1 nic to deal both with WAN and LAN traffic, great idea, genius!
I might try this one later I guess.
I didn't realize I can do this when I was trying to use vlan for AP ;D you are pro man! -
Only possible issue comes down to bandwidth. Since your going to be hairpinning your connection from lan to wan..
So if gig most you could ever see between lan and wan would be 500 mbps, Vlans on an interface share the total physical bandwidth of that interface..
Performance wise prob still better off than usb crap. That would sure make for a cleaner looking setup running on some laptop with dual usb nics handing off of it, etc.
-
Only possible issue comes down to bandwidth. Since your going to be hairpinning your connection from lan to wan..
So if gig most you could ever see between lan and wan would be 500 mbps, Vlans on an interface share the total physical bandwidth of that interface..
Performance wise prob still better off than usb crap. That would sure make for a cleaner looking setup running on some laptop with dual usb nics handing off of it, etc.
Yep, actually you know why I switch to USB NIC at beginning?
When I was using physical NIC, if I go to pingtest.net, ping is fine, but I get results as -100%, because of the NIC will double ping or something like that. Unless I set the NIC for VM use only. Interesting isn't it.
Yep, probably I will leave as it is then, untill I can afford a proper rack server ;D -
Huh?? Not a clue to what your talking about..
-
Huh?? Not a clue to what your talking about..
Never mind, I guess I misunderstood your last post ::) ::) ::)
I mean, When I enable one same NIC both for physical machine and in virtual machine (Where pfsense sit on, as a gateway).
Then I go to pingtest.net, the result for ping section will be minus 100% (Normally should be 100% if there's no ping problem), and that is because the ping is been sent or responded twice :) -
Tell you one more crazy thing.
Those USB3 NICs are connected to a express card which plugged in laptop
::) ::) haha
Even more broke, I guess that's what you going to say. :P :D -
sure seems like it.. If you want to play get some hardware to play with. Doesn't have to be anything fancy for sure. But come on card in some old laptop with usb nics hanging off that, running vm software talk about a hodge podge jury rigged setup.
An old small pc with a couple of nics in it would be fine - can surely be had for a few bucks off ebay or something if budget is a concern.
-
sure seems like it.. If you want to play get some hardware to play with. Doesn't have to be anything fancy for sure. But come on card in some old laptop with usb nics hanging off that, running vm software talk about a hodge podge jury rigged setup.
An old small pc with a couple of nics in it would be fine - can surely be had for a few bucks off ebay or something if budget is a concern.
Yes, haha :P
Oh I know, like buy a second hand desktop or something like that ::)
Um, one or two more things will kick in is the electricity bill, laptop will generally eats less power than desktop I guess?
And the fan in the desktop will bring some noises I guess.
Oh, I want to mention that actually another great thing is laptop takes less space ;D, well, can't compare to blade servers I know. ;DBut yeah, I definitely know and understand what you are saying.
I can see and feel that with laptops, my playground is very limited, PCI/ports/hard disks etc.
Actually it can be tangled to decide to save for ultimate hardware in one shot, or upgrade gradually. -
How much power do you think a small box draws? I have older hp n40l with 4 disks in it, running multiple vms. It draws like 50-55w.. While yes it has fans, they are not noisy or anything..
Did you put a killawatt meter on how much your laptop draws? There are plenty of people getting old actual firewall hardware and running pfsense on it, etc. You can for sure build a low power box, no fan for very low budget to run pfsense on.. You don't have ot use freaking total crap because you have low budget..
-
How much power do you think a small box draws? I have older hp n40l with 4 disks in it, running multiple vms. It draws like 50-55w.. While yes it has fans, they are not noisy or anything..
Did you put a killawatt meter on how much your laptop draws? There are plenty of people getting old actual firewall hardware and running pfsense on it, etc. You can for sure build a low power box, no fan for very low budget to run pfsense on.. You don't have ot use freaking total crap because you have low budget..
hp n40l Um, learnt something new.
And you know what, just now I checked my laptop charger, label says it's 90W hahaha, I don't have a killawatt meter though.
I guess I might look into that then, hp n40l is on my sticky note now, thanks for that!! :P
You are amazing!!!
BTW, I think at least my set up can approve pfsense is quite robust and will work in any environment, such as a insane environment like mine hahaha. ;D ;D ;D
BTW2, it's a retired laptop, so I think I should make something or make use of it, that's how things started, previously it's just modem -> wireless router -> daily use computer ;)(It's a a pity that I can't thank you multiple times in this post ???)
-
First: I know it's not good to use USB NICs and yes, currently I'm still using it.
Just want to share some more experiences.
So I searched on Google and found this post https://forum.pfsense.org/index.php?topic=13014.msg70145#msg70145 https://forum.pfsense.org/index.php?topic=13014.msg70145#msg70145
As GruensFroeschli said:1: Well it depends on your setup.
If your client can handle oversized frames you should not have to change the MTU.
If the driver of your em-NIC's cannot handle oversized frames, you would have to change the MTU on the other side of the link, so no oversized frames arrive at your end.2: The problem is, that VLAN-tags add 4bytes to every frame.
–> frames can become bigger than the allowed maximum.Most drivers can handle this, but some have problems.
And some more about vlan and MTU: http://www.microhowto.info/tutorials/802.1q.html http://www.microhowto.info/tutorials/802.1q.html http://wiki.mikrotik.com/wiki/Manual:Interface/VLAN
So following this logic, I thought I will need to increase MTU size then.
I tried these steps, now VLANs with 1500 MTU works.
1. Enable Jumbo Packet for that LAN USB NIC on physical host not in virtual machine Windows in my case, and set maximum size to 4KB (I guess 2KB or 9KB etc. will work as well, see above links for WHY) (Most Intel NIC supports 9KB, but 4KB is enough for solving this problem though, will be a problem if you need to transfer big files between VLANs where all Intel NICs on PCs support 9KB but the LAN NIC on pfSense only support 4KB maximum, but that is not in this scope though.)
2. Set the actual LAN MTU to 4000 (Or anything greater than 1518) in pfSense.
(All VLANs are virtual interfaces created on LAN interface in pfSense) So only 1 physical cable for LAN and all VLANs3. Then set MTU for all VLAN interfaces in pfsense to 1500.
Now all VLANs working with 1500 MTU, For Internet, captive portal web page and web page hosted inside the LAN or VLANs.
(Previously, Internet works, but can't get on captive portal page which hosted on pfSense, and can't get on web page which hosted in in LAN hosts.);)