IP address issue

KOM

Your LAN rules are fine. What are the details of your pfSense LAN NIC, and the settings for your client PCs?

d4t4str34m

Attached are screenshots of my LAN configuration and my DHCP configuration.

![Screen Shot 2016-09-27 at 9.25.23 AM.png](/public/imported_attachments/1/Screen Shot 2016-09-27 at 9.25.23 AM.png)
![Screen Shot 2016-09-27 at 9.25.23 AM.png_thumb](/public/imported_attachments/1/Screen Shot 2016-09-27 at 9.25.23 AM.png_thumb)
![Screen Shot 2016-09-27 at 9.25.53 AM.png](/public/imported_attachments/1/Screen Shot 2016-09-27 at 9.25.53 AM.png)
![Screen Shot 2016-09-27 at 9.25.53 AM.png_thumb](/public/imported_attachments/1/Screen Shot 2016-09-27 at 9.25.53 AM.png_thumb)
![Screen Shot 2016-09-27 at 9.27.35 AM.png](/public/imported_attachments/1/Screen Shot 2016-09-27 at 9.27.35 AM.png)
![Screen Shot 2016-09-27 at 9.27.35 AM.png_thumb](/public/imported_attachments/1/Screen Shot 2016-09-27 at 9.27.35 AM.png_thumb)
![Screen Shot 2016-09-27 at 9.28.00 AM.png](/public/imported_attachments/1/Screen Shot 2016-09-27 at 9.28.00 AM.png)
![Screen Shot 2016-09-27 at 9.28.00 AM.png_thumb](/public/imported_attachments/1/Screen Shot 2016-09-27 at 9.28.00 AM.png_thumb)

KOM

Well, that's a start. For a LAN client to have Internet access, it must have an IP address, a netmask, a gateway and at least one DNS server. Can you provide the network details of one of your client systems that can't go through the firewall? Run ipconfig is a DOS box (assuming you're running Windows clients) and report back what it says.

d4t4str34m

Attached is the output to ifconfig. The numbers 10.0.0.230, 10.0.0.232, and 10.0.0.234 will not get out. The only thing that I see in common are that they are Apple servers. I can give it a different address like 10.0.190.242 and it will get out just fine. I have a Windows server that has 10.0.0.241 and it works just fine.

If I statically assign that 230 address to a Windows machine it won't work either. I have also tried setting up the 230 address in DHCP as a reserve for that server instead of being statically assigned at the machine so I made sure it was getting all of the other network settings like other machines and it still doesn't work.

network.txt

KOM

Are you sure there isn't an IP conflict with .230? Change the .230 box to something else and then try to ping .230, or delete its entry from the ARP table and then check it in a minute or so to see if a different MAC appears with .230. Usually client connectivity is one of the easiest things to get working right out of the box. What happens if you statically configure the client NIC as follows:

IP: 10.0.0.230
Mask: 255.255.255.0
Gateway: 10.0.0.254
DNS: 8.8.8.8

Derelict

Loves me some 10.0.0.0/8.

Running anything like snort/suricata?

Anything in the firewall log for .230 when you try to get out?

johnpoz

Well if pfsense interface is with a /8 mask, how would setting the client to /24 work??

What happens if you statically configure the client NIC as follows:

IP: 10.0.0.230
Mask: 255.255.255.0
Gateway: 10.0.0.254
DNS: 8.8.8.8

So you have 2 interfaces en0 and en1 - en1 looks down, but you sure its not trying to use that and not your en0 that has the IP and is connected?

So your saying it gets an IP via dhcp, but does not work with it? Can pfsense see that mac in in its arp table, can the apple server see the mac of pfsense interface in that network. Do these match up.. As mentioned duplicate IP can cause you problems for sure.

Again, going to stress this use of a /8 on a network other than a summary route in a router is completely borked!!! Maybe your apple server says - what a /8 mask - that makes no sense.. Whoever setting me up is completely clueless. I will just not work until I get a realistic mask for a interface.. /8 masks routes, ok, firewall rules sure. Interfaces for hosts in a network - no not so much. Makes no sense to use such a network..

KOM

Well if pfsense interface is with a /8 mask, how would setting the client to /24 work??

What does one have to do with the other, as long as they can see each other? The client doesn't need to see all of his massive network just to test connectivity with the gateway. And like you said after perhaps there is some weird Apple thing going on that is choking on the /8.

johnpoz

Setting the mask to /24 as long as that network includes the actual gateway IP in the same mask ok that is a good point. But not normal troubleshooting technique ;) But guess it would reflect on some ODD issue with apple not liking a /8 without changing the whole network.

I would like to know it gets dhcp or not, and it works with that? If so then really points to a conflict with the IPs that are not working.

Derelict

Because one side's broadcast address would be 10.255.255.255 and the other side would be 10.0.0.255.

Strange things can break in strange ways when you do that. Pick a subnet mask for the interface and stick with it.

There are a couple good reasons not to use 10/8 but it should work fine.

KOM

Just to be clear, I'm not advocating running with mismatched subnet masks in general. It was just to do a quick test while ruling something out without him having to change his network.

d4t4str34m

Sorry I haven't gotten back and worked on this issue. I haven't been using those servers to the point they needed an outside connection. I worked on it today and ended up setting a Virtual IP for those IP addresses and they started working. I must have halfway did the mapping to the IP addresses? Just wanted to update you guys on what I did to fix it. Thanks for you help.

KOM

You can create a NAT with anything you want as the Destination address, but pfSense has to know to listen for it. It automatically knows to listen on the WAN IP. All others must be explicitly set via Virtual IP.