Routing or pass-through?
-
Screenshot of your firewall rules was what I was talking about ;)
Your directly connecting your ports to different interfaces in pfsense - why are you tagging them on pfsense? Pfsense doesn't care or need to see these tags.. While yes you need to tag them on your uplink between switches. From your drawing putting tags on your pfsense opt interfaces is not needed, and yeah could be causing you some issues. Pfsense only cares about the tag when when there is going to be more than one vlan on a interface. If not there is no point to tagging.
But from these rules
pass in quick on igb2 inet from 192.168.2.0/24 to any flags S/SA keep state label "USER_RULE"
pass in quick on igb3 inet from 192.168.3.0/24 to any flags S/SA keep state label "USER_RULE"Your doing Any Any.. So yeah you would be able to share files or print. And to be honest with such rules other than creating new broadcast domains. Your not firewalling anything.. Might was have everything on same network.. Guessing this is just making sure everything is working before you lock it down mode?
If your having issues with sharing files.. You running the local firewall on windows, its going to block someone coming from a different network out of the box. You would have to allow for your other segment on the windows firewall for sharing.
-
Screenshot of your firewall rules was what I was talking about ;)
Your directly connecting your ports to different interfaces in pfsense - why are you tagging them on pfsense?
wasn't sure about whether you wanted a screenshot or the complete set - it took seconds for the set :)
again … I wasn't sure whether or not the pfsense had to tag the traffic, so I did it anyway :) I'll take it away.
what I'd really like to do is keep traffic on each vlan separate, with the exception of access to the samba server, and a couple of lan connected printers. The samba server is a Linux box with Samba running.
I don't understand the two "pass in quick ...." -
I've removed the tagging from the configuration and rebooted. The wireless LAN and the home lans seem to be working fine. I can VPN to work over the wireless LAN. But I can still ping from 192.168.4.x to 192.168.2.x, which I don't want to do. And I still can't see the samba share but I can see the printers on the 192.168.1.x network. There may be something awry with my Samba setup, so I'll check that.
-
You can still ping because you have ANY ANY rules!!! Yeah your going to be able to do anything you want.. Your just routing really not firewalling with an any any rule..
You can not see your shares?? So your trying to like browse to them?? Via like your network neighborhood or something? That is not going to work across segments. Just access the box directly via its name or IP, ie \computername.domain.tld or \IPADDRESS
Post up your rules via a screenshot.. If you wan to be able to access your smb shares, then your going to need to allow tcp 445 if you don't want to be able to ping, then don't allow icmp, or block it before you allow any, etc.
Rules are evaluated top down, first rule to trigger wins and the rest of the rules are not looked at. As the traffic enters interface on pfsense.. So if you don't want vlan X to talk to vlan Y on icmp.. Then on vlan X you would create rules that block icmp, or don't allow it..
-
Thank you johnpoz - it's like learning a new foreign language! I will look at this later today and report back.
-
heheeh - yeah sure it can seem like that..
-
OK, so I've checked samba on the same vlan as the server and it worked first time, so something's being blocked (I guess). If I want access samba from my wireless LAN, for instance, How do I enable tcp 445? .. current rules are below. The samba server is on the LAN
 -
Hi sorry to bump this message. Can anyone tell me how to enable tcp on port 445? I have tried to work it out but I'm really not quite sure where it's done. Thank you
-
You have an ANY ANY rule - so yeah tcp 445 is open.. If you can not access the shares, then look to firewall running on where the shares are.. Out of the box windows firewall is not going to allow access to its shares from IPs other than its on local network.
-
Hm, thank you for the post. I'm running Linux so there isn't a firewall running.
And I can ping the server no problem. -
Linux has firewalls ;) So you meant to say your not running one ;)
So your accessing it how \IPaddress of the samba server? Or \hostname and its not resolving?
Your not going to be able to resolve a hostname via broadcast across segments. So like I said before your going to have to use fqdn or ipaddress.
What does your samba.conf look like.. Do you have this other network in your hosts allow statement? If not then no you wouldn't be able to access it.
-
OK, I'll check everything tomorrow. Thank you. Yes, I know Linux has firewalls …. but unlike windoze it doesn't install one without you asking for it. :)
-
Well that would depend on the distro ;) But I hear ya…
My guess would be your host allow, if that has your network in. Then do a simple sniff on pfsense. Do you see your traffic going to your samba host, do you see a reply? This can even show if you get an answer to why your denied access, etc.
Do packet capture on your lan interface.. Use the IP address of your samba box as filter.. Then try and connect from your wifi network.. Do you see traffic? Do you see syn,ack back? Load it up in wireshark and see what is going on. If you don't see traffic going there, then sniff on your wifi interface do you see the client sending the traffic.
If you see the syn but not the syn,ack back when sniffing on the lan.. Then its your samba box or your sending to the wrong mac, etc..
-
It's been a while, I know. Yes, I can connect directly by IP address but I can't see the Samba share. I'll come back with some more thoughts about my requirements in a few days ..
