Cant ping my gateway on op1 interface, but can access pfsense web….
-
" I made rules so that I could connect from my desktop to my ESXI server how is running on the opt1 nic. (See attachemts for my full network setup)"
There would be no need to create such rules in the default out of the box config because the default rule on lan is any any.. Lan can go anywhere it wants, internet, other local networks you create on pfsense, etc.
Why don't you post up your rules for both your lan and new opt1 and we can discuss why stuff will or will not work.
Rules are evaluated top down on an interface, first rule to trigger wins no other rules are looked at. You create your rules on interface where traffic will first enter pfsense.
"I made a rule that says any any on the opt1 as well as a rule on LAN that says 172.29.229.2 (ESXI) port * Destination * gateway * "
Post up your rules or we are just going to be guessing what your did..
-
thanks for the reply here are my rules
 -
and
 -
Sigh.
- The first rule on LAN is useless.
- The 172. rules on LAN have no effect, that's not where you put them
- The first rule on OPT1 makes no sense either, it's already covered by the second one. - DNS is UDP/TCP, not TCP.
- Ping is ICMP, not TCP.
- The first rule on LAN is useless.
-
Pretty much none of those rules makes sense on lan since you have an any any on the bottom and that source of 172.29 would never be seen inbound into lan unless you had a downstream router and lan was your transit network.
Your rules on opt are pointless as well, as dok pints out dns is UDP, with now and then some possible tcp..
And where in those rules do you allow ICMP or Any your 2nd rule is any any for tcp only - ping is icmp.
https://doc.pfsense.org/index.php/Firewall_Rule_Basics
Firewall rules on Interface and Group tabs process traffic in the Inbound direction and are processed from the top down, stopping at the first match. Where no user-configured firewall rules match, traffic is denied.
Maybe this should be worded better? Maybe we need to put in pictures??
-
Okey I removed them, but still no changes
 -
1
-
I cannot see anything removed or improved, plus you are missing the absolutely basic rule: you do NOT allow OPT1 traffic on LAN. You allow it on OPT1 (the interfaces where the traffic first hits the firewall)
-
yeah looks like you got this .6 wanting to talk to googledns.. Going to be hard for it resolve local stuff that way ;)
What I would highly suggest is put in any any rule on Opt1, get your stuff talking!! Then put in block rules for what you don't want to talk.. Unless you don't want opt talking to lan at all?
-
update of rules
 -
updated opt1
 -
And again completely pointless with that TCP rule with a rule right below it that says any any.. You do not need this rule!!! Unless you wanted to log or something - which you clearly do not have marked.
And you rule on opt is only allow TCP, not ping (icmp) or dns which is UDP..
-
The first rule is still pointless. But yet again: You are showing us the WRONG INTERFACE!!!
You need to allow the traffic on OPT1, NOT LAN!!!!
-
Okey god… I am such an idiot............ Figured it out now........ God dam.......
-
thanks guys for sticking it out…. I am such a freaking dumb ass.....
-
Well no problem, you figured out the issue pretty fast. Some people don't get it even after a couple of days. :D
-
I felt so freaking dumb when I discovered what I had done worng. But again thaks for helping me in my less bright moments :P
-
Days? heheh dok there are some that don't get it after weeks ;) heheheh
