Two gateways, two subnets, one internet, subnet connectivity issue
-
You now need a default route @ LAN 2 pointing back to LAN 1 (192.168.1.1).
You also need to verify that the static route @ LAN 1 is pointed at the current IP configured @ LAN 2. (i.e. if the LAN 2 interface is 192.168.1.254, then the route should be destination 192.168.5.0/24 gateway 192.168.1.254)
-
Ok, so I did this:
System -> Advanced -> Firewall & NAT -> check Disable all packet filtering
WAN was set to 192.168.1.254
Default Gateway on wan is set to: 192.168.1.1Still nothing. I am on the 192.168.5.0 subnet doing all this and once I make those changes I can't access the internet. On LAN1 I have confirmed that I DO have the static route pointing at the WAN IP provided above.
Is there something that needs to be set on LAN2 pfsense box to tell the LAN on that box to communicate with the WAN since all NAT/Filtering is disabled?
-
Check your routing table, what is the gateway of the default route? Diagnostics -> Routes. Post a screen shot if you can.
-
I've been using .112 instead of .254 :) My static routes on LAN1 match this.
 -
Can you ping 192.168.1.1? Can you ping 8.8.8.8?
-
I doubt it, but I'll change the configuration back right now and let you know.
-
Ping on both was 100% failure.
-
Can you post a network map of how things are currently connected?
Also, what default gateway are your clients using on the PC's?
What happens when you ping 192.168.1.1 from PFsense itself?
-
What happens when you ping 192.168.1.1 from PFsense itself?
I'm checking now.
Please excuse my terrible drawing, but it is all there. Let me know if you need clarification.
-
Where can I input commands in pfSense?
Either from the shell via ssh or by going to Diagnostics -> Ping
-
Ping Results directly from pfSense. Looks good. That means something is still prohibiting a connection between the LAN and WAN on the pfsense box as I'm unable to ping from a client connected to the pfSense Subnet (192.168.5.0)
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: icmp_seq=0 ttl=58 time=19.789 ms
64 bytes from 8.8.8.8: icmp_seq=1 ttl=58 time=19.992 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=58 time=18.517 ms–- 8.8.8.8 ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 18.517/19.433/19.992/0.653 msPING 192.168.1.1 (192.168.1.1): 56 data bytes
64 bytes from 192.168.1.1: icmp_seq=0 ttl=64 time=1.897 ms
64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=3.034 ms
64 bytes from 192.168.1.1: icmp_seq=2 ttl=64 time=2.398 ms--- 192.168.1.1 ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 1.897/2.443/3.034/0.465 ms -
Run a tracert on your laptop to 8.8.8.8 and post the results.
-
Traceroute while I have internet access:
Traceroute has started…
traceroute to 8.8.8.8 (8.8.8.8), 64 hops max, 72 byte packets
1 192.168.5.1 (192.168.5.1) 2.032 ms 1.566 ms 3.057 ms
2 192.168.1.1 (192.168.1.1) 4.491 ms 2.755 ms 3.445 ms
3 * * *
4 WANISP.ptr.us.xo.net (WANISP) 13.697 ms 11.825 ms 15.092 ms
5 ge-0-0-2-spk-cr1.cet.com (198.202.27.65) 14.796 ms 12.241 ms 12.642 ms
6 te-1-1-sea-cr2.cet.com (198.202.26.2) 18.589 ms 20.696 ms 20.326 ms
7 six.sea01.google.com (206.81.80.17) 20.489 ms 20.139 ms 19.410 ms
8 108.170.245.113 (108.170.245.113) 20.336 ms 20.854 ms 20.953 ms
9 209.85.250.19 (209.85.250.19) 20.182 ms 20.219 ms 21.039 ms
10 google-public-dns-a.google.com (8.8.8.8) 19.162 ms 20.637 ms 20.258 msLet me run one when I turn NAT/Firewall off
traceroute to 8.8.8.8 (8.8.8.8), 64 hops max, 72 byte packets
1 192.168.5.1 (192.168.5.1) 1.249 ms 3.578 ms 1.490 ms
2 * * *
3 * * *
4 * * *
5 * * *
6 * * *
7 * * *
8 * * *
9 * * *
10 * * *
11 * * *
12 * * *
13 * * * -
So, that traceroute shows you hitting the LAN 2 internal interface, then routed to LAN 1 and out to the internet.
So, what do you mean when you say "traceroute while I have internet access"?
ahh… I think I know what you mean now, so once you turn off the firewall and NATing.... you can't get past the local adapter. Which tells me there's an internal routing issue.
-
Yes, that is correct. It hits the LAN interface on LAN2 and then dies on the spot.
-
Do I need a static route between the LAN interface and the WAN?
-
I can ping everything on LAN1 (192.168.1.0), however when I try to ping something on LAN2 I get something like this:
92 bytes from dd-wrt (192.168.1.1): Destination Host Unreachable
Vr HL TOS Len ID Flg off TTL Pro cks Src Dst
4 5 00 5400 4fc9 0 0000 3f 01 a41b 192.168.1.115 192.168.5.192 bytes from dd-wrt (192.168.1.1): Redirect Host(New addr: 192.168.1.254)
Vr HL TOS Len ID Flg off TTL Pro cks Src Dst
4 5 00 0054 f9f5 0 0000 3f 01 f9ee 192.168.1.115 192.168.5.1I'm not sure what the .254 address is.
-
I found where the .254 was coming from. DDWRT was holding on to an old route that I set up previously in this thread. A reboot and it let go. Makes most of what I've been doing irrelevant and must go back now. Waiting for DHCP on the other end so I can connect to a PC over VNC for testing. I have not idea why VNC works over this network, but I'm glad that it is working.
-
I have it working! Finally. I have a several routes/rules/NATs in place and not 100% certain which allowed it to work or is doing nothing and haven't had the time to strip each one away at a time to see. I have access from both directions and internet on both sides. One strange thing is that I can not ping devices on LAN2 from LAN1, but I can connect to their web interfaces etc… I must still be missing one small key here.
On the DDWRT Router (192.168.1.1) that is hooked to the modem, I have a static route setup. Operating mode is gateway
Lan Dest: 192.168.5.0
Subnet Mask: 255.255.255.0
Gateway: 192.168.1.112Then on pfSense (192.168.5.1)
WAN of pfsense is essentially hooked to the LAN of DDWRT
WANIP: 192.168.1.112
Gateway: 192.168.1.1
LANIP: 192.168.5.1Static Route WAN
Destination Network: 192.168.5.0
Gateway: 192.168.1.1Firewall/NAT are still on essentiallly. I pretty much bypassed them with the local network rules I have set.
NAT --- Outbound
Hybrid Outbound NAT
I added the following rule
Interface WAN
Source 192.168.1.0/24
Source Port *
Destination 192.168.5.0
Destination Port: *
Nat Address: WAN Address
Nat Port *
Static Port NOBasically on the firewall rules I added any/any to WAN and LAN.
I'm sure this looks a bit ridiculous to someone with much more networking knowledge and I bet there are some major flaws as well, but it works and it is still behind the head router's firewall.
-
Hopefully someone is still watching this thread.
I want to go back to the beginning and take a look at something fundamental from the big picture of the design.
Essentially I wanted network 1 to still function internally if it loses connectivity to network 2 and vice versa. I also do not want local traffic on network 2 to "travel" all the way back to network 1 and then back for something that doesn't need internet. Example of streaming an IP cam locally on network2. I have limited bandwidth on the wireless bridge between the two networks and don't want to waste it on something that isn't necessary. Forget about internet connection if the two networks lose connectivity, I don't care at that point.
Have I gone about this the right way? Creating a subnet for each network and joining the subnets as I've done?
….or would have it have been better to simply have the ONE gateway in network 1 where the internet is and have pfsense essentially act as a router only and have them all on the same subnet (pfSense utilizing DHCP).
Network 1 router would function as gateway and DHCP server for let's say 192.168.1.150-.254
Network 2 router function as just a router and DHCP server for 192.168.1.1-149Would this still allow each network to function by itself with the exception of internet and also not create redundancies in the wifi bridge traffic when devices on network 2 are communication between other devices on network 2?
I realize this thread has pretty much come full circle, but I have accomplished, mostly, what I aimed to do and have learned a lot in the process.
