VLAN to VLAN Routing
-
Hello all .. am having this problem and it boggles me to no end ..
I setup 2 VLANs connecting to one switch with ID 11,12 and subnet 10.1.11.0/24, 10.1.12.0/24 respectively. The switch is connected to the pfsense box via a trunk, tagged both ID 11,12. On the pfsense box, I created both VLANs and created the interfaces both on em0. Then of course allow them via rule all to all on both interfaces. However, PC from VLAN 11 cannot reach PC on VLAN 12, but it can reach the gateway of VLAN 12 .. on the pfsense box, I can ping to both PCs. Please find the attached diagram for reference. I'm hoping for a fruitful solution to this .. :(
-
And do you have firewalls on these boxes? Most likely their firewalls would block traffic from other than local networks.
Also you state that is L3 switch.. So is routing or are you just using it as L2 and letting pfsense do the routing?
-
And do you have firewalls on these boxes? Most likely their firewalls would block traffic from other than local networks.
Also you state that is L3 switch.. So is routing or are you just using it as L2 and letting pfsense do the routing?
No firewall configured on the boxes. There's no IP configured on the switch except 1 for management purposes. I'm letting the pfsense doing the routing.
-
Well then you got something else wrong.. If you created any any rules all pfsense is doing is routing.
Just because there is no firewall configured doesn't mean there isn't one ;) Windows out of the box for example would block icmp from other than local networks. If the boxes are pointing to pfsense as their gateway off their segments.. Then it points to firewall on the boxes.. .Or you created maybe only tcp only on your interfaces.
Can devices ping pfsense IP on their vlan you said pfsense can ping them.
-
Show us the rules. If they were any/any AND there are no interfering firewalls on the hosts themselves it would be working.
Maybe your rules are TCP-only or something.
-
Indeed the pfsense can ping the devices and likewise .. as a note I've enabled the box to accept ping request already … oh btw .. the rule is all instead of only tcp
-
If you are not going to post the rules it is going to be very difficult to help you.
-
PC from VLAN 11 cannot reach PC on VLAN 12, but it can reach the gateway of VLAN 12 .. on the pfsense box, I can ping to both PCs.
This tells me that the default gateway of the PC on VLAN12 needs to be checked. It needs to be the pfSense interface.
-
PC from VLAN 11 cannot reach PC on VLAN 12, but it can reach the gateway of VLAN 12 .. on the pfsense box, I can ping to both PCs.
This tells me that the default gateway of the PC on VLAN12 needs to be checked. It needs to be the pfSense interface.
OMG!! .. You're such a savior! it was indeed the GWs of the PCs .. they're blank! some technicians gonna get hurt for this >:(
Thanx derelict!
-
Derelict – I said the same freaking thing before him ;)
"If the boxes are pointing to pfsense as their gateway"
-
It's amazing.
-
Derelict – I said the same freaking thing before him ;)
"If the boxes are pointing to pfsense as their gateway"
My bad that I let the technician configured the boxes and did not check them thoroughly as the location of the boxes are too far apart from the control room … SORRY!
