[SOLVED] VLAN Internet access

[jutje]

Hello there,

I would like my VLAN to have access to the internet but it ain’t woking at the moment.
I have VLAN20 172.16.2.1/24 DATA_NET

And the rule I have config at the moment is
Action: Pass
Interface: DATA_NET
Protocol: Any
Source: Any
Desination: Any

Please some help

[viragomann]

Is there an outbound NAT rule in place for that subnet? Firewall > NAT > Outbound.

[johnpoz]

Unless you messed with the outbound nat, automatic would auto create the outbound nat.. But sure that is a common problem when users set it to manual.

Is pfsense actually seeing the traffic on the vlan?  Did you setup the switch to send your vlan taggged as 20 on the port connected to physical interface your vlan is running on.

[jutje]

Viragomann:
What shoul be something like this?

Interface: DATA_NET
Source: 172.16.2.0/24
Source port Any
Destination: Any
Destination port: Any
Nat Address: WAN address
Nat port: Any

Johnpoz:
No it's set to manual outbound. And yes ma VLAN is config including my Switch which at this moment my file server is receiving a ip address from pfsense (172.16.2.2)

[viragomann]

You have to change the interface to WAN in that rule. The rest is fine.

[jutje]

Still not working  :'(

See attachments

[Derelict]

Remove that Pass any any any rule from WAN before you do anything else, please.

[jutje]

Remove that Pass any any any rule from WAN

Step one Done

[Derelict]

You do realize you are only passing http and https and things like ping won't work right?

[jutje]

Yea but still my Outside traffic gets blocked when coming in.

I have a Synology NAS den my VLAN and am trying to do a frameware update i keep getting 'Connection failed. Check you Internet connection.'

[viragomann]

Your pass rules on DATA_NET interface have the source "LAN net".  ???  Should be "DATA_NET net", I think.

[Derelict]

Nice.

And you probably need a port forward to access your NAS from the outside.

https://doc.pfsense.org/index.php/How_can_I_forward_ports_with_pfSense

Most people here would probably recommend against a port forward (especially from source address any) and opt for a VPN instead.

[jutje]

No i don't think that's the problem.

It just not has internet access. It cannot grab firmware update from the internet. It has to do with something about the firewall rules.

[Derelict]

You are bouncing all over the place from inbound to your NAS to outbound. Make sure you see the post by viragomann up there ^. That is certainly wrong.

https://doc.pfsense.org/index.php/Connectivity_Troubleshooting

[jutje]

Yea but i don't really get it… Why am seeing this in my firewall log

WAN Default deny rule IPv4 (1000000103)   37.143.0.0 (Public IP)   192.168.1.3 (Local IP) ICMP

My pfsense box is behind my ISP Router which is giving the pfsense box the private ip 192.168.1.3
But i keep seeing it get bocked by pfsense just after i try to search for new update for my Synology.

P.S. I even try to put my Synology in my LAN Network everything is working perfectly but not when i put it back in my VLAN

[Derelict]

Because there isn't a WAN rule passing the ICMP traffic from that
source (or from source any).

https://doc.pfsense.org/index.php/Firewall_Rule_Basics

https://doc.pfsense.org/index.php/Firewall_Rule_Troubleshooting

Even the pass any any rule I asked you to delete would not have passed pings since it was for TCP/UDP-only, not ICMP (ping is ICMP).

[jutje]

Yes i got it working now.
I didn't select DATA_NET as Network Interfaces under DNS Resolver.
And i also added this rull.

Now i have another issue/question… but i'll open a new post for that.