Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    [SOLVED] VLAN Internet access

    Scheduled Pinned Locked Moved Firewalling
    17 Posts 4 Posters 8.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      jutje
      last edited by

      Viragomann:
      What shoul be something like this?

      Interface: DATA_NET
      Source: 172.16.2.0/24
      Source port Any
      Destination: Any
      Destination port: Any
      Nat Address: WAN address
      Nat port: Any

      Johnpoz:
      No it's set to manual outbound. And yes ma VLAN is config including my Switch which at this moment my file server is receiving a ip address from pfsense (172.16.2.2)

      1 Reply Last reply Reply Quote 0
      • V
        viragomann
        last edited by

        You have to change the interface to WAN in that rule. The rest is fine.

        1 Reply Last reply Reply Quote 0
        • J
          jutje
          last edited by

          Still not working  :'(

          See attachments

          DATA_NET.png
          DATA_NET.png_thumb
          Firewall.jpg
          Firewall.jpg_thumb
          Outbound.png
          Outbound.png_thumb
          WAN.png
          WAN.png_thumb

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            Remove that Pass any any any rule from WAN before you do anything else, please.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • J
              jutje
              last edited by

              Remove that Pass any any any rule from WAN

              Step one Done

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                You do realize you are only passing http and https and things like ping won't work right?

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • J
                  jutje
                  last edited by

                  Yea but still my Outside traffic gets blocked when coming in.

                  I have a Synology NAS den my VLAN and am trying to do a frameware update i keep getting 'Connection failed. Check you Internet connection.'

                  1 Reply Last reply Reply Quote 0
                  • V
                    viragomann
                    last edited by

                    Your pass rules on DATA_NET interface have the source "LAN net".  ???  Should be "DATA_NET net", I think.

                    1 Reply Last reply Reply Quote 0
                    • DerelictD
                      Derelict LAYER 8 Netgate
                      last edited by

                      Nice.

                      And you probably need a port forward to access your NAS from the outside.

                      https://doc.pfsense.org/index.php/How_can_I_forward_ports_with_pfSense

                      Most people here would probably recommend against a port forward (especially from source address any) and opt for a VPN instead.

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • J
                        jutje
                        last edited by

                        No i don't think that's the problem.

                        It just not has internet access. It cannot grab firmware update from the internet. It has to do with something about the firewall rules.

                        1 Reply Last reply Reply Quote 0
                        • DerelictD
                          Derelict LAYER 8 Netgate
                          last edited by

                          You are bouncing all over the place from inbound to your NAS to outbound. Make sure you see the post by viragomann up there ^. That is certainly wrong.

                          https://doc.pfsense.org/index.php/Connectivity_Troubleshooting

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • J
                            jutje
                            last edited by

                            Yea but i don't really get it… Why am seeing this in my firewall log

                            WAN Default deny rule IPv4 (1000000103)   37.143.0.0 (Public IP)   192.168.1.3 (Local IP) ICMP

                            My pfsense box is behind my ISP Router which is giving the pfsense box the private ip 192.168.1.3
                            But i keep seeing it get bocked by pfsense just after i try to search for new update for my Synology.

                            P.S. I even try to put my Synology in my LAN Network everything is working perfectly but not when i put it back in my VLAN

                            1 Reply Last reply Reply Quote 0
                            • DerelictD
                              Derelict LAYER 8 Netgate
                              last edited by

                              Because there isn't a WAN rule passing the ICMP traffic from that
                              source (or from source any).

                              https://doc.pfsense.org/index.php/Firewall_Rule_Basics

                              https://doc.pfsense.org/index.php/Firewall_Rule_Troubleshooting

                              Even the pass any any rule I asked you to delete would not have passed pings since it was for TCP/UDP-only, not ICMP (ping is ICMP).

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              1 Reply Last reply Reply Quote 0
                              • J
                                jutje
                                last edited by

                                Yes i got it working now.
                                I didn't select DATA_NET as Network Interfaces under DNS Resolver.
                                And i also added this rull.

                                Now i have another issue/question… but i'll open a new post for that.

                                Rules.png
                                Rules.png_thumb

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.