Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    [SOLVED] VLAN Internet access

    Scheduled Pinned Locked Moved Firewalling
    17 Posts 4 Posters 8.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DerelictD
      Derelict LAYER 8 Netgate
      last edited by

      Remove that Pass any any any rule from WAN before you do anything else, please.

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      1 Reply Last reply Reply Quote 0
      • J
        jutje
        last edited by

        Remove that Pass any any any rule from WAN

        Step one Done

        1 Reply Last reply Reply Quote 0
        • DerelictD
          Derelict LAYER 8 Netgate
          last edited by

          You do realize you are only passing http and https and things like ping won't work right?

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 0
          • J
            jutje
            last edited by

            Yea but still my Outside traffic gets blocked when coming in.

            I have a Synology NAS den my VLAN and am trying to do a frameware update i keep getting 'Connection failed. Check you Internet connection.'

            1 Reply Last reply Reply Quote 0
            • V
              viragomann
              last edited by

              Your pass rules on DATA_NET interface have the source "LAN net".  ???  Should be "DATA_NET net", I think.

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                Nice.

                And you probably need a port forward to access your NAS from the outside.

                https://doc.pfsense.org/index.php/How_can_I_forward_ports_with_pfSense

                Most people here would probably recommend against a port forward (especially from source address any) and opt for a VPN instead.

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • J
                  jutje
                  last edited by

                  No i don't think that's the problem.

                  It just not has internet access. It cannot grab firmware update from the internet. It has to do with something about the firewall rules.

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    You are bouncing all over the place from inbound to your NAS to outbound. Make sure you see the post by viragomann up there ^. That is certainly wrong.

                    https://doc.pfsense.org/index.php/Connectivity_Troubleshooting

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • J
                      jutje
                      last edited by

                      Yea but i don't really get it… Why am seeing this in my firewall log

                      WAN Default deny rule IPv4 (1000000103)   37.143.0.0 (Public IP)   192.168.1.3 (Local IP) ICMP

                      My pfsense box is behind my ISP Router which is giving the pfsense box the private ip 192.168.1.3
                      But i keep seeing it get bocked by pfsense just after i try to search for new update for my Synology.

                      P.S. I even try to put my Synology in my LAN Network everything is working perfectly but not when i put it back in my VLAN

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        Because there isn't a WAN rule passing the ICMP traffic from that
                        source (or from source any).

                        https://doc.pfsense.org/index.php/Firewall_Rule_Basics

                        https://doc.pfsense.org/index.php/Firewall_Rule_Troubleshooting

                        Even the pass any any rule I asked you to delete would not have passed pings since it was for TCP/UDP-only, not ICMP (ping is ICMP).

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • J
                          jutje
                          last edited by

                          Yes i got it working now.
                          I didn't select DATA_NET as Network Interfaces under DNS Resolver.
                          And i also added this rull.

                          Now i have another issue/question… but i'll open a new post for that.

                          Rules.png
                          Rules.png_thumb

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.