[SOLVED] Access from LAN to DMZ(OPT1)

[theboda]

Ok I deleted all rules for the DMZ interface.
Left the LAN interface with the default rules.
Tried to ping the device in the DMZ, did a packet capture on the DMZ interface –> got no output at all.

[johnpoz]

Is your device on lan using pfsense as gateway?  Can you ping the dmz interface IP of pfsense?

Did you maybe set a /32 mask on the pfsense dmz IP vs say /24?

[theboda]

Yes my lan device has the gateway 192.168.1.1 which is the LAN gateway of the pfsense.
Tried to ping 192.168.3.1, but can't ping the dmz interface either.

ping 192.168.3.1
PING 192.168.3.1 (192.168.3.1) 56(84) bytes of data.
From 192.168.1.105 icmp_seq=1 Destination Host Unreachable

[johnpoz]

well if you can not ping the dmz IP of pfsense from lan - then your never going to get to a device on the dmz.  Ae you using a vpn client on pfsense and sending all traffic out the vpn?

Did you set a /32 on the dmz IP?

Are you using a vpn client on the lan device?

Post up the interface settings of your lan and dmz in pfsense.  This really is clickity clickity worky sort of stuff.

Did you put some rule in your floating tab that would be blocking it?

[theboda]

No vpns at all on the systems.
The dmz IP is set on a /32


[johnpoz]

Why would you be getting back that from .105?  pfsense lan IP was .1 you stated.

LAN IGB1 192.168.1.1

Do you have some host routes setup on this lan box?

you sure your lan mask is /24 and not maybe say /22 or larger?  Is this lan device windows box?  If so post output of ipconfig /all and route print.

[johnpoz]

your /32 is BROKEN…  Set that to /24 how it normally would be..

[theboda]

Set it to /24, still not working.
The laptop is a linux machine.
I don't have host routes set up, not that I know of.

[johnpoz]

well do a netstat -nr on it..

So you can see your routes… This will also validate what mask you have... When you ping you an IP on a different network you sure shouldn't be getting back from a different host

From 192.168.1.105 icmp_seq=1 Destination Host Unreachable

On your own network that is not your gateway that it can not get there.

[theboda]

here is my netstat output

[johnpoz]

your mask is /16 so 192.168.3 is on the same network…  So no never going to sent traffic to pfsense to get there.

[theboda]

Thank you!!  ::)

[johnpoz]

np - knew it had to be something silly.. If you would of been dhcp on the client never could of happened.

[NogBadTheBad]

Glad your sorted :)

BTW you have IPv6 track interface on your lan interface and no IPv6 firewall rules, if you dont use IPv6 disable it.