I think Pfsense is blocking ping.
-
The internet hits my work by public ip provided by an internet provider and then a private network is created 172.20.18.0/24. I have to do nat also in pfsense? From network 10.10.10.0/24 I can ping the network from my work but the reverse does not.
-
I'm guessing there are no ACLs on FastEthernet0/1 ?
Post your pfSense firewall rules & static routes.
Pings from 192.168.1.2 -> 192.168.1.1 should work as they are directly attached.
-
So the internet is between you at work and this router and pfsense.. Or is this router and pfsense at your work location?
you can not route rfc1918 addresses over the internet.. You would need a vpn to connect your work rfc1918 network to some other location also using rfc1918 behind a nat router connected to the internet.
Your drawing doesn't make a lot of sense if its local. But if its all local then you just need to turn off all nat on that router and pfsense and route your traffic and allow it in the in the firewall in pfsense.
Where exactly did you do that sniff? That just looks like pfsense monitoring its gatways??
-
Yes. Ping 192.168.1.2 -> 192.168.1.1 Works
But ping 192.168.1.1 -> 192.168.1.2 does not work -
@utilizador_estagio said in I think Pfsense is blocking ping.:
But ping 192.168.1.1 -> 192.168.1.2 does not work
Out of the box pfsense wan blocks all unsolicited traffic.. If you want to ping pfsense wan IP, you would have to allow that in the wan rules on pfsense.
If all of this is local to your work, not understanding the point of the "router" in your diagram, why do you not just connect pfsense directly this 172.20.18 network?
-
Okay. I'll reframe everything and I'll come back with the whole scheme and explain what's going on. Thank you.
-
Ok, i am back. Here is the issue.
I'm using the test router because the purpose is to test the features of pfsense, such as the locks that one can do and these things, and my boss told me to use a test router to create a subnet so as not to interfere with the network of work (172.20.18.0/24). The network created was 192.168.1.0/24 and I configured static addressing on the router and assigned the addresses shown in the figure.
At first I did not have internet because I needed to do the nat on the test router. I did it and it worked because I was able to access the internet on the test router. then I switched on pfsense and configured it with the addresses shown in the figure. Now my PC is connected to the network 10.10.10.0/24. (DHCP). I still have internet access. I created a samba server on the ubunto to share file. It works. inside the 10.10.10.0/24 network all right. The problem appears when I try to access the server through the network (172.20.18.0/24). I can not. If I am inside the 10.10.10.0/24 network I can ping out of pfsense, for example to a machine on the network. 172.20.18.0/24. But if I am inside the network 172.20.18.0/24 I can not ping the network 10.10.10.0/24, not even in the WAN address of pfsense.
I've already disabled blocking options on 'reserved networks' in pfsense's WAN interface. I have also created a rule to allow pfsense to ping. I have already made the diagnosis to know if the ping is coming to the WAN interface of pfsense.
What to do ? -
Note: I am an intern starting at pfsense.
-
Allowing ping, i did:
Action: allow
Interface: WAN
Address Family: IPv4
Protocol: ICMP
ICMP subtypes: any
source. any
destination: WAN net -
So where exactly is your source and what IP are you pinging exactly.
If your on this 172.20.18 network, with a default gateway of 172.20.18.1 and your pinging 10.10.10.20?
Or are you on the public internet? You have a triple nat looks like? Which router(s)/pfsense are natting which are not?
In such a setup both 172.20.18 and 192.168.1 are transit networks and there should be no "hosts" on them - if there are and you want to get to downstream networks you would need to do routing on the hosts themselves.
-
i am pinging from 172.20.18.190 to 10.10.10.20
172.20.18 default gatway is 172.20.18.1 -
Yeah that is going to be asymmetrical mess then... If your going to connect downstream routers, then the network that connects them is transit and no host should be on it. If you put hosts on a transit network then you have to route on the host or your traffic is going to be asymmetrical.
Also are either of these downstream routers from your edge natting or not?
From your drawing router 2 and pfsense are downstream from your edge router 1
-
I would eliminate router 2 from the set up and put the 192.168.1.0/24 network on an OPT interface on pfSense (assuming the network is needed at all). You have an awful lot of routers chained and managing routing and NAT (outbound NAT on the edge router) between all of those local networks is going to be a pain. Simplify your setup.
