Created second Lan, but machines can't communicate between networks.
-
So, I created another interface and called it Lan2. Lan1 is 192.168.1.0/24 and I gave Lan2 192.168.2.0/24. Lan2 has Wan access and has no trouble with reaching the internet, and the machine there can ping its PFsense gateway at 192.168.2.1. I created a firewall rule identical to the default for Lan1, allow to any. However, the 2 networks can't communicate. From my machine on Lan1 I can't ping the machine on Lan2, nor can I ping its PFsense at 192.168.2.1. Vice versa from Lan2 to Lan1. What am I doing wrong? This is almost definitely a really stupid oversight on my part but I can't figure out what else would be necessary.
-
Hello,
your pfSense is the default gateway in both networks and configured on the clients?
Please share a screenshot of your firewall rules and make sure, the system you want to ping answers to ping requests. For example windows don't answers ping per default. Try to ping devices in the same network. -
Here are my firewall rules. Yes, PFsense is the gateway for everything. Web UI is available at 192.168.1.1 for Lan1, 192.168.2.1 for Lan2. Every machine is Linux so it won't be an issue client side. I can ssh to the machine on Lan2 if I use the public IP address (Virtual IP with 1:1 nat for that machine), but I can't ssh from 192.168.1.0/24.
-
Could you provide the configured routes and a traceroute from both machines? I don't think this is a pfsense issue.
Maybe you can make a Packet Capture on your pfSense. -
@bepo Are you able to briefly tell me how to do that? Any info you can give is fine and I'll go away and research it - but I need a nudge in the right direction. Also, I forgot to mention that I can access the server on Lan2 (owndomain.com) fine on a mobile or through VPN, but I CAN'T access it when using a machine that is accessing WAN on Lan1. That'swhen I have to use a VPN. Does that give any clues?
-
@asfsfreh What vpn you are talking about?
You have to make something like "traceroute ip.of.server.2" on your server 1 and paste the output here. The same in the other direction.
-
So, I've been unable to ping anything at all on the other lan for the entire time. I just installed the traceroute package and ran it to 192.168.2.2 (machine on Lan2). It immediately found the machine and as if by magic I can now SSH to the machine over Lan. I have no idea why, because at no point have I been able to ping the server. It now pings successfully every time. So problem solved! Almost...I still can't connect to the Lan2 server's public IP if I'm using a computer on Lan 1. Apologies, that's why I mentioned VPN (as in a private provider on my computer). the server on Lan2 is hosting synapse (matrix), and I can successfully log into it if I'm using cellular data or if I'm using a provide VPN from my provider. However, my phone app or the web client on my computer are unable to log in to the server if they are going straight through PFsense. Is there some setting that would affect this? Perhaps PFSense doesn't like a wan request that comes back on itself?
-
@asfsfreh said in Created second Lan, but machines can't communicate between networks.:
Perhaps PFSense doesn't like a wan request that comes back on itself?
This is a problem in general. Not pfSense specific. I would recommend you to create a NAT rule, that redirects LAN 1 Clients to Server2-Public-IP to the Server2-Internal-IP.
And dont forget to upvote my posts, if they help you :-)
-
Why are you hitting the server in your other local public IP in the first place? Why would you not resolve its via fqdn? I server.publicdomain.tld
And have that locally resolve to the 192.168.x.x address the server is actually on locally?
-
Thanks a lot, really appreciate you taking the time today. Upvotes are on the way
-
@johnpoz How exactly would I do that? Is in PFSense somewhere? My phone app requires the public IP for login so that's what it uses, so can I tell PFsense to resolve that internally somehow?
-
-
None of that is required - he could just be using some dyndns?
What do you mean your phone requires the public IP for login? If you explain what exactly your doing we might be able to help better ;)
As to resolving any fqdn, if the device points to pfsense for dns then its a simple host override.. If your device is hard coded to try and use say public dns 8.8.8.8 for example... Then you could do a dns redirect so that any external dns is redirect to pfsense dns.. Which would then return any host overrides you have put in place.
https://www.netgate.com/docs/pfsense/dns/redirecting-all-dns-requests-to-pfsense.html
-
@johnpoz said in Created second Lan, but machines can't communicate between networks.:
None of that is required - he could just be using some dyndns?
Correct, but if he own this we could use it. So i ask for the best and if he havent that we can make it with some dyndns stuff.
-
@bepo Yes, I own a domain with DNS records pointing to the public IP for the server on Lan2. What would I need to do?
-
@bepo So, I went to DNS resolver and selected host overrides. Under 'host' I put the hostname displayed for hostname in the DHCP static mapping page. For domain I entered mydomain.com, and I entered the local address of the server as the 'IP to return to host'. That hasn't worked though, so was I on the right path or should I delete that host override?
-
@johnpoz Sorry, a lot of what I've said isn't very clear! My phone/web client try to access the server I have on Lan2 by using my domain name - example.com (I have public DNS records pointing to the public IP address for that server). PFSense obviously doesn't seem to like allowing something through the firewall that comes straight back to it, the question is what the method for me solving that is, and how to do that in PFsense.
-
@asfsfreh if your public domain is example.com, create a host override in your dns config and point example.com to your internal lan2 ip address.
From Internet example.com should resolve to your public ip.
From any pfsense network example.com should resolve to your internal LAN2 server ip. -
@bepo I've done that, but it isn't working. I ran traceroute to mydomain.com but it is only showing the public ip address, and I still can't log in to the server from Lan. Does anything need to be added/checked under 'DNS server settings' in general setup? At the moment that section is blank.
-
I would assume its something.example.com and not just example.com
But just create a record like this..
Now if your client points to pfsense it should resolve to that... Make sure you put it in the right place if your using the forwarder on pfsense you put it there, default is resolver (unbound) and you would put it there.
If your client is not using pfsense for dns - then you would have to use the redirect method.
if really is just example.com then the host would be example and the domain would just be com
query to validate
Clearly you would use your own local IP ;) I shouldn't have to say that - but you would be surprised! ;)
