Created second Lan, but machines can't communicate between networks.
-
@bepo Are you able to briefly tell me how to do that? Any info you can give is fine and I'll go away and research it - but I need a nudge in the right direction. Also, I forgot to mention that I can access the server on Lan2 (owndomain.com) fine on a mobile or through VPN, but I CAN'T access it when using a machine that is accessing WAN on Lan1. That'swhen I have to use a VPN. Does that give any clues?
-
@asfsfreh What vpn you are talking about?
You have to make something like "traceroute ip.of.server.2" on your server 1 and paste the output here. The same in the other direction.
-
So, I've been unable to ping anything at all on the other lan for the entire time. I just installed the traceroute package and ran it to 192.168.2.2 (machine on Lan2). It immediately found the machine and as if by magic I can now SSH to the machine over Lan. I have no idea why, because at no point have I been able to ping the server. It now pings successfully every time. So problem solved! Almost...I still can't connect to the Lan2 server's public IP if I'm using a computer on Lan 1. Apologies, that's why I mentioned VPN (as in a private provider on my computer). the server on Lan2 is hosting synapse (matrix), and I can successfully log into it if I'm using cellular data or if I'm using a provide VPN from my provider. However, my phone app or the web client on my computer are unable to log in to the server if they are going straight through PFsense. Is there some setting that would affect this? Perhaps PFSense doesn't like a wan request that comes back on itself?
-
@asfsfreh said in Created second Lan, but machines can't communicate between networks.:
Perhaps PFSense doesn't like a wan request that comes back on itself?
This is a problem in general. Not pfSense specific. I would recommend you to create a NAT rule, that redirects LAN 1 Clients to Server2-Public-IP to the Server2-Internal-IP.
And dont forget to upvote my posts, if they help you :-)
-
Why are you hitting the server in your other local public IP in the first place? Why would you not resolve its via fqdn? I server.publicdomain.tld
And have that locally resolve to the 192.168.x.x address the server is actually on locally?
-
Thanks a lot, really appreciate you taking the time today. Upvotes are on the way
-
@johnpoz How exactly would I do that? Is in PFSense somewhere? My phone app requires the public IP for login so that's what it uses, so can I tell PFsense to resolve that internally somehow?
-
-
None of that is required - he could just be using some dyndns?
What do you mean your phone requires the public IP for login? If you explain what exactly your doing we might be able to help better ;)
As to resolving any fqdn, if the device points to pfsense for dns then its a simple host override.. If your device is hard coded to try and use say public dns 8.8.8.8 for example... Then you could do a dns redirect so that any external dns is redirect to pfsense dns.. Which would then return any host overrides you have put in place.
https://www.netgate.com/docs/pfsense/dns/redirecting-all-dns-requests-to-pfsense.html
-
@johnpoz said in Created second Lan, but machines can't communicate between networks.:
None of that is required - he could just be using some dyndns?
Correct, but if he own this we could use it. So i ask for the best and if he havent that we can make it with some dyndns stuff.
-
@bepo Yes, I own a domain with DNS records pointing to the public IP for the server on Lan2. What would I need to do?
-
@bepo So, I went to DNS resolver and selected host overrides. Under 'host' I put the hostname displayed for hostname in the DHCP static mapping page. For domain I entered mydomain.com, and I entered the local address of the server as the 'IP to return to host'. That hasn't worked though, so was I on the right path or should I delete that host override?
-
@johnpoz Sorry, a lot of what I've said isn't very clear! My phone/web client try to access the server I have on Lan2 by using my domain name - example.com (I have public DNS records pointing to the public IP address for that server). PFSense obviously doesn't seem to like allowing something through the firewall that comes straight back to it, the question is what the method for me solving that is, and how to do that in PFsense.
-
@asfsfreh if your public domain is example.com, create a host override in your dns config and point example.com to your internal lan2 ip address.
From Internet example.com should resolve to your public ip.
From any pfsense network example.com should resolve to your internal LAN2 server ip. -
@bepo I've done that, but it isn't working. I ran traceroute to mydomain.com but it is only showing the public ip address, and I still can't log in to the server from Lan. Does anything need to be added/checked under 'DNS server settings' in general setup? At the moment that section is blank.
-
I would assume its something.example.com and not just example.com
But just create a record like this..
Now if your client points to pfsense it should resolve to that... Make sure you put it in the right place if your using the forwarder on pfsense you put it there, default is resolver (unbound) and you would put it there.
If your client is not using pfsense for dns - then you would have to use the redirect method.
if really is just example.com then the host would be example and the domain would just be com
query to validate
Clearly you would use your own local IP ;) I shouldn't have to say that - but you would be surprised! ;)
-
@asfsfreh please provide a screenshot of your dns config.
And maybe there is a dns cache on your device. Try to reboot your client. -
Or just flush the cache on your local device - but hard on phone.. Normally you would have to cycle the wifi connection. But its possible his app or phone is using public dns.. Which is why I brought up the whole redirecting dns thing.
-
@johnpoz in /etc/resolv/conf on my client my nameserver is listed as pfsense (192.168.1.1). Here's a screenshot of what I did, with my real domain replaced for the screenshot:
And here is what the DNS resolver page looks like. Shouldn't this work?
-
Your setting looks good on my first view.
Did you flushed your dns cache as recommended by @johnpoz?
