Having LAN issues related to a new switch
-
@HansSolo said in Having LAN issues related to a new switch:
So let's say I try to connect to 192.168.0.2 from 192.168.0.3.
I should see a log entry going at least to 192.168.0.2Incorrect. Traffic will not hit the firewall unless the destination is outside of 192.168.0.0/24. If both PC's are in the same subnet, you can disconnect PFsense altogether and the two devices will still communicate because the switch is flooding the frame to all ports in the same broadcast domain and will forward the frame to the correct port one it learns the MAC address from the destination PC.
If you're having communication issues between two devices in the same subnet, you either have a windows firewall issue or a configuration issue within the software/protocol that you're trying to communicate with.
When you say you cannot communicate between PC's... what exactly are you trying to do?
-
Never. I ALWAYS disabled Promiscuous mode.
But now I'm gonna go back and connect these two to that Firebox just to see.
I'm not sure HOW it logged that traffic. But it did. -
Either the traffic was between different subnets, or the NIC was in promiscuous mode, or some other device was in promiscuous mode and relaying what it saw to the WG box. It has to be something special because tcp/ip works the same way everywhere. Local IPv4 clients find each other via ARP and talk direct.
-
-
Can you ping from one to the other? Have you disabled both firewalls and tried to ping?
I have to leave for a little bit. BBL.
-
@HansSolo said in Having LAN issues related to a new switch:
Just trying to get two PC's on a local network share.
As stated already this has ZERO to do with pfsense - ZERO... Other than it being your dhcp server I assume, when it come to device A talking to B that are both on the same network... The router/gateway (pfsense) has ZERO to do with that conversation - zero!!
-
IF = Then.
If destination address lies within your subnet Then client one goes direct to client two.
If destination address lies outside your subnet Then the client traffic is directed at the gateway address. If and only then.
-
@HansSolo said in Having LAN issues related to a new switch:
Not only can I not communicate between these PC's
That has nothing to do with pfSense. Communication between devices on a local LAN do not pass through it.
-
@HansSolo
You typed in your original post that all IP addresses are set static. You should go and check all hosts to make sure you typed all the IP addresses in the same subnet and mask. Why don’t you let pfsense DHCP all your network addresses? Then, if you put the hosts on the same physical network, they can all talk to each other, if setup properly.Jeff
-
@JKnott said in Having LAN issues related to a new switch:
@HansSolo said in Having LAN issues related to a new switch:
Not only can I not communicate between these PC's
That has nothing to do with pfSense. Communication between devices on a local LAN do not pass through it.
right. Like I said, I think I was losing my mind that evening ;-)
thx -
@akuma1x said in Having LAN issues related to a new switch:
@HansSolo
You typed in your original post that all IP addresses are set static. You should go and check all hosts to make sure you typed all the IP addresses in the same subnet and mask. Why don’t you let pfsense DHCP all your network addresses? Then, if you put the hosts on the same physical network, they can all talk to each other, if setup properly.Jeff
Jeff,
Good question.
LONG ago I set up two totally separate networks, OPT1 and OPT2 for various reasons. I never liked DHCP and never really needed it because my network doesn't have various users or devices coming and going. everything is static and I like the control that you hav with static IPs. That and I have some devices that I need to occasionally access remotely and they need to have static IP's. -
You can still do that with DHCP and static reserved addresses in pfsense, really easy.
Jeff
-
Dhcp has zero to do with users coming and going..
Most of the time a device will always have the same IP even with dhcp, unless there are more devices than leases and you have device on and off all the time.
Once a device gets a IP via lease - he will continue to renew that IP.. He will even ask for it again when shut off.. The way the dhcpd works is even if that box has been off for really long time - he will still get that IP back because the dhcpd doesn't reuse that lease until he has ran out of other IPs and it has expired, etc..
And you can just always set a reservation for specific device mac address - no that device will always be that IP via dhcp.
The benefit of dhcp is now you can change all your devices to new IP range if so desired without having to actually touch them.. You could change the dns they point to, or the gateway or their domain they use for search suffix, the ntp server they point to, etc. etc.. All without actually having to go touch the physical device.
There is like zero reason not to use dhcp on your network.
-
@johnpoz said in Having LAN issues related to a new switch:
Dhcp has zero to do with users coming and going..
Most of the time a device will always have the same IP even with dhcp, unless there are more devices than leases and you have device on and off all the time.
Once a device gets a IP via lease - he will continue to renew that IP.. He will even ask for it again when shut off.. The way the dhcpd works is even if that box has been off for really long time - he will still get that IP back because the dhcpd doesn't reuse that lease until he has ran out of other IPs and it has expired, etc..
And you can just always set a reservation for specific device mac address - no that device will always be that IP via dhcp.
The benefit of dhcp is now you can change all your devices to new IP range if so desired without having to actually touch them.. You could change the dns they point to, or the gateway or their domain they use for search suffix, the ntp server they point to, etc. etc.. All without actually having to go touch the physical device.
There is like zero reason not to use dhcp on your network.
Thanks. So many differing opinions.......
why-is-dhcp-considered-insecure -
Just like any service it could be considered an attack vector... But for that to happen they have to be able to get on your network.. Is someone plugging in a device and running a dhcp starvation attack on your network... Ie using up all your dhcp leases so that clients can not get an IP? ;)
You need to understand the actual conversation at hand about "possible" risks of a service you are running on your network.. But for you take a blanket stand that service XYZ is insecure.. Without even understanding their conversation and homing in on the words insecure and dhcp is just nonsense..
None of those such concerns would come into play in some home setup with a 5 port switch like a DGS-1005G..
You know your car would be more secure (less likely to be stolen) if you drained all its gas when you parked it.. Do you do that?
-
@johnpoz said in Having LAN issues related to a new switch:
None of those such concerns would come into play in some home setup with a 5 port switch like a DGS-1005G..
Bingo.
Which is why it's just easier for me to use Static IP's in this situation ;-)If I have to go through the trouble to set up reservations, phooey. Just set them Static once and done.
How about we compare DHCP to the car KEYS? Would you leave those in your car?
edit: Why would I leave my car keys - they are always in my pocket... Leaving them in the car would be extra work. My point of the gas was that is an over the top step for little reward... Just like not running dhcp on your network..
You do understand that an attack that is on your network doesn't need to get an IP from dhcp to find out the IP range of the network... And its not rocket science to discover the gateway IP or the dns server, etc. just from being physically attached.. If your worried about such things then you run nac, and the device has to auth before it can do anything on the network, even get an dhcp address.
-
@HansSolo said in Having LAN issues related to a new switch:
Just set them Static once and done.
It takes 2 seconds to set up a reservation - way less time for you to setup a static that is for damn sure... Especially on non pc devices.. And as already stated - if you ever wont to change "anything" you now have to go touch each device.
Dude you do what you want - but lets be clear devices on the same network, pfsense has ZERO to do with their conversation.
-
Dude you do what you want - but lets be clear devices on the same network, pfsense has ZERO to do with their conversation.
Got it. thanks
As for the other points, your opinions are appreciated. it's just that I read opinions from other experts on StackExchange, ServerFault etc who's opinions may be different from yours.Don't get upset.
-
I am not upset.. I understand the statements of sure dhcpd is an attack vector.. Not using it to reduce that attack vector comes with its own cost - is that cost worth the removal of that specific attack vector..
Sorry but NO I am not going to only use static on my network to reduce the possibility of those attacks... Since they have no real possibility in the real world to be used on my network. And to be honest their other easier ways to mitigate that specific sort of attack anyway - if that was the concern..
All steps to "secure" something come with a cost, extra effort, loss of functionality or ease of use, etc. etc.. You need to weigh the actual "risk" of some attack vector with the cost of specific method of mitigation of said risk... Sorry but the risk of possible nefarious use of the dhcp protocol is not high enough to warrant not using it.
If you only have 2 devices on your network and you don't want to use dhcp - sure have fun with that. But I have 40+ devices on my network... And then device that come and go all the time that our outside my control... What going to show my guest that wants to use my wifi how to setup static IP and dns on their phone?
You try setting up a static on say a nest protect smoke alarm - it has no interface at all.. So how you going to do that? ;) Setting a static on my printer is running through click menus with arrow buttons and tiny lcd screen... To set numbers you have to click 1,2,3, etc.. Setting it via dhcp takes all of 2 seconds... It gets a lease - I see the lease on pfsense - click the static reservation button.. put in the IP there you go printer when it renews gets the new IP..
Cost of mitigation of risk vs level of risk always come into play.
-
@johnpoz said in Having LAN issues related to a new switch:
I am not upset.. I understand the statements of sure dhcpd is an attack vector.. Not using it to reduce that attack vector comes with its own cost - is that cost worth the removal of that specific attack vector..
Sorry but NO I am not going to only use static on my network to reduce the possibility of those attacks... Since they have no real possibility in the real world to be used on my network. And to be honest their other easier ways to mitigate that specific sort of attack anyway - if that was the concern..
All steps to "secure" something come with a cost, extra effort, loss of functionality ore ease of use, etc. etc.. You need to way the actual "risk" of some attack vector with the cost of specific method of mitigation of said risk... Sorry but the risk of possible nefarious use of the dhcp protocol is not high enough to warrant not using it.
If you only have 2 devices on your network and you don't want to use dhcp - sure have fun with that. But I have 40+ devices on my network... And then device that come and go all the time that our outside my control... What going to show my guest that wants to use my wifi how to setup static IP and dns on their phone?
You try setting up a static on say a nest protect smoke alarm - it has no interface at all.. So how you going to do that? ;) Setting a static on my printer is running through click menus with arrow buttons and tiny lcd screen... To set numbers you have to click 1,2,3, etc.. Setting it via dhcp takes all of 2 seconds... It gets a lease - I see the lease on pfsense - click the static reservation button.. put in the IP there you go printer when it renews gets the new IP..
Mitigation of risk vs level of risk always come into play.
I use Roost smoke alarms. They're on Wifi and work great. Cost a LOT less too
