Netgate SG-3100 LAN ports cannot go through LAN Gateway.

mmajian · Oct 11, 2019, 9:27 PM

Hello,
I purchased Netgate SG-3100 2 months ago and trying to learn pfSense since then.
But right now I met a very strange problem, which is all the LAN port devices can't connect to LAN gateway which is 192.168.1.1
Below is my LAN interface setting.
🔒 Log in to view
The WAN is connect to a static IP modem. Below is my WAN interface setting.
🔒 Log in to view
The OPT1 is called WirelessNetwork interface connect to a wifi access point with IP address 192.168.30.1. Below is my WirelessNetwork interface setting.
🔒 Log in to view
And below is my firewall rules:
🔒 Log in to view
🔒 Log in to view
🔒 Log in to view
It's very strange that I connect two Windows 10 computers to LAN1 and LAN2, they got corrected IPv4 addresses from LAN DHCP server but cannot go through or ping 192.168.1.1. But these two computers can ping each other.
I checked all Ethernet cables and they're all good. I connect a switch to OPT1 port (the WirelessNetwork) with upon computers and all computers can go through and ping 192.168.30.1 and also 192.168.1.1.
Can anyone help why my LAN ports cannot go through LAN Gateway? Is there any other settings I missed? Thank you.

kiokoman · Oct 12, 2019, 4:17 PM

first, i can tell you that the second rule on WAN interface is wrong,
you will never see "LAN net" from the "WAN" interface.
is there any reason to block port 10443 to the firewall?
the WAN ip is not 192.168.1.x right?
the configuration of the interfaces and the other rules seems good to me, maybe there is a problem from the dhcp server.
i don't know the sg3100 very well idk if that "switch port" need a selection

johnpoz · Oct 12, 2019, 4:27 PM

And how are you accessing it to show the images?
And yeah that 2nd wan rule is just pointless

kiokoman · Oct 12, 2019, 4:30 PM

@mmajian said in Netgate SG-3100 LAN ports cannot go through LAN Gateway.:

I connect a switch to OPT1 port (the WirelessNetwork) with upon computers and all computers can go through and ping 192.168.30.1 and also 192.168.1.1.

i suppose from there ^

johnpoz · Oct 12, 2019, 4:32 PM

@mmajian said in Netgate SG-3100 LAN ports cannot go through LAN Gateway.:

wifi access point with IP address 192.168.30.1

How is your AP same IP as your pfsense interface?

Vs showing your IP settings, show us your switch settings - this is where the lan ports are.

mmajian · Oct 12, 2019, 4:37 PM

@kiokoman It should be port 443 to the firewall. And the WAN ip is static IP from IPS not 192.168.x.x.
The DHCP looks correct, all computers got the correct Ip address.

kiokoman · Oct 12, 2019, 4:40 PM

ok, if you didn't set any wrong gateway on the dhcp server,
now give more info to johnpoz

mmajian · Oct 12, 2019, 4:41 PM

@johnpoz Thank you. I can access to firewall from OPT1 port (the WirelessNetwork) interface. I disabled firewall rules for WirelessNetwork interface.

johnpoz · Oct 12, 2019, 4:44 PM

Well if your getting dhcp - from pfsense? Or you got some other device on your network with 192.168.1.1 handing out dhcp?? On your clients that are on 192.168.1.1 validate the mac of what your seeing for 192.168.1/24 that its pfsense mac address.

mmajian · Oct 12, 2019, 4:48 PM

@johnpoz Sorry, the wifi access point with IP address 192.168.30.14. My IP settings are: LAN 192.168.1.1/24, WAN static IP from IPS, Wirelessnetwork 192.168.30.1/24,
OpenVPN 192.168.70.1/24

johnpoz · Oct 12, 2019, 4:50 PM

Ok great - now lets see you validate that your clients are seeing the correct mac for pfsense lan interface.. You show pfsense log handing them IP address?

Lets see your switch config in your pfsense, and lets see your interface assignments.

mmajian · Oct 12, 2019, 4:51 PM

@johnpoz Only one Win10 computer connect to LAN1 prot. It received correct IP address as 192.168.1.100. But it can't ping to 192.168.1.1
And I can see the correct IP, MAC and computer name in pfSense DHCP leases, but the online status is offline.

mmajian · Oct 12, 2019, 4:55 PM

@johnpoz The switch is LAN1 active with default config. The interface assignments are
🔒 Log in to view

kiokoman · Oct 12, 2019, 6:29 PM

maybe some antivirus/firewall on that windows 10 machine that can block it?
is the network set as public instead of private ?

johnpoz · Oct 12, 2019, 6:43 PM

@mmajian said in Netgate SG-3100 LAN ports cannot go through LAN Gateway.:

but the online status is offline.

That means it can not get dns..

Well if you can see the correct mac and get an IP - then yeah I would think something wrong on the machine itself if plugged directly into the 3100 switch ports, and nothing else connected. Simple enough to sniff on pfsense - while your pinging, so you see the pings or not?

mmajian · Oct 12, 2019, 7:05 PM

@johnpoz I disabled all firewalls in Win10 computer and still can't ping. And no I can't see any pings or traffics from win10 computer to pfSense in firewall logs.

stephenw10 · Oct 13, 2019, 5:25 PM

Hmm, curious. Are the switch settings in the SG-3100 still at their defaults?

Can you ping out from pfSense to the Windows host on LAN?

Steve

mmajian · Oct 13, 2019, 6:00 PM

@stephenw10 Yes, the switch settings for SG-3100 are their defaults. And no I can't ping Windows host from pfSense (connection timed out.)

stephenw10 · Oct 13, 2019, 6:09 PM

Hmm, sure behaves like a subnet conflict, like there is something else there responding as 192.168.1.1. If that was the case I would expect to see a load of errors in the system log though.

Try running a packet capture on the LAN from Diag > Packet capture whilst pinging from the Windows host. Do you see the pings arriving?

Steve

mmajian · Oct 13, 2019, 6:17 PM

@stephenw10 I also did try to change IP address for LAN to 192.168.10.1. And Windows computer get correct IP from DHCP 192.168.10.100. But still can't ping LAN.
I will try to run packet capture on Monday and see what will happen. Thank you so much.