Netgate SG-3100 LAN ports cannot go through LAN Gateway.
-
@mmajian said in Netgate SG-3100 LAN ports cannot go through LAN Gateway.:
wifi access point with IP address 192.168.30.1
How is your AP same IP as your pfsense interface?
Vs showing your IP settings, show us your switch settings - this is where the lan ports are.
-
@kiokoman It should be port 443 to the firewall. And the WAN ip is static IP from IPS not 192.168.x.x.
The DHCP looks correct, all computers got the correct Ip address. -
ok, if you didn't set any wrong gateway on the dhcp server,
now give more info to johnpoz -
@johnpoz Thank you. I can access to firewall from OPT1 port (the WirelessNetwork) interface. I disabled firewall rules for WirelessNetwork interface.
-
Well if your getting dhcp - from pfsense? Or you got some other device on your network with 192.168.1.1 handing out dhcp?? On your clients that are on 192.168.1.1 validate the mac of what your seeing for 192.168.1/24 that its pfsense mac address.
-
@johnpoz Sorry, the wifi access point with IP address 192.168.30.14. My IP settings are: LAN 192.168.1.1/24, WAN static IP from IPS, Wirelessnetwork 192.168.30.1/24,
OpenVPN 192.168.70.1/24 -
Ok great - now lets see you validate that your clients are seeing the correct mac for pfsense lan interface.. You show pfsense log handing them IP address?
Lets see your switch config in your pfsense, and lets see your interface assignments.
-
@johnpoz Only one Win10 computer connect to LAN1 prot. It received correct IP address as 192.168.1.100. But it can't ping to 192.168.1.1
And I can see the correct IP, MAC and computer name in pfSense DHCP leases, but the online status is offline. -
@johnpoz The switch is LAN1 active with default config. The interface assignments are
-
maybe some antivirus/firewall on that windows 10 machine that can block it?
is the network set as public instead of private ? -
@mmajian said in Netgate SG-3100 LAN ports cannot go through LAN Gateway.:
but the online status is offline.
That means it can not get dns..
Well if you can see the correct mac and get an IP - then yeah I would think something wrong on the machine itself if plugged directly into the 3100 switch ports, and nothing else connected. Simple enough to sniff on pfsense - while your pinging, so you see the pings or not?
-
@johnpoz I disabled all firewalls in Win10 computer and still can't ping. And no I can't see any pings or traffics from win10 computer to pfSense in firewall logs.
-
Hmm, curious. Are the switch settings in the SG-3100 still at their defaults?
Can you ping out from pfSense to the Windows host on LAN?
Steve
-
@stephenw10 Yes, the switch settings for SG-3100 are their defaults. And no I can't ping Windows host from pfSense (connection timed out.)
-
Hmm, sure behaves like a subnet conflict, like there is something else there responding as 192.168.1.1. If that was the case I would expect to see a load of errors in the system log though.
Try running a packet capture on the LAN from Diag > Packet capture whilst pinging from the Windows host. Do you see the pings arriving?
Steve
-
@stephenw10 I also did try to change IP address for LAN to 192.168.10.1. And Windows computer get correct IP from DHCP 192.168.10.100. But still can't ping LAN.
I will try to run packet capture on Monday and see what will happen. Thank you so much. -
I also found a very strange thing that when I connect Win10 computer to WirelessNetwork port, it gets correct IP address and gateway
But it also can ping LAN 192.168.1.1
Even I have this rule in WirelessNetwork
Also when I tried to get route from 192.168.30.52 to 192.168.1.1 in Win10 computer
It seems like it access 192.168.1.1 directly not through it's gateway 192.168.30.1
Can anyone help to explain these weird phenomenon? Maybe by fixing this will fix the LAN ports can't reach LAN gateway problem. Thanks. -
Not necessarily.
192.168.1.1 is still only one hop away since that address exists on the same hop you reach at 192.168.30.1. It is free to respond to a traceroute using that address.
-
@Derelict Thank you very much for trace-route. But why can I ping 192.168.1.1 from WirelessNetwork. I think anything from WirelessNetwork net to LAN net should be blocked by default.
-
Well, if you want to BLOCK traffic on from Wireless network to LAN net then BLOCK it. Don't block traffic with a pass rule.
Add a rule above what you have that blocks traffic to destination LAN net above what you have and see if the behavior changes.
