Netgate SG-3100 LAN ports cannot go through LAN Gateway.
-
Hello,
I purchased Netgate SG-3100 2 months ago and trying to learn pfSense since then.
But right now I met a very strange problem, which is all the LAN port devices can't connect to LAN gateway which is 192.168.1.1
Below is my LAN interface setting.
The WAN is connect to a static IP modem. Below is my WAN interface setting.
The OPT1 is called WirelessNetwork interface connect to a wifi access point with IP address 192.168.30.1. Below is my WirelessNetwork interface setting.
And below is my firewall rules:
It's very strange that I connect two Windows 10 computers to LAN1 and LAN2, they got corrected IPv4 addresses from LAN DHCP server but cannot go through or ping 192.168.1.1. But these two computers can ping each other.
I checked all Ethernet cables and they're all good. I connect a switch to OPT1 port (the WirelessNetwork) with upon computers and all computers can go through and ping 192.168.30.1 and also 192.168.1.1.
Can anyone help why my LAN ports cannot go through LAN Gateway? Is there any other settings I missed? Thank you. -
first, i can tell you that the second rule on WAN interface is wrong,
you will never see "LAN net" from the "WAN" interface.
is there any reason to block port 10443 to the firewall?
the WAN ip is not 192.168.1.x right?
the configuration of the interfaces and the other rules seems good to me, maybe there is a problem from the dhcp server.
i don't know the sg3100 very well idk if that "switch port" need a selection -
And how are you accessing it to show the images?
And yeah that 2nd wan rule is just pointless -
@mmajian said in Netgate SG-3100 LAN ports cannot go through LAN Gateway.:
I connect a switch to OPT1 port (the WirelessNetwork) with upon computers and all computers can go through and ping 192.168.30.1 and also 192.168.1.1.
i suppose from there ^
-
@mmajian said in Netgate SG-3100 LAN ports cannot go through LAN Gateway.:
wifi access point with IP address 192.168.30.1
How is your AP same IP as your pfsense interface?
Vs showing your IP settings, show us your switch settings - this is where the lan ports are.
-
@kiokoman It should be port 443 to the firewall. And the WAN ip is static IP from IPS not 192.168.x.x.
The DHCP looks correct, all computers got the correct Ip address. -
ok, if you didn't set any wrong gateway on the dhcp server,
now give more info to johnpoz -
@johnpoz Thank you. I can access to firewall from OPT1 port (the WirelessNetwork) interface. I disabled firewall rules for WirelessNetwork interface.
-
Well if your getting dhcp - from pfsense? Or you got some other device on your network with 192.168.1.1 handing out dhcp?? On your clients that are on 192.168.1.1 validate the mac of what your seeing for 192.168.1/24 that its pfsense mac address.
-
@johnpoz Sorry, the wifi access point with IP address 192.168.30.14. My IP settings are: LAN 192.168.1.1/24, WAN static IP from IPS, Wirelessnetwork 192.168.30.1/24,
OpenVPN 192.168.70.1/24 -
Ok great - now lets see you validate that your clients are seeing the correct mac for pfsense lan interface.. You show pfsense log handing them IP address?
Lets see your switch config in your pfsense, and lets see your interface assignments.
-
@johnpoz Only one Win10 computer connect to LAN1 prot. It received correct IP address as 192.168.1.100. But it can't ping to 192.168.1.1
And I can see the correct IP, MAC and computer name in pfSense DHCP leases, but the online status is offline. -
@johnpoz The switch is LAN1 active with default config. The interface assignments are
-
maybe some antivirus/firewall on that windows 10 machine that can block it?
is the network set as public instead of private ? -
@mmajian said in Netgate SG-3100 LAN ports cannot go through LAN Gateway.:
but the online status is offline.
That means it can not get dns..
Well if you can see the correct mac and get an IP - then yeah I would think something wrong on the machine itself if plugged directly into the 3100 switch ports, and nothing else connected. Simple enough to sniff on pfsense - while your pinging, so you see the pings or not?
-
@johnpoz I disabled all firewalls in Win10 computer and still can't ping. And no I can't see any pings or traffics from win10 computer to pfSense in firewall logs.
-
Hmm, curious. Are the switch settings in the SG-3100 still at their defaults?
Can you ping out from pfSense to the Windows host on LAN?
Steve
-
@stephenw10 Yes, the switch settings for SG-3100 are their defaults. And no I can't ping Windows host from pfSense (connection timed out.)
-
Hmm, sure behaves like a subnet conflict, like there is something else there responding as 192.168.1.1. If that was the case I would expect to see a load of errors in the system log though.
Try running a packet capture on the LAN from Diag > Packet capture whilst pinging from the Windows host. Do you see the pings arriving?
Steve
-
@stephenw10 I also did try to change IP address for LAN to 192.168.10.1. And Windows computer get correct IP from DHCP 192.168.10.100. But still can't ping LAN.
I will try to run packet capture on Monday and see what will happen. Thank you so much. -
I also found a very strange thing that when I connect Win10 computer to WirelessNetwork port, it gets correct IP address and gateway
But it also can ping LAN 192.168.1.1
Even I have this rule in WirelessNetwork
Also when I tried to get route from 192.168.30.52 to 192.168.1.1 in Win10 computer
It seems like it access 192.168.1.1 directly not through it's gateway 192.168.30.1
Can anyone help to explain these weird phenomenon? Maybe by fixing this will fix the LAN ports can't reach LAN gateway problem. Thanks. -
Not necessarily.
192.168.1.1 is still only one hop away since that address exists on the same hop you reach at 192.168.30.1. It is free to respond to a traceroute using that address.
-
@Derelict Thank you very much for trace-route. But why can I ping 192.168.1.1 from WirelessNetwork. I think anything from WirelessNetwork net to LAN net should be blocked by default.
-
Well, if you want to BLOCK traffic on from Wireless network to LAN net then BLOCK it. Don't block traffic with a pass rule.
Add a rule above what you have that blocks traffic to destination LAN net above what you have and see if the behavior changes.
-
@Derelict Great, thank you. I created a BLOCK rule and it's working.
Now I am backing LAN ports can't reach LAN gateway problem. Looks like fixing problems with WirelessNetwork doesn't fix LAN net. -
@stephenw10 I connect one of the Win10 computer to LAN1 port and Switch setting is here:
It's getting correct IP address from LAN DHCP 192.168.1.115, but is't offline
I started Packet capture on LAN interface for IPv4 only.
Looks like LAN can receive from Win10 computer but never reply. -
Ok that is good info, now lets see your actual switch config.
-
@johnpoz Sorry I am new to pfSense. What is actual switch config and how to view it? Thanks.
-
@mmajian said in Netgate SG-3100 LAN ports cannot go through LAN Gateway.:
@Derelict Great, thank you. I created a BLOCK rule and it's working.
Now I am backing LAN ports can't reach LAN gateway problem. Looks like fixing problems with WirelessNetwork doesn't fix LAN net.Yet another victim.
Someday people will listen.
-
See that tab you showing the ports - hit the vlan tab.. lets make sure nothing messed up there
That is the default settings, from one of my 3100s
You don't have any rules in in your floating tab do you? And for good measure lets see the routes.. under diag..
-
@johnpoz Yes, my VLANs setting are same as yours. And I don't have rules in floating tab. And here is the routes:
-
Have you tried reloading the firewall rules? Or I take it you have tried rebooting it? ;)
Try changing the IP to say 192.168.2.1/24 on the lan interface?Everything looks right..
Are you seeing any errors on the interface, in the interface status?
LAN Interface (lan, igb0) Status up MAC Address 00:08:a2:0c:e6:24 - ADI Engineering IPv4 Address 192.168.9.253 Subnet mask IPv4 255.255.255.0 IPv6 Link Local fe80::208:a2ff:fe0c:e624%igb0 IPv6 Address 2001:470:snipped::253 Subnet mask IPv6 64 MTU 1500 Media 1000baseT <full-duplex> In/out packets 461831409/992950006 (321.12 GiB/1.27 TiB) In/out packets (pass) 461831409/992950006 (321.12 GiB/1.27 TiB) In/out packets (block) 8743/0 (506 KiB/0 B) In/out errors 0/0 Collisions 0
You tried a different port?
-
Looks like you have pfBlocker installed. Let's see the floating firewall rules. You maybe need to edit them to see all the info.
That can block and not log traffic in LAN if it;s not configured correctly.
Steve
-
He stated he has no rules on floating.
You didn't setup any port forward rules did you?
I would like to see the full output of the rules to be honest
https://docs.netgate.com/pfsense/en/latest/firewall/viewing-the-full-pf-ruleset.html -
@johnpoz No, zero errors on LAN interface and I did tried different ports. And I did tried change LAN IP to 192.168.10.1/24, still not working.
-
@stephenw10 I disabled pfBlocker but no luck.
-
@johnpoz No port forward rules. No errors on LAN interface:
Here are all rules
-
@mmajian said in Netgate SG-3100 LAN ports cannot go through LAN Gateway.:
Yes, my VLANs setting are same as yours.
Please post them.
It's not rules (though it looks like you are still using a
!
LAN net rule for some inexplicable reason.) -
@Derelict Sure, here is my VLAN:
Here are ports:
And I disabled all firewall rule here:
I uninstalled pfBlocker and disabled OpenVPN. Then reboot the firewall but still no luck.
Next thing I am going to try is reset to factory default.
But if that still not working I think it might be the hardware problem. -
Disabling pf will, as it says there, disable NAT so you will be unable to connect to any public IPs from any internal interface.
You should still be able to connect to LAN though...It seems unlikely to be a hardware issue since clients on LAN are still able to pull a DHCP address, traffic is able to flow both ways for that to happen.
Do you see the connected LAN client in the ARP table? (Diag > ARP)
Steve