Netgate SG-3100 LAN ports cannot go through LAN Gateway.

stephenw10

Hmm, curious. Are the switch settings in the SG-3100 still at their defaults?

Can you ping out from pfSense to the Windows host on LAN?

Steve

mmajian

@stephenw10 Yes, the switch settings for SG-3100 are their defaults. And no I can't ping Windows host from pfSense (connection timed out.)

stephenw10

Hmm, sure behaves like a subnet conflict, like there is something else there responding as 192.168.1.1. If that was the case I would expect to see a load of errors in the system log though.

Try running a packet capture on the LAN from Diag > Packet capture whilst pinging from the Windows host. Do you see the pings arriving?

Steve

mmajian

@stephenw10 I also did try to change IP address for LAN to 192.168.10.1. And Windows computer get correct IP from DHCP 192.168.10.100. But still can't ping LAN.
I will try to run packet capture on Monday and see what will happen. Thank you so much.

mmajian

I also found a very strange thing that when I connect Win10 computer to WirelessNetwork port, it gets correct IP address and gateway

But it also can ping LAN 192.168.1.1

Even I have this rule in WirelessNetwork

Also when I tried to get route from 192.168.30.52 to 192.168.1.1 in Win10 computer

It seems like it access 192.168.1.1 directly not through it's gateway 192.168.30.1
Can anyone help to explain these weird phenomenon? Maybe by fixing this will fix the LAN ports can't reach LAN gateway problem. Thanks.

Derelict

Not necessarily.

192.168.1.1 is still only one hop away since that address exists on the same hop you reach at 192.168.30.1. It is free to respond to a traceroute using that address.

mmajian

@Derelict Thank you very much for trace-route. But why can I ping 192.168.1.1 from WirelessNetwork. I think anything from WirelessNetwork net to LAN net should be blocked by default.

Derelict

Well, if you want to BLOCK traffic on from Wireless network to LAN net then BLOCK it. Don't block traffic with a pass rule.

Add a rule above what you have that blocks traffic to destination LAN net above what you have and see if the behavior changes.

mmajian

@Derelict Great, thank you. I created a BLOCK rule and it's working.
Now I am backing LAN ports can't reach LAN gateway problem. Looks like fixing problems with WirelessNetwork doesn't fix LAN net.

mmajian

@stephenw10 I connect one of the Win10 computer to LAN1 port and Switch setting is here:

It's getting correct IP address from LAN DHCP 192.168.1.115, but is't offline

I started Packet capture on LAN interface for IPv4 only.

Looks like LAN can receive from Win10 computer but never reply.

johnpoz

Ok that is good info, now lets see your actual switch config.

mmajian

@johnpoz Sorry I am new to pfSense. What is actual switch config and how to view it? Thanks.

Derelict

@mmajian said in Netgate SG-3100 LAN ports cannot go through LAN Gateway.:

@Derelict Great, thank you. I created a BLOCK rule and it's working.
Now I am backing LAN ports can't reach LAN gateway problem. Looks like fixing problems with WirelessNetwork doesn't fix LAN net.

Yet another victim.

Someday people will listen.

johnpoz

See that tab you showing the ports - hit the vlan tab.. lets make sure nothing messed up there

That is the default settings, from one of my 3100s

You don't have any rules in in your floating tab do you? And for good measure lets see the routes.. under diag..

mmajian

@johnpoz Yes, my VLANs setting are same as yours. And I don't have rules in floating tab. And here is the routes:

johnpoz

Have you tried reloading the firewall rules? Or I take it you have tried rebooting it? ;)
Try changing the IP to say 192.168.2.1/24 on the lan interface?

Everything looks right..

Are you seeing any errors on the interface, in the interface status?


LAN Interface (lan, igb0)

Status
    up
MAC Address
    00:08:a2:0c:e6:24 - ADI Engineering
IPv4 Address
    192.168.9.253
Subnet mask IPv4
    255.255.255.0
IPv6 Link Local
    fe80::208:a2ff:fe0c:e624%igb0
IPv6 Address
    2001:470:snipped::253
Subnet mask IPv6
    64
MTU
    1500
Media
    1000baseT <full-duplex>
In/out packets
    461831409/992950006 (321.12 GiB/1.27 TiB)
In/out packets (pass)
    461831409/992950006 (321.12 GiB/1.27 TiB)
In/out packets (block)
    8743/0 (506 KiB/0 B)
In/out errors
    0/0
Collisions
    0

You tried a different port?

stephenw10

Looks like you have pfBlocker installed. Let's see the floating firewall rules. You maybe need to edit them to see all the info.

That can block and not log traffic in LAN if it;s not configured correctly.

Steve

johnpoz

He stated he has no rules on floating.

You didn't setup any port forward rules did you?

I would like to see the full output of the rules to be honest
https://docs.netgate.com/pfsense/en/latest/firewall/viewing-the-full-pf-ruleset.html

mmajian

@johnpoz No, zero errors on LAN interface and I did tried different ports. And I did tried change LAN IP to 192.168.10.1/24, still not working.

mmajian

@stephenw10 I disabled pfBlocker but no luck.