Netgate SG-3100 LAN ports cannot go through LAN Gateway.

johnpoz

Have you tried reloading the firewall rules? Or I take it you have tried rebooting it? ;)
Try changing the IP to say 192.168.2.1/24 on the lan interface?

Everything looks right..

Are you seeing any errors on the interface, in the interface status?


LAN Interface (lan, igb0)

Status
    up
MAC Address
    00:08:a2:0c:e6:24 - ADI Engineering
IPv4 Address
    192.168.9.253
Subnet mask IPv4
    255.255.255.0
IPv6 Link Local
    fe80::208:a2ff:fe0c:e624%igb0
IPv6 Address
    2001:470:snipped::253
Subnet mask IPv6
    64
MTU
    1500
Media
    1000baseT <full-duplex>
In/out packets
    461831409/992950006 (321.12 GiB/1.27 TiB)
In/out packets (pass)
    461831409/992950006 (321.12 GiB/1.27 TiB)
In/out packets (block)
    8743/0 (506 KiB/0 B)
In/out errors
    0/0
Collisions
    0

You tried a different port?

stephenw10

Looks like you have pfBlocker installed. Let's see the floating firewall rules. You maybe need to edit them to see all the info.

That can block and not log traffic in LAN if it;s not configured correctly.

Steve

johnpoz

He stated he has no rules on floating.

You didn't setup any port forward rules did you?

I would like to see the full output of the rules to be honest
https://docs.netgate.com/pfsense/en/latest/firewall/viewing-the-full-pf-ruleset.html

mmajian

@johnpoz No, zero errors on LAN interface and I did tried different ports. And I did tried change LAN IP to 192.168.10.1/24, still not working.

mmajian

@stephenw10 I disabled pfBlocker but no luck.

mmajian

@johnpoz No port forward rules. No errors on LAN interface:

Here are all rules

Derelict

@mmajian said in Netgate SG-3100 LAN ports cannot go through LAN Gateway.:

Yes, my VLANs setting are same as yours.

Please post them.

It's not rules (though it looks like you are still using a ! LAN net rule for some inexplicable reason.)

mmajian

@Derelict Sure, here is my VLAN:

Here are ports:

And I disabled all firewall rule here:

I uninstalled pfBlocker and disabled OpenVPN. Then reboot the firewall but still no luck.
Next thing I am going to try is reset to factory default.
But if that still not working I think it might be the hardware problem.

stephenw10

Disabling pf will, as it says there, disable NAT so you will be unable to connect to any public IPs from any internal interface.
You should still be able to connect to LAN though...

It seems unlikely to be a hardware issue since clients on LAN are still able to pull a DHCP address, traffic is able to flow both ways for that to happen.

Do you see the connected LAN client in the ARP table? (Diag > ARP)

Steve

johnpoz

@stephenw10 said in Netgate SG-3100 LAN ports cannot go through LAN Gateway.:

Do you see the connected LAN client in the ARP table? (Diag > ARP)

That is a very good point... Do you maybe have anything with static arp setup?

When you ping pfsense, from you pc... What does pfsense show in its arp table for this client IP.. Does the mac in the table match?

where is that block ! mvneta1 inet from 192.168.1.0/24 to any coming from?

Make sure you remove any ! rules...

stephenw10

@johnpoz said in Netgate SG-3100 LAN ports cannot go through LAN Gateway.:

where is that block ! mvneta1 inet from 192.168.1.0/24 to any coming from?

That's a system default rule. It blocks traffic from an assigned subnet arriving on any other interface.

stephenw10

When DHCP works but nothing else does my first thought is a missing firewall rule. But those rules look good. And with pf disabled you should always be able to reach the LAN IP.
Also you should be able to ping out to a client on LAN with no rules in place.

So then why is it not replying... a bad route perhaps or subnet conflct. But those also look good.

So then we have mystery disappearing packets and that is usually either the IPSec daemon grabbing them or captive portal blocking that traffic in ipfw.
Do you have either IPSec or Captive Portal configured?

Steve

mmajian

@johnpoz @stephenw10 No I don't see connected LAN client in the ARP table. I only the LAN itself.

johnpoz

Well that going to be kind of problem answering something... But how did you sniff, you should of seen arp go out if pfsense did not know what it was..

mmajian

@johnpoz @stephenw10 And I don't have either IPSec or Captive Portal configured. Here is my IPSec Advanced Settings:

johnpoz

Well it would be impossible for pfsense to answer back if there is no mac for it to send the traffic too.

So sniff when you ping the pfsense again, making sure your sniffing all.. You should see an arp... and answer

kiokoman

reinstall from scratch, who know what experimentation you did in the last two month to end like this, i think it would be faster even if it would be more fun to understand what is it :)

mmajian

@johnpoz I sorry what do you mean to sniff when ping pfSense.

stephenw10

Run a packet capture on LAN. Set promiscuous mode. Leave the settings at 'any' to capture everything. Set, say, 1000 packets.
Connect the lan client and start pinging.

You should see the DHCP traffic at the very least.

If you see incoming ping requests and no replies you should see ARP requests instead if that client is still not in the ARP table.

Steve

kiokoman

and .. do you remember if you have made any changes inside System / Advanced / System Tunables ?