Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Netgate SG-3100 LAN ports cannot go through LAN Gateway.

    Scheduled Pinned Locked Moved General pfSense Questions
    64 Posts 5 Posters 10.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mmajian @Derelict
      last edited by

      @Derelict Sure, here is my VLAN:
      58454d43-a9f6-4f9f-9de1-5648feef1227-image.png
      Here are ports:
      edcd6726-bc36-48a9-8489-e1364d35ea3e-image.png
      And I disabled all firewall rule here:
      ec21994f-994c-4954-9eb8-a658f3dd7ec8-image.png
      I uninstalled pfBlocker and disabled OpenVPN. Then reboot the firewall but still no luck.
      Next thing I am going to try is reset to factory default.
      But if that still not working I think it might be the hardware problem.

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        Disabling pf will, as it says there, disable NAT so you will be unable to connect to any public IPs from any internal interface.
        You should still be able to connect to LAN though...

        It seems unlikely to be a hardware issue since clients on LAN are still able to pull a DHCP address, traffic is able to flow both ways for that to happen.

        Do you see the connected LAN client in the ARP table? (Diag > ARP)

        Steve

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by johnpoz

          @stephenw10 said in Netgate SG-3100 LAN ports cannot go through LAN Gateway.:

          Do you see the connected LAN client in the ARP table? (Diag > ARP)

          That is a very good point... Do you maybe have anything with static arp setup?

          When you ping pfsense, from you pc... What does pfsense show in its arp table for this client IP.. Does the mac in the table match?

          where is that block ! mvneta1 inet from 192.168.1.0/24 to any coming from?

          Make sure you remove any ! rules...

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          stephenw10S M 2 Replies Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator @johnpoz
            last edited by

            @johnpoz said in Netgate SG-3100 LAN ports cannot go through LAN Gateway.:

            where is that block ! mvneta1 inet from 192.168.1.0/24 to any coming from?

            That's a system default rule. It blocks traffic from an assigned subnet arriving on any other interface.

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              When DHCP works but nothing else does my first thought is a missing firewall rule. But those rules look good. And with pf disabled you should always be able to reach the LAN IP.
              Also you should be able to ping out to a client on LAN with no rules in place.

              So then why is it not replying... a bad route perhaps or subnet conflct. But those also look good.

              So then we have mystery disappearing packets and that is usually either the IPSec daemon grabbing them or captive portal blocking that traffic in ipfw.
              Do you have either IPSec or Captive Portal configured?

              Steve

              1 Reply Last reply Reply Quote 0
              • M
                mmajian @johnpoz
                last edited by

                @johnpoz @stephenw10 No I don't see connected LAN client in the ARP table. I only the LAN itself.
                7e7db871-025d-4e3d-b701-05e1b62e5f65-image.png

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by

                  Well that going to be kind of problem answering something... But how did you sniff, you should of seen arp go out if pfsense did not know what it was..

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  M 1 Reply Last reply Reply Quote 0
                  • M
                    mmajian @johnpoz
                    last edited by

                    @johnpoz @stephenw10 And I don't have either IPSec or Captive Portal configured. Here is my IPSec Advanced Settings:
                    ec6a8c8e-c8ef-432c-8803-123650ea8cb1-image.png
                    4ccb0f75-94f8-4855-96af-73b84fc02f29-image.png

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      Well it would be impossible for pfsense to answer back if there is no mac for it to send the traffic too.

                      So sniff when you ping the pfsense again, making sure your sniffing all.. You should see an arp... and answer

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      M 1 Reply Last reply Reply Quote 0
                      • kiokomanK
                        kiokoman LAYER 8
                        last edited by

                        reinstall from scratch, who know what experimentation you did in the last two month to end like this, i think it would be faster even if it would be more fun to understand what is it :)

                        ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
                        Please do not use chat/PM to ask for help
                        we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
                        Don't forget to Upvote with the 👍 button for any post you find to be helpful.

                        1 Reply Last reply Reply Quote 0
                        • M
                          mmajian @johnpoz
                          last edited by

                          @johnpoz I sorry what do you mean to sniff when ping pfSense.

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            Run a packet capture on LAN. Set promiscuous mode. Leave the settings at 'any' to capture everything. Set, say, 1000 packets.
                            Connect the lan client and start pinging.

                            You should see the DHCP traffic at the very least.

                            If you see incoming ping requests and no replies you should see ARP requests instead if that client is still not in the ARP table.

                            Steve

                            M 1 Reply Last reply Reply Quote 0
                            • kiokomanK
                              kiokoman LAYER 8
                              last edited by

                              and .. do you remember if you have made any changes inside System / Advanced / System Tunables ?

                              ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
                              Please do not use chat/PM to ask for help
                              we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
                              Don't forget to Upvote with the 👍 button for any post you find to be helpful.

                              M 1 Reply Last reply Reply Quote 0
                              • M
                                mmajian @stephenw10
                                last edited by

                                @stephenw10 @johnpoz
                                Here is package capture: (LAN is 192.168.1.1, LAN client is 192.168.1.115)
                                packagecap.txt

                                DerelictD 1 Reply Last reply Reply Quote 0
                                • M
                                  mmajian @kiokoman
                                  last edited by

                                  @kiokoman I don't remember I changed that, here is mine:
                                  e18c746f-58b4-4137-b2b8-2b760922a7bc-image.png

                                  1 Reply Last reply Reply Quote 0
                                  • DerelictD
                                    Derelict LAYER 8 Netgate @mmajian
                                    last edited by

                                    @mmajian said in Netgate SG-3100 LAN ports cannot go through LAN Gateway.:

                                    @stephenw10 @johnpoz
                                    Here is package capture: (LAN is 192.168.1.1, LAN client is 192.168.1.115)
                                    packagecap.txt

                                    If that packet capture is still available for download, download it and attach it.

                                    Chattanooga, Tennessee, USA
                                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                    M 1 Reply Last reply Reply Quote 0
                                    • M
                                      mmajian @Derelict
                                      last edited by

                                      @Derelict
                                      packetcapture.cap
                                      Attached is packet capture file.

                                      1 Reply Last reply Reply Quote 0
                                      • DerelictD
                                        Derelict LAYER 8 Netgate
                                        last edited by

                                        The first problem I see is 192.168.1.115 is asking 192.168.1.1 for DNS and it is not responding.

                                        How is DNS configured on the firewall? Services > DNS Resolver or Services > DNS Forwarder needs to be enabled or the clients need to be configured to use something like google or cloudflare for DNS.

                                        The second problem I see is that whatever device is d0:50:99:d0:00:ed ( D0:50:99 AsrockIn ASRock Incorporation) keeps asking for an ARP WHO HAS 192.168.1.115 when that is its own IP address. Of course nobody's going to answer, and why is it even asking?

                                        I think you can start looking for causes of whatever it is you are seeing off the firewall.

                                        Detach whatever switch is connected and connect to one of the LAN ports. Does it work?

                                        Chattanooga, Tennessee, USA
                                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                        M 2 Replies Last reply Reply Quote 0
                                        • M
                                          mmajian @Derelict
                                          last edited by

                                          @Derelict Thank you.
                                          The DNS Forwarder is disabled. The DNS resolver is below (I don't think I changed this):
                                          7d852e0b-655d-4ae5-af2d-7841eaecb588-image.png

                                          And yes the device d0:50:99:d0:00:ed is the Win10 computer connect to LAN1. I will try disconnect all ports except LAN1 and see what will happen.

                                          1 Reply Last reply Reply Quote 0
                                          • M
                                            mmajian @Derelict
                                            last edited by mmajian

                                            @Derelict @stephenw10 @johnpoz
                                            Very good news. I add a static mapping in DHCP server for Win10 computer and check "Create an ARP Table Static Entry for this MAC & IP Address pair.".
                                            70f62d40-fe3c-4b08-a998-dd9f73a754fc-image.png

                                            Now it can ping 192.168.1.1 and solve the immediate problem.
                                            In LAN DHCP server I did check "Enable Static ARP entries"
                                            0249a576-93ca-48e0-a337-62fbf5f1db6c-image.png
                                            Is this means all dynamic DHCP won't have entries in ARP?
                                            Can anyone explain why? Thank you so much.
                                            Jian

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.