Netgate SG-3100 LAN ports cannot go through LAN Gateway.
-
Well that going to be kind of problem answering something... But how did you sniff, you should of seen arp go out if pfsense did not know what it was..
-
@johnpoz @stephenw10 And I don't have either IPSec or Captive Portal configured. Here is my IPSec Advanced Settings:
🔒 Log in to view
🔒 Log in to view -
Well it would be impossible for pfsense to answer back if there is no mac for it to send the traffic too.
So sniff when you ping the pfsense again, making sure your sniffing all.. You should see an arp... and answer
-
reinstall from scratch, who know what experimentation you did in the last two month to end like this, i think it would be faster even if it would be more fun to understand what is it :)
-
@johnpoz I sorry what do you mean to sniff when ping pfSense.
-
Run a packet capture on LAN. Set promiscuous mode. Leave the settings at 'any' to capture everything. Set, say, 1000 packets.
Connect the lan client and start pinging.You should see the DHCP traffic at the very least.
If you see incoming ping requests and no replies you should see ARP requests instead if that client is still not in the ARP table.
Steve
-
and .. do you remember if you have made any changes inside System / Advanced / System Tunables ?
-
@stephenw10 @johnpoz
Here is package capture: (LAN is 192.168.1.1, LAN client is 192.168.1.115)
packagecap.txt -
@kiokoman I don't remember I changed that, here is mine:
🔒 Log in to view -
@mmajian said in Netgate SG-3100 LAN ports cannot go through LAN Gateway.:
@stephenw10 @johnpoz
Here is package capture: (LAN is 192.168.1.1, LAN client is 192.168.1.115)
packagecap.txtIf that packet capture is still available for download, download it and attach it.
-
@Derelict
packetcapture.cap
Attached is packet capture file. -
The first problem I see is 192.168.1.115 is asking 192.168.1.1 for DNS and it is not responding.
How is DNS configured on the firewall? Services > DNS Resolver or Services > DNS Forwarder needs to be enabled or the clients need to be configured to use something like google or cloudflare for DNS.
The second problem I see is that whatever device is d0:50:99:d0:00:ed ( D0:50:99 AsrockIn ASRock Incorporation) keeps asking for an ARP WHO HAS 192.168.1.115 when that is its own IP address. Of course nobody's going to answer, and why is it even asking?
I think you can start looking for causes of whatever it is you are seeing off the firewall.
Detach whatever switch is connected and connect to one of the LAN ports. Does it work?
-
@Derelict Thank you.
The DNS Forwarder is disabled. The DNS resolver is below (I don't think I changed this):
🔒 Log in to viewAnd yes the device d0:50:99:d0:00:ed is the Win10 computer connect to LAN1. I will try disconnect all ports except LAN1 and see what will happen.
-
@Derelict @stephenw10 @johnpoz
Very good news. I add a static mapping in DHCP server for Win10 computer and check "Create an ARP Table Static Entry for this MAC & IP Address pair.".
🔒 Log in to viewNow it can ping 192.168.1.1 and solve the immediate problem.
In LAN DHCP server I did check "Enable Static ARP entries"
🔒 Log in to view
Is this means all dynamic DHCP won't have entries in ARP?
Can anyone explain why? Thank you so much.
Jian -
Oh my freaking gawd... So you had set static arps but had no static arps? So yeah no shit pfsense not going to be able to talk to your clients..
Why do people click on shit when they have no clue to what it does??
How exactly did you get to that where you clicked that??? Without actually hitting the gui at first, and then clicking that would of broken your connection.
Going to have to just stop thinking people didn't randomly start clicking shit without a clue.. And just say install clean do not touch a damn thing - does it work.. There you go!!! Just at a loss to how you did not mention that you clicked that - that sure and and the F is not default!! Why would you click on it - it clearly states what it does!!!
Do we have to explain - only the machines listed below will be able to communicate.. Seems pretty clear to me ;)
-
@johnpoz Yeah I was trying to add some static mappings in DHCP several weeks ago so I checked this. But I didn't know it will dis-communicate normal DHCP client.
In my defense, I understand this as - only the machines listed below will be able to communicate when DHCP server is disabled.
And I would change this label as "Only Static ARP Entries"
Thank you. -
That is not something you check to do static dhcp reservations...
Dude - thanks for wasting my time.. And every one else in this thread.. Spending cycles trying to figure out what is wrong is you shot yourself in the freaking foot, and didn't even mention it.. I asked you 9 some hours ago even directly about static arp..
If you don't know what something is, and you can not figure it out from reading the book or the docs - than freaking ask before freaking clicking it.. If it was something that should be checked it would of been checked out of the box ;)
Back in your first post - oh by the way I clicked this this and this that are not default.. Do you think they could of have anything to do with it <rolleyes>
-
I like it when I can say... i told you ...
@kiokoman said in Netgate SG-3100 LAN ports cannot go through LAN Gateway.:
reinstall from scratch, who know what experimentation you did in the last two month to end like this
-
Hmm, unclear if you had static ARP entries in place or if adding them allowed clients to connect.
Either way you should not need statuc ARP entries. I would remove all of them and just go with the default DHCP settings. Test that and make sure it's working as expected.
Steve
-
In 3.5 years here at Netgate plus a long time before that I have never seen a situation that required Static ARP to fix.