One WAN. Two LAN's.

epretorious

Hello, All:

OVERVIEW
I'm using 2.4.4-RELEASE-p3 (amd64) on my home gateway system. The gateway has 5 network ports:

One functions as the External Interface (WAN): em4.
This interface is configured via my ISP's DHCP.
Two of the other ports function as the Internal Interfaces (LAN &OPT1): em0 & em1.

One services my Household Network (LAN:192.168.1.1/24).

The other services my Lab Network (OPT1:172.16.0.1/24).

PROBLEM STATEMENT
I'm able to go from the Household Network to the Lab Network. But I'm not able to go from the Lab Network to the Household Network or to the Internet.

CURRENT STATE
The Household Network (LAN:192.168.1.1/24) works correctly:

DHCP works correctly (192.168.1.1/24).
DNS works correctly (192.168.1.1).
I'm able to reach the hosts and services across on Internet (WAN).
I'm able to reach hosts and services on the Lab Network (OPT1:172.16.0.1/24).
When I sign-in to any of the systems in the Lab:

The source address shown by the /usr/bin/netstat command is the IP address of my computer (192.168.1.101).

The /usr/bin/w & /usr/bin/who commands both display the IP address of my computer (192.168.1.101).

But the Lab Network only works partially:

DHCP works correctly (172.16.0.1/24).
DNS does not seem to work (172.16.0.1).
I'm not able to reach the DNS service of the gateway (192.168.1.1).
I'm not able to reach any hosts or services on the Household Network (192.168.1.1/24).
I'm not able to reach any hosts on the Internet (WAN).

DESIRED STATE
I'd like to be able to go from either of the Internal Interfaces (LAN &OPT1)...

to the other Internal Interface
to the Internet

Is there and important configuration step that I've missed?

viragomann

@epretorious said in One WAN. Two LAN's.:

Is there and important configuration step that I've missed?

Fireall rules which allow the desired acceess?

By default pfSense has an allow any to any rule on LAN, so from LAN network it allows access to any destionations.
But if you add additional interfaces you have to add firewall rules to it by yourself to allow traffic coming in that interface.

johnpoz

@viragomann said in One WAN. Two LAN's.:

you have to add firewall rules

This ;) dhcp will work because when you enable dhcp on an interface pfsense auto adds hidden rules for dhcp to work. But nothing else would be allowed..

epretorious

Thank you, both, for your insight!

I've used the "Default allow LAN to any rule" as a template and created a similar rule for Internal Interface that services the Lab Network (OPT1: 172.16.0.1/24) and that seems to have solved my problem!

johnpoz

Yeah that will allow you to route, but not do any sort of firewall between your networks - is that something you looking to doing?

epretorious

@johnpoz said in One WAN. Two LAN's.:

Yeah that will allow you to route, but not do any sort of firewall between your networks - is that something you looking to doing?

I'm not too worried about separating the two. But maybe I should be...

johnpoz

If your not worried about them talking to each other, since you have any any rules - what is the point of multiple segments in the first place? ;)