Netgear/Vlans/Pfsense

r79c

arp -a on the client gives me

Interface: 192.168.5.50 --- 0x7

Internet Address
192.168.1.125
192.168.1.201
192.168.1.202
192.168.5.1 - mac address is that of LAN interface on Pfsense
192.168.5.255
224.0.0.2
224.0.0.251
224.0.0.252
239.255.255.250
255.255.255.255

with all the physical address as well

ipconfig /all

Connection : localdomain
description: intel gb network connection
physical: mac
dhcp enabled: yes
auto config: yes
link local ipv6: ...
ipv4 192.168.5.50
subnet mask: 255.255.255.0
default gateway: 192.168.5.1
dhcp server: 192.168.5.1
dhcpv6 iaid: 133459204
dhcpv6 client duid: ...
dns server: 192.168.5.1
netbios over tcip: enabled

yes client is a windows box

johnpoz

Well is the mac address for 5.1 pfsense mac address. Where were you seeing 5.0? for your interface?

You have something really F'd up

192.168.1.125
192.168.1.201
192.168.1.202

You shouldn't be seeing 192.168.1 address if your in vlan 5!!!

r79c

@johnpoz yes the mac address for 5.1 is the mac address of the lan interface

5.0 must have been a typo

two of those 192.168.1 address are static IP mappings for devices
192.168.1.125 is the IP address of an access point

all these IP addresses go through port 3 on the netgear switch which is connected to a wireless access point mesh

johnpoz

@r79c said in Netgear/Vlans/Pfsense:

two of those 192.168.1 address are static IP mappings for devices

Doesn't matter! So you created those on the device directly with arp? For why? It is pointless, and does nothing - sure and the F not going to work..

I take it basic understanding of how vlans actually work, and what they do is where we need to start..

r79c

@johnpoz So you created those on the device directly with arp? For why?

I statically mapped those IP addresses using Pfsense with arp yes, why, because those two devices are TV's which I did not want to put the traffic over VPN connection.

@johnpoz I take it basic understanding of how vlans actually work, and what they do is where we need to start..

sure, your the only one responding to this, and I'm grateful because I can't seem to get this working at all!!! I'm starting to wonder why I'm bothering really, as I only wanted to setup up one VLAN with one PC on my home network LoL

johnpoz

@r79c said in Netgear/Vlans/Pfsense:

I statically mapped those IP addresses using Pfsense with arp yes,

Dude ON THE CLIENT!!! we need to see the arp table on the CLIENT that is in vlan 5 and connected to port 1 of your switch... Not the arp table of pfsense!!!!

Here

$ arp -a                                                      
                                                              
Interface: 192.168.9.100 --- 0xc                              
  Internet Address      Physical Address      Type            
  192.168.9.10          00-11-32-7b-29-7d     dynamic         
  192.168.9.11          00-11-32-7b-29-7e     dynamic         
  192.168.9.99          70-6e-6d-f3-11-93     dynamic         
  192.168.9.208         02-11-32-2d-aa-61     dynamic         
  192.168.9.253         00-08-a2-0c-e6-24     dynamic         
  192.168.9.255         ff-ff-ff-ff-ff-ff     static          
  224.0.0.22            01-00-5e-00-00-16     static          
  239.192.0.0           01-00-5e-40-00-00     static          
  239.255.255.250       01-00-5e-7f-ff-fa     static          
  255.255.255.255       ff-ff-ff-ff-ff-ff     static          
                                                              
Interface: 192.168.9.101 --- 0x14                             
  Internet Address      Physical Address      Type            
  192.168.9.10          00-11-32-7b-29-7d     dynamic         
  192.168.9.11          00-11-32-7b-29-7e     dynamic         
  192.168.9.253         00-08-a2-0c-e6-24     dynamic         
  192.168.9.255         ff-ff-ff-ff-ff-ff     static          
  224.0.0.22            01-00-5e-00-00-16     static          
  239.192.0.0           01-00-5e-40-00-00     static          
  239.255.255.250       01-00-5e-7f-ff-fa     static          
  255.255.255.255       ff-ff-ff-ff-ff-ff     static

This is my windows box arp table... Post yours up from the BOX connected to port 1 of your switch! if on that box your seeing 192.168.1 IPs then your setup is BORKED!!!

And post your ipconfig /all

$ ipconfig /all                                                                     
                                                                                    
Windows IP Configuration                                                            
                                                                                    
   Host Name . . . . . . . . . . . . : i5-win                                       
   Primary Dns Suffix  . . . . . . . : local.lan                                    
   Node Type . . . . . . . . . . . . : Broadcast                                    
   IP Routing Enabled. . . . . . . . : No                                           
   WINS Proxy Enabled. . . . . . . . : No                                           
   DNS Suffix Search List. . . . . . : local.lan                                    
                                                                                    
Ethernet adapter Local:                                                             
                                                                                    
   Connection-specific DNS Suffix  . :                                              
   Description . . . . . . . . . . . : Realtek PCIe GbE Family Controller           
   Physical Address. . . . . . . . . : 00-13-3B-2F-67-62                            
   DHCP Enabled. . . . . . . . . . . : No                                           
   Autoconfiguration Enabled . . . . : Yes                                          
   IPv4 Address. . . . . . . . . . . : 192.168.9.100(Preferred)                     
   Subnet Mask . . . . . . . . . . . : 255.255.255.0                                
   Default Gateway . . . . . . . . . : 192.168.9.253                                
   DNS Servers . . . . . . . . . . . : 192.168.3.10                                 
   NetBIOS over Tcpip. . . . . . . . : Enabled

At a loss to where your posting that arp info from - because that sure and the F does not look like how pfsense would present it..... And no matter what you did with static arps on pfsense they would not show in your clients arp table.. You do not have your vlans setup how you think you do if your seeing arp entries from 192.168.1 on your box that is suppose to be in vlan 5

This is switch setup
pfsense - 1U,5T --- switch --- 5U --- vlan 5 client

If that is how you have it setup, you should NEVER see arp entries for anything other than what is in vlan 5

r79c

ok here it is, from the client...

C:\WINDOWS\system32>arp -a

Interface: 192.68.5.50 --- 0x7
   Internet Address                       Physical Address                  Type
   192.168.1.125                          b0-be-76-b7-cf-8c                  dynamic
   192.168.1.201                          78-bd-bc-34-d0-f3                  dynamic
   192.168.1.202                          08-84-9d-87-b5-d3                 dynamic
   192.168.5.1                              6d-b3-11-1c-6c-77                  dynamic
   192.168.5.255                          ff-ff-ff-ff-ff-ff                                static
   224.0.0.22                                 01-00-5e-00-00-16                 static
   224.0.0.251                               01-00-5e-00-00-fb                  static
   224.0.0.252                               01-00-5e-00-00-fc                  static
   239.255.255.250                      01-00-5e-7f-ff-fa                      static
   255.255.255.255                      ff-ff-ff-ff-ff-ff                                static

BORKED! LOL

johnpoz

Yup that is BORKED

You should not be seeing 192.168.1 address if your in vlan 5.. So your switch is clearly not setup correctly. or its not doing what it should be doing.. If you were in vlan 5 it would not be possible for you to get arp answers for anything in 192.168.1

r79c

@johnpoz said in Netgear/Vlans/Pfsense:

This is switch setup
pfsense - 1U,5T --- switch --- 5U --- vlan 5 client

If you could look at the following pictures they show the netgear switch setup as it is at the moment.

https://ibb.co/0ft99fJ
https://ibb.co/D9W0ZXV
https://ibb.co/wy401MF
https://ibb.co/z7Rv26Z

Pfsense is plugged in to port 2

VLAN5 PC Client is plugged in to port 1

Everything else is plugged into port 3

johnpoz

that looks correct yes..

But its not working if your seeing mac of devices in 192.168.1..

Clear your arp table... Do they come back? trying pinging one of those 192.168.1 address from your client after you clear your arp.

BTW your rules on vlan 5 are WRONG!!! source would NEVER be pfsense on vlan 5 address.. Source would be vlan 5 net..

What did you set netgears IP too? You said you changed it.

What is the hardware of your pfsense box?
6DB311

That doesn't resolve as maker of networking gear..

r79c

@johnpoz said in Netgear/Vlans/Pfsense:

Clear your arp table

cleared and not returned

cannot ping any 192.168.1 or 192.168.5

i have the following arp entries now

192.168.5.1
192.168.5.255
224.0.0.22
224.0.0.251
224.0.0.252
239.255.255.250
255.255.255.255

johnpoz

Ok that is better!

So simple test is sniff on pfsense vlan interface while you ping it from the client.. Do you see the ping?

BTW what hardware is the nic on pfsense? that mac doesn't resolve to anyone..

r79c

@johnpoz said in Netgear/Vlans/Pfsense:

Do you see the ping?

16:37:10.374829 IP 192.168.5.50 > 192.168.5.1: ICMP echo request, id 1, seq 36, length 40
16:37:15.321366 IP 192.168.5.50 > 192.168.5.1: ICMP echo request, id 1, seq 37, length 40
16:37:20.337599 IP 192.168.5.50 > 192.168.5.1: ICMP echo request, id 1, seq 38, length 40
16:37:25.318515 IP 192.168.5.50 > 192.168.5.1: ICMP echo request, id 1, seq 39, length 40
16:37:26.442815 IP 192.168.5.50.53865 > 239.255.255.250.1900: UDP, length 174
16:37:27.009842 IP 192.168.5.50.60396 > 192.168.5.1.53: UDP, length 46
16:37:27.463007 IP 192.168.5.50.53865 > 239.255.255.250.1900: UDP, length 174
16:37:28.011221 IP 192.168.5.50.60396 > 192.168.5.1.53: UDP, length 46
16:37:28.465757 IP 192.168.5.50.53865 > 239.255.255.250.1900: UDP, length 174
16:37:29.013961 IP 192.168.5.50.60396 > 192.168.5.1.53: UDP, length 46
16:37:29.468473 IP 192.168.5.50.53865 > 239.255.255.250.1900: UDP, length 174
16:37:31.022413 IP 192.168.5.50.60396 > 192.168.5.1.53: UDP, length 46
16:37:32.811702 ARP, Request who-has 192.168.5.1 (6c:b3:11:1c:6c:77) tell 192.168.5.50, length 46
16:37:32.811707 ARP, Reply 192.168.5.1 is-at 6c:b3:11:1c:6c:77, length 28
16:37:35.033636 IP 192.168.5.50.60396 > 192.168.5.1.53: UDP, length 46

johnpoz

@r79c said in Netgear/Vlans/Pfsense:

16:37:10.374829 IP 192.168.5.50 > 192.168.5.1: ICMP echo request, id 1, seq 36, length 40
16:37:15.321366 IP 192.168.5.50 > 192.168.5.1: ICMP echo request, id 1, seq 37, length 40

Yup... So lets see your rules on on vlan 5 again... And do you have any rules in floating?

r79c

https://ibb.co/rs4tG8r

https://ibb.co/zVDwqW4

johnpoz

So your blocking it with pfblocker... Disable those rules on floating as test!

That firehol list contains rfc1918 address space!!

r79c

Ok I disabled those rules and disabled pfblocker for the time being.

I set those rules up when I set up pfblocker but I was never 100% competent on how it is setup, I only set it up about two weeks ago....

johnpoz

And - are you pinging?

r79c

@johnpoz said in Netgear/Vlans/Pfsense:

And - are you pinging?

no

johnpoz

Well your firewall rule that allows all of IPv4 show hits... And your seeing the traffic actually hit pfsense vlan interface... You were sniffing on the vlan interface right!! not lan..

So lets see your routing table..

Unless you where not sniffing on vlan 5 interface it makes no sense to be honest..

Is pfsense a VM? Or this is a physical box... What is the nic of this box? Why does the mac of the 5.1 not show as known company?