Netgear/Vlans/Pfsense
-
No you need an outbound nat so that pfsense will nat 192.168.5 to one of your vpn interfaces.. You only had 192.168.1 in your hybrid natting to yoru vpn interface ips.
Why would you need a rule for lan to wan?? Wan net is not the internet - its just wan net, that is it... Your rule on sending vlan 5 out your vpn would send it out a vpn... But you had no outbound nat to nat 192.168.5 to vpn interface.
-
I added a rule to one of the vpn interfaces that I have outbound
https://ibb.co/4TspV7G
Is this correct?
-
Again those wan outbound hybrids are POINTLESS!!!
And how you sure that outbound nat is gong to use that vpn interface, if your policy routing it out a group... What if it goes out a different vpn interface?
-
So i have the following configuration and I still have no internet connectivity on the pc plugged into port 1 on the netgear switch. The VLAN5 interface is up, I have outbound NAT rules and firewall rules in the VLAN tab. I just dont understand it at the moment????? It should be relatively simple.
on the pc i get a dhcp lease but am unable to ping 192.168.5.1 or google.com
LAN is on 192.168.1.
VLAN is on 192.168.5.here are some more screens of the configuration.
https://ibb.co/0ft99fJ
https://ibb.co/D9W0ZXV
https://ibb.co/wy401MF
https://ibb.co/z7Rv26Z
https://ibb.co/dcXmmCQ
https://ibb.co/8r27zTG
https://ibb.co/vsmjRxW
https://ibb.co/7JGDVS1
https://ibb.co/HTCjhpNI've just read that you cannot send vlan over vpn!
https://forum.netgate.com/topic/148170/specific-vlan-over-vpn-only/5
-
Not sure how that NordVPN stuff works, but I think you need the 192.168.5.0 natting out the VPN gateway instead of the redundant WAN. Why don't you just verify the vlan works out the WAN first. I'll refrain from giving my opinions of 'privacy' vpn providers.
RE: That last link, i'm not sure what JP is on about- you can't carry the vlan tag over a VPN, but you can absolutely have a vlan interface with a unique subnet and route that. My experience however is with site to site tunnels. -
I thought that as well, getting it to work with the WAN first so I added the following mapping...
https://ibb.co/WF4NFYm
still no internet, It has to be something stupid that I'm not configuring properly...
-
@r79c said in Netgear/Vlans/Pfsense:
on the pc i get a dhcp lease but am unable to ping 192.168.5.1
Well then look to the client for why... Can you arp pfsense 192.168.5.1 on the client? You have no rules allowing to ping pfsense.. Its possible everything thing is getting shoved out your policy.. So no you wouldn't be able to ping 192.168.5.1... Create a rule above your policy route rule that allows ping to vlan address
I've just read that you cannot send vlan over vpn!
Your reading that WRONG... That has nothing to do with what your doing, which is routing a specific network/vlan over a vpn connection.
As to getting to the internet - well how and the F do you think its going to go out your vpn which your forcing via your policy route.. But your not natting to it... We already went over this!!!
What I would highly suggest you do is get your vlan 5 working as a normal network before you worry about shoving all its traffic down some vpn connection.
-
@johnpoz What I would highly suggest you do is get your vlan 5 working as a normal network before you worry about shoving all its traffic down some vpn connection.
that's what I'm trying to do
@johnpoz Create a rule above your policy route rule that allows ping to vlan address
By policy route rule you mean a firewall rule in the vlan tab that allows me to ping vlan address?
if i do arp -a 192.168.5.1 i get
Interface: 192.168.5.0 --- 0x7
Internet Address 192.168.5.1
Physical Address MAC
Type Dynamicrules picture
https://ibb.co/cyTRT9s
-
@r79c said in Netgear/Vlans/Pfsense:
I dont get a response with arp 192.168.5.1
Look in your client that is on this vlan 5, look in its arp table.. If you do not see pfsense mac address then NO your never going to be able to ping it.
And would say your not getting dhcp from it either..
I am assuming this is a windows box.
lets see its ipconfig /all
ping 192.168.5.1
look in your arp table
arp -aThis is WRONG
Interface: 192.168.5.0 --- 0x7
Post your ipconfig /all
Your interface sure and the hell should not have a .0 address with a /24 mask.
-
arp -a on the client gives me
Interface: 192.168.5.50 --- 0x7
Internet Address
192.168.1.125
192.168.1.201
192.168.1.202
192.168.5.1 - mac address is that of LAN interface on Pfsense
192.168.5.255
224.0.0.2
224.0.0.251
224.0.0.252
239.255.255.250
255.255.255.255with all the physical address as well
ipconfig /all
Connection : localdomain
description: intel gb network connection
physical: mac
dhcp enabled: yes
auto config: yes
link local ipv6: ...
ipv4 192.168.5.50
subnet mask: 255.255.255.0
default gateway: 192.168.5.1
dhcp server: 192.168.5.1
dhcpv6 iaid: 133459204
dhcpv6 client duid: ...
dns server: 192.168.5.1
netbios over tcip: enabledyes client is a windows box
-
Well is the mac address for 5.1 pfsense mac address. Where were you seeing 5.0? for your interface?
You have something really F'd up
192.168.1.125 192.168.1.201 192.168.1.202
You shouldn't be seeing 192.168.1 address if your in vlan 5!!!
-
@johnpoz yes the mac address for 5.1 is the mac address of the lan interface
5.0 must have been a typo
two of those 192.168.1 address are static IP mappings for devices
192.168.1.125 is the IP address of an access pointall these IP addresses go through port 3 on the netgear switch which is connected to a wireless access point mesh
-
@r79c said in Netgear/Vlans/Pfsense:
two of those 192.168.1 address are static IP mappings for devices
Doesn't matter! So you created those on the device directly with arp? For why? It is pointless, and does nothing - sure and the F not going to work..
I take it basic understanding of how vlans actually work, and what they do is where we need to start..
-
@johnpoz So you created those on the device directly with arp? For why?
I statically mapped those IP addresses using Pfsense with arp yes, why, because those two devices are TV's which I did not want to put the traffic over VPN connection.
@johnpoz I take it basic understanding of how vlans actually work, and what they do is where we need to start..
sure, your the only one responding to this, and I'm grateful because I can't seem to get this working at all!!! I'm starting to wonder why I'm bothering really, as I only wanted to setup up one VLAN with one PC on my home network LoL
-
@r79c said in Netgear/Vlans/Pfsense:
I statically mapped those IP addresses using Pfsense with arp yes,
Dude ON THE CLIENT!!! we need to see the arp table on the CLIENT that is in vlan 5 and connected to port 1 of your switch... Not the arp table of pfsense!!!!
Here
$ arp -a Interface: 192.168.9.100 --- 0xc Internet Address Physical Address Type 192.168.9.10 00-11-32-7b-29-7d dynamic 192.168.9.11 00-11-32-7b-29-7e dynamic 192.168.9.99 70-6e-6d-f3-11-93 dynamic 192.168.9.208 02-11-32-2d-aa-61 dynamic 192.168.9.253 00-08-a2-0c-e6-24 dynamic 192.168.9.255 ff-ff-ff-ff-ff-ff static 224.0.0.22 01-00-5e-00-00-16 static 239.192.0.0 01-00-5e-40-00-00 static 239.255.255.250 01-00-5e-7f-ff-fa static 255.255.255.255 ff-ff-ff-ff-ff-ff static Interface: 192.168.9.101 --- 0x14 Internet Address Physical Address Type 192.168.9.10 00-11-32-7b-29-7d dynamic 192.168.9.11 00-11-32-7b-29-7e dynamic 192.168.9.253 00-08-a2-0c-e6-24 dynamic 192.168.9.255 ff-ff-ff-ff-ff-ff static 224.0.0.22 01-00-5e-00-00-16 static 239.192.0.0 01-00-5e-40-00-00 static 239.255.255.250 01-00-5e-7f-ff-fa static 255.255.255.255 ff-ff-ff-ff-ff-ff static
This is my windows box arp table... Post yours up from the BOX connected to port 1 of your switch! if on that box your seeing 192.168.1 IPs then your setup is BORKED!!!
And post your ipconfig /all
$ ipconfig /all Windows IP Configuration Host Name . . . . . . . . . . . . : i5-win Primary Dns Suffix . . . . . . . : local.lan Node Type . . . . . . . . . . . . : Broadcast IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No DNS Suffix Search List. . . . . . : local.lan Ethernet adapter Local: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Realtek PCIe GbE Family Controller Physical Address. . . . . . . . . : 00-13-3B-2F-67-62 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes IPv4 Address. . . . . . . . . . . : 192.168.9.100(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 192.168.9.253 DNS Servers . . . . . . . . . . . : 192.168.3.10 NetBIOS over Tcpip. . . . . . . . : Enabled
At a loss to where your posting that arp info from - because that sure and the F does not look like how pfsense would present it..... And no matter what you did with static arps on pfsense they would not show in your clients arp table.. You do not have your vlans setup how you think you do if your seeing arp entries from 192.168.1 on your box that is suppose to be in vlan 5
This is switch setup
pfsense - 1U,5T --- switch --- 5U --- vlan 5 clientIf that is how you have it setup, you should NEVER see arp entries for anything other than what is in vlan 5
-
ok here it is, from the client...
C:\WINDOWS\system32>arp -a Interface: 192.68.5.50 --- 0x7 Internet Address Physical Address Type 192.168.1.125 b0-be-76-b7-cf-8c dynamic 192.168.1.201 78-bd-bc-34-d0-f3 dynamic 192.168.1.202 08-84-9d-87-b5-d3 dynamic 192.168.5.1 6d-b3-11-1c-6c-77 dynamic 192.168.5.255 ff-ff-ff-ff-ff-ff static 224.0.0.22 01-00-5e-00-00-16 static 224.0.0.251 01-00-5e-00-00-fb static 224.0.0.252 01-00-5e-00-00-fc static 239.255.255.250 01-00-5e-7f-ff-fa static 255.255.255.255 ff-ff-ff-ff-ff-ff static
BORKED! LOL
-
Yup that is BORKED
You should not be seeing 192.168.1 address if your in vlan 5.. So your switch is clearly not setup correctly. or its not doing what it should be doing.. If you were in vlan 5 it would not be possible for you to get arp answers for anything in 192.168.1
-
@johnpoz said in Netgear/Vlans/Pfsense:
This is switch setup
pfsense - 1U,5T --- switch --- 5U --- vlan 5 clientIf you could look at the following pictures they show the netgear switch setup as it is at the moment.
https://ibb.co/0ft99fJ
https://ibb.co/D9W0ZXV
https://ibb.co/wy401MF
https://ibb.co/z7Rv26ZPfsense is plugged in to port 2
VLAN5 PC Client is plugged in to port 1
Everything else is plugged into port 3
-
that looks correct yes..
But its not working if your seeing mac of devices in 192.168.1..
Clear your arp table... Do they come back? trying pinging one of those 192.168.1 address from your client after you clear your arp.
BTW your rules on vlan 5 are WRONG!!! source would NEVER be pfsense on vlan 5 address.. Source would be vlan 5 net..
What did you set netgears IP too? You said you changed it.
What is the hardware of your pfsense box?
6DB311That doesn't resolve as maker of networking gear..
-
@johnpoz said in Netgear/Vlans/Pfsense:
Clear your arp table
cleared and not returned
cannot ping any 192.168.1 or 192.168.5
i have the following arp entries now
192.168.5.1
192.168.5.255
224.0.0.22
224.0.0.251
224.0.0.252
239.255.255.250
255.255.255.255 -
Ok that is better!
So simple test is sniff on pfsense vlan interface while you ping it from the client.. Do you see the ping?
BTW what hardware is the nic on pfsense? that mac doesn't resolve to anyone..
-
@johnpoz said in Netgear/Vlans/Pfsense:
Do you see the ping?
16:37:10.374829 IP 192.168.5.50 > 192.168.5.1: ICMP echo request, id 1, seq 36, length 40 16:37:15.321366 IP 192.168.5.50 > 192.168.5.1: ICMP echo request, id 1, seq 37, length 40 16:37:20.337599 IP 192.168.5.50 > 192.168.5.1: ICMP echo request, id 1, seq 38, length 40 16:37:25.318515 IP 192.168.5.50 > 192.168.5.1: ICMP echo request, id 1, seq 39, length 40 16:37:26.442815 IP 192.168.5.50.53865 > 239.255.255.250.1900: UDP, length 174 16:37:27.009842 IP 192.168.5.50.60396 > 192.168.5.1.53: UDP, length 46 16:37:27.463007 IP 192.168.5.50.53865 > 239.255.255.250.1900: UDP, length 174 16:37:28.011221 IP 192.168.5.50.60396 > 192.168.5.1.53: UDP, length 46 16:37:28.465757 IP 192.168.5.50.53865 > 239.255.255.250.1900: UDP, length 174 16:37:29.013961 IP 192.168.5.50.60396 > 192.168.5.1.53: UDP, length 46 16:37:29.468473 IP 192.168.5.50.53865 > 239.255.255.250.1900: UDP, length 174 16:37:31.022413 IP 192.168.5.50.60396 > 192.168.5.1.53: UDP, length 46 16:37:32.811702 ARP, Request who-has 192.168.5.1 (6c:b3:11:1c:6c:77) tell 192.168.5.50, length 46 16:37:32.811707 ARP, Reply 192.168.5.1 is-at 6c:b3:11:1c:6c:77, length 28 16:37:35.033636 IP 192.168.5.50.60396 > 192.168.5.1.53: UDP, length 46
-
@r79c said in Netgear/Vlans/Pfsense:
16:37:10.374829 IP 192.168.5.50 > 192.168.5.1: ICMP echo request, id 1, seq 36, length 40
16:37:15.321366 IP 192.168.5.50 > 192.168.5.1: ICMP echo request, id 1, seq 37, length 40Yup... So lets see your rules on on vlan 5 again... And do you have any rules in floating?
-
https://ibb.co/rs4tG8r
https://ibb.co/zVDwqW4
-
So your blocking it with pfblocker... Disable those rules on floating as test!
That firehol list contains rfc1918 address space!!
-
Ok I disabled those rules and disabled pfblocker for the time being.
I set those rules up when I set up pfblocker but I was never 100% competent on how it is setup, I only set it up about two weeks ago....
-
And - are you pinging?
-
-
Well your firewall rule that allows all of IPv4 show hits... And your seeing the traffic actually hit pfsense vlan interface... You were sniffing on the vlan interface right!! not lan..
So lets see your routing table..
Unless you where not sniffing on vlan 5 interface it makes no sense to be honest..
Is pfsense a VM? Or this is a physical box... What is the nic of this box? Why does the mac of the 5.1 not show as known company?
-
@johnpoz said in Netgear/Vlans/Pfsense:
You were sniffing on the vlan interface right!!
yes
routing table
Destination Gateway Flags Use Mtu Netif Expire 0.0.0.0/1 10.8.2.1 UGS 2057 1500 ovpnc3 default 192.168.10.1 UGS 112 1500 igb0 10.8.2.0/24 10.8.2.1 UGS 0 1500 ovpnc3 10.8.2.1 link#10 UH 7060 1500 ovpnc3 10.8.2.19 link#10 UHS 0 16384 lo0 10.8.3.1 link#8 UH 7074 1500 ovpnc1 10.8.3.10 link#8 UHS 0 16384 lo0 10.8.8.0/24 10.8.8.1 UGS 0 1500 ovpnc2 10.8.8.1 link#9 UH 7078 1500 ovpnc2 10.8.8.4 link#9 UHS 0 16384 lo0 127.0.0.1 link#4 UH 1350047 16384 lo0 128.0.0.0/1 10.8.2.1 UGS 57242 1500 ovpnc3 192.168.1.0/24 link#2 U 815693 1500 igb1 192.168.1.1 link#2 UHS 0 16384 lo0 192.168.5.0/24 link#7 U 1927 1500 igb1.5 192.168.5.1 link#7 UHS 0 16384 lo0 192.168.10.0/24 link#1 U 0 1500 igb0 192.168.10.1 6c:b3:11:1c:6c:76 UHS 53316 1500 igb0 192.168.10.3 link#1 UHS 0 16384 lo0 217.146.82.191/32 192.168.10.1 UGS 24899 1500 igb0
-
Well that looks correct.. you have 192.168.5 and using the interface..
And it was seeing traffic - your not running any sort of IPS are you?
Can you post output of
cat /tmp/rules.debug
-
-
Dude!!!! you need to give this info.... Disable it!!! What do its logs say..
-
@johnpoz said in Netgear/Vlans/Pfsense:
So maybe its just an issue with this nic and vlans
perhaps the card that I bought off Amazon does not support VLAN's, although I presumed it did. Also I saw that pfsense only shows interfaces that VLAN's can be created on so if the card didn't support VLAN's it should not show in the pfsense drop down.
igb0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500 options=6400bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,VLAN_HWTSO,RXCSUM_IPV6,TXCSUM_IPV6> ether 6c:b3:11:1c:6c:76 hwaddr 6c:b3:11:1c:6c:76 inet6 fe80::6eb3:11ff:fe1c:6c76%igb0 prefixlen 64 scopeid 0x1 inet6 fdc0:13c1:78f1:0:6eb3:11ff:fe1c:6c76 prefixlen 64 autoconf inet 192.168.10.3 netmask 0xffffff00 broadcast 192.168.10.255 nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL> media: Ethernet autoselect (1000baseT <full-duplex>) status: active igb1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500 options=6500bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,VLAN_HWFILTER,VLAN_HWTSO,RXCSUM_IPV6,TXCSUM_IPV6> ether 6c:b3:11:1c:6c:77 hwaddr 6c:b3:11:1c:6c:77 inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255 inet6 fe80::1:1%igb1 prefixlen 64 scopeid 0x2 nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> media: Ethernet autoselect (1000baseT <full-duplex>) status: active enc0: flags=0<> metric 0 mtu 1536 nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> groups: enc lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384 options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6> inet6 ::1 prefixlen 128 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x4 inet 127.0.0.1 netmask 0xff000000 nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> groups: lo pflog0: flags=100<PROMISC> metric 0 mtu 33160 groups: pflog pfsync0: flags=0<> metric 0 mtu 1500 groups: pfsync syncpeer: 224.0.0.240 maxupd: 128 defer: on syncok: 1 igb1.5: flags=88843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,STATICARP> metric 0 mtu 1500 options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6> ether 6c:b3:11:1c:6c:77 inet6 fe80::6eb3:11ff:fe1c:6c77%igb1.5 prefixlen 64 scopeid 0x7 inet 192.168.5.1 netmask 0xffffff00 broadcast 192.168.5.255 nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL> media: Ethernet autoselect (1000baseT <full-duplex>) status: active vlan: 5 vlanpcp: 0 parent interface: igb1 groups: vlan ovpnc1: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1500 options=80000<LINKSTATE> inet6 fe80::6eb3:11ff:fe1c:6c76%ovpnc1 prefixlen 64 scopeid 0x8 inet 10.8.3.10 --> 10.8.3.1 netmask 0xffffff00 nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> groups: tun openvpn Opened by PID 7054 ovpnc2: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1500 options=80000<LINKSTATE> inet6 fe80::6eb3:11ff:fe1c:6c76%ovpnc2 prefixlen 64 scopeid 0x9 inet 10.8.8.4 --> 10.8.8.1 netmask 0xffffff00 nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> groups: tun openvpn Opened by PID 82209 ovpnc3: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1500 options=80000<LINKSTATE> inet6 fe80::6eb3:11ff:fe1c:6c76%ovpnc3 prefixlen 64 scopeid 0xa inet 10.8.2.19 --> 10.8.2.1 netmask 0xffffff00 nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> groups: tun openvpn Opened by PID 33738
-
You've made a lot of changes, I suggest you reboot the firewall to make sure the pfb/snort is off.
-
Well I am out of ideas to be honest... You say your sniffing on your vlan, and seeing the ping request.. Your rule you posted shows your allowing it... And your showing hits..
So makes no sense..
But your running IPS, and you had pfblocker with rules that would block rfc1918 space, etc..
Your nic is some no name???, never heard off - and its mac address does not even lookup... So maybe its just an issue with this nic and vlans... Lets see a ifconfig output from pfsense. I want to see what is showing for options on your igb1...
example - here is an interface I am running vlans on.
igb2: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500 options=6500bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,VLAN_HWFILTER,VLAN_HWTSO,RXCSUM_IPV6,TXCSUM_IPV6> ether 00:08:a2:0c:e6:20 hwaddr 00:08:a2:0c:e6:20 inet6 fe80::208:a2ff:fe0c:e620%igb2 prefixlen 64 scopeid 0x3 inet 192.168.2.253 netmask 0xffffff00 broadcast 192.168.2.255 nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> media: Ethernet autoselect (1000baseT <full-duplex>) status: active igb2.4: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500 options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6> ether 00:08:a2:0c:e6:20 inet6 fe80::208:a2ff:fe0c:e620%igb2.4 prefixlen 64 scopeid 0xb inet 192.168.4.253 netmask 0xffffff00 broadcast 192.168.4.255 nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> media: Ethernet autoselect (1000baseT <full-duplex>) status: active vlan: 4 vlanpcp: 0 parent interface: igb2 groups: vlan igb2.6: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500 options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6> ether 00:08:a2:0c:e6:20 inet6 fe80::208:a2ff:fe0c:e620%igb2.6 prefixlen 64 scopeid 0xc inet 192.168.6.253 netmask 0xffffff00 broadcast 192.168.6.255 nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> media: Ethernet autoselect (1000baseT <full-duplex>) status: active vlan: 6 vlanpcp: 0 parent interface: igb2 groups: vlan
Only other thing would be to run tcpdump on pfsense with -e flag so you can see the tagging is happening or not happening... Maybe its answering without the tag???? So your sniff on vlan wouldn't show it - that is guess..
But sure a reload of your rules, or reboot couldn't hurt.
From pfsense - sniff on your vlan 5, and try to ping your client 192.168.5.50..
-
@johnpoz said in Netgear/Vlans/Pfsense:
So maybe its just an issue with this nic and vlans
Perhaps it is, I presumed the card that I purchased off amazon supported vlan's and the pfsense drop down showed the card as an interface that could create vlans on...
igb0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500 options=6400bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,VLAN_HWTSO,RXCSUM_IPV6,TXCSUM_IPV6> ether 6c:b3:11:1c:6c:76 hwaddr 6c:b3:11:1c:6c:76 inet6 fe80::6eb3:11ff:fe1c:6c76%igb0 prefixlen 64 scopeid 0x1 inet6 fdc0:13c1:78f1:0:6eb3:11ff:fe1c:6c76 prefixlen 64 autoconf inet 192.168.10.3 netmask 0xffffff00 broadcast 192.168.10.255 nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL> media: Ethernet autoselect (1000baseT <full-duplex>) status: active igb1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500 options=6500bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,VLAN_HWFILTER,VLAN_HWTSO,RXCSUM_IPV6,TXCSUM_IPV6> ether 6c:b3:11:1c:6c:77 hwaddr 6c:b3:11:1c:6c:77 inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255 inet6 fe80::1:1%igb1 prefixlen 64 scopeid 0x2 nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> media: Ethernet autoselect (1000baseT <full-duplex>) status: active enc0: flags=0<> metric 0 mtu 1536 nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> groups: enc lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384 options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6> inet6 ::1 prefixlen 128 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x4 inet 127.0.0.1 netmask 0xff000000 nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> groups: lo pflog0: flags=100<PROMISC> metric 0 mtu 33160 groups: pflog pfsync0: flags=0<> metric 0 mtu 1500 groups: pfsync syncpeer: 224.0.0.240 maxupd: 128 defer: on syncok: 1 igb1.5: flags=88843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,STATICARP> metric 0 mtu 1500 options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6> ether 6c:b3:11:1c:6c:77 inet6 fe80::6eb3:11ff:fe1c:6c77%igb1.5 prefixlen 64 scopeid 0x7 inet 192.168.5.1 netmask 0xffffff00 broadcast 192.168.5.255 nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL> media: Ethernet autoselect (1000baseT <full-duplex>) status: active vlan: 5 vlanpcp: 0 parent interface: igb1 groups: vlan ovpnc1: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1500 options=80000<LINKSTATE> inet6 fe80::6eb3:11ff:fe1c:6c76%ovpnc1 prefixlen 64 scopeid 0x8 inet 10.8.3.10 --> 10.8.3.1 netmask 0xffffff00 nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> groups: tun openvpn Opened by PID 7054 ovpnc2: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1500 options=80000<LINKSTATE> inet6 fe80::6eb3:11ff:fe1c:6c76%ovpnc2 prefixlen 64 scopeid 0x9 inet 10.8.8.4 --> 10.8.8.1 netmask 0xffffff00 nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> groups: tun openvpn Opened by PID 82209 ovpnc3: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1500 options=80000<LINKSTATE> inet6 fe80::6eb3:11ff:fe1c:6c76%ovpnc3 prefixlen 64 scopeid 0xa inet 10.8.2.19 --> 10.8.2.1 netmask 0xffffff00 nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> groups: tun openvpn Opened by PID 33738
just to recap the NAT automatic rules have added 192.168.1.0/24 and 192.168.5.0/24
can I just be sure that I'm not missing a specific mapping that needs to be added???? like you have said before would the automatic rule be enough???
-
Your nat rules have zero to do with pinging 192.168.5.1..
Who makes this card exactly??? 6c:b3:11 does not show up as vendor .. ipolex?
It really makes no sense at this point... Have you rebooted? And you disabled snort and pfblocker... What is looks like from your sniff is firewall not allowing the traffic..
edit: Why do you have this on your vlan interface??
STATICARP
Do you have this enabled???
OMG dude - did you just click every possible thing there is to click without clue one to what any of it does??? Why would you click that???
-
@johnpoz said in Netgear/Vlans/Pfsense:
Who makes this card exactly??? 6c:b3:11 does not show up as vendor .. ipolex?
Not sure how accurate this information is but a Google search shows that his NIC is made by the following company in China. Never heard of them. Maybe this NIC is not compatible FreeBSD 11.x?
Company
Shenzhen Lianrui Electronics Co.,Ltd
Address
Block C4 XinTang Industrial Park
Baishixia FuYong Town BaoAn District
Shenzhen Guangdong 518000
CHINA
Range
6C:B3:11:00:00:00 - 6C:B3:11:FF:FF:FF
Type
IEEE MA-L