Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Netgear/Vlans/Pfsense

    Scheduled Pinned Locked Moved L2/Switching/VLANs
    58 Posts 4 Posters 10.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      r79c
      last edited by r79c

      ok here it is, from the client...

      C:\WINDOWS\system32>arp -a
      
      Interface: 192.68.5.50 --- 0x7
         Internet Address                       Physical Address                  Type
         192.168.1.125                          b0-be-76-b7-cf-8c                  dynamic
         192.168.1.201                          78-bd-bc-34-d0-f3                  dynamic
         192.168.1.202                          08-84-9d-87-b5-d3                 dynamic
         192.168.5.1                              6d-b3-11-1c-6c-77                  dynamic
         192.168.5.255                          ff-ff-ff-ff-ff-ff                                static
         224.0.0.22                                 01-00-5e-00-00-16                 static
         224.0.0.251                               01-00-5e-00-00-fb                  static
         224.0.0.252                               01-00-5e-00-00-fc                  static
         239.255.255.250                      01-00-5e-7f-ff-fa                      static
         255.255.255.255                      ff-ff-ff-ff-ff-ff                                static
      

      BORKED! LOL

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by johnpoz

        Yup that is BORKED

        You should not be seeing 192.168.1 address if your in vlan 5.. So your switch is clearly not setup correctly. or its not doing what it should be doing.. If you were in vlan 5 it would not be possible for you to get arp answers for anything in 192.168.1

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • R
          r79c @johnpoz
          last edited by

          @johnpoz said in Netgear/Vlans/Pfsense:

          This is switch setup
          pfsense - 1U,5T --- switch --- 5U --- vlan 5 client

          If you could look at the following pictures they show the netgear switch setup as it is at the moment.

          https://ibb.co/0ft99fJ
          https://ibb.co/D9W0ZXV
          https://ibb.co/wy401MF
          https://ibb.co/z7Rv26Z

          Pfsense is plugged in to port 2

          VLAN5 PC Client is plugged in to port 1

          Everything else is plugged into port 3

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by johnpoz

            that looks correct yes..

            But its not working if your seeing mac of devices in 192.168.1..

            Clear your arp table... Do they come back? trying pinging one of those 192.168.1 address from your client after you clear your arp.

            BTW your rules on vlan 5 are WRONG!!! source would NEVER be pfsense on vlan 5 address.. Source would be vlan 5 net..

            What did you set netgears IP too? You said you changed it.

            What is the hardware of your pfsense box?
            6DB311

            That doesn't resolve as maker of networking gear..

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            R 1 Reply Last reply Reply Quote 0
            • R
              r79c @johnpoz
              last edited by

              @johnpoz said in Netgear/Vlans/Pfsense:

              Clear your arp table

              cleared and not returned

              cannot ping any 192.168.1 or 192.168.5

              i have the following arp entries now

              192.168.5.1
              192.168.5.255
              224.0.0.22
              224.0.0.251
              224.0.0.252
              239.255.255.250
              255.255.255.255

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by johnpoz

                Ok that is better!

                So simple test is sniff on pfsense vlan interface while you ping it from the client.. Do you see the ping?

                BTW what hardware is the nic on pfsense? that mac doesn't resolve to anyone..

                ping.jpg

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                R 1 Reply Last reply Reply Quote 0
                • R
                  r79c @johnpoz
                  last edited by

                  @johnpoz said in Netgear/Vlans/Pfsense:

                  Do you see the ping?

                  16:37:10.374829 IP 192.168.5.50 > 192.168.5.1: ICMP echo request, id 1, seq 36, length 40
                  16:37:15.321366 IP 192.168.5.50 > 192.168.5.1: ICMP echo request, id 1, seq 37, length 40
                  16:37:20.337599 IP 192.168.5.50 > 192.168.5.1: ICMP echo request, id 1, seq 38, length 40
                  16:37:25.318515 IP 192.168.5.50 > 192.168.5.1: ICMP echo request, id 1, seq 39, length 40
                  16:37:26.442815 IP 192.168.5.50.53865 > 239.255.255.250.1900: UDP, length 174
                  16:37:27.009842 IP 192.168.5.50.60396 > 192.168.5.1.53: UDP, length 46
                  16:37:27.463007 IP 192.168.5.50.53865 > 239.255.255.250.1900: UDP, length 174
                  16:37:28.011221 IP 192.168.5.50.60396 > 192.168.5.1.53: UDP, length 46
                  16:37:28.465757 IP 192.168.5.50.53865 > 239.255.255.250.1900: UDP, length 174
                  16:37:29.013961 IP 192.168.5.50.60396 > 192.168.5.1.53: UDP, length 46
                  16:37:29.468473 IP 192.168.5.50.53865 > 239.255.255.250.1900: UDP, length 174
                  16:37:31.022413 IP 192.168.5.50.60396 > 192.168.5.1.53: UDP, length 46
                  16:37:32.811702 ARP, Request who-has 192.168.5.1 (6c:b3:11:1c:6c:77) tell 192.168.5.50, length 46
                  16:37:32.811707 ARP, Reply 192.168.5.1 is-at 6c:b3:11:1c:6c:77, length 28
                  16:37:35.033636 IP 192.168.5.50.60396 > 192.168.5.1.53: UDP, length 46
                  
                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    @r79c said in Netgear/Vlans/Pfsense:

                    16:37:10.374829 IP 192.168.5.50 > 192.168.5.1: ICMP echo request, id 1, seq 36, length 40
                    16:37:15.321366 IP 192.168.5.50 > 192.168.5.1: ICMP echo request, id 1, seq 37, length 40

                    Yup... So lets see your rules on on vlan 5 again... And do you have any rules in floating?

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    R 1 Reply Last reply Reply Quote 0
                    • R
                      r79c @johnpoz
                      last edited by

                      https://ibb.co/rs4tG8r

                      https://ibb.co/zVDwqW4

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by johnpoz

                        So your blocking it with pfblocker... Disable those rules on floating as test!

                        That firehol list contains rfc1918 address space!!

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        R 1 Reply Last reply Reply Quote 0
                        • R
                          r79c @johnpoz
                          last edited by

                          Ok I disabled those rules and disabled pfblocker for the time being.

                          I set those rules up when I set up pfblocker but I was never 100% competent on how it is setup, I only set it up about two weeks ago....

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by

                            And - are you pinging?

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            R 1 Reply Last reply Reply Quote 0
                            • R
                              r79c @johnpoz
                              last edited by

                              @johnpoz said in Netgear/Vlans/Pfsense:

                              And - are you pinging?

                              no

                              1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator
                                last edited by johnpoz

                                Well your firewall rule that allows all of IPv4 show hits... And your seeing the traffic actually hit pfsense vlan interface... You were sniffing on the vlan interface right!! not lan..

                                So lets see your routing table..

                                Unless you where not sniffing on vlan 5 interface it makes no sense to be honest..

                                Is pfsense a VM? Or this is a physical box... What is the nic of this box? Why does the mac of the 5.1 not show as known company?

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                R 1 Reply Last reply Reply Quote 0
                                • R
                                  r79c @johnpoz
                                  last edited by

                                  @johnpoz said in Netgear/Vlans/Pfsense:

                                  You were sniffing on the vlan interface right!!

                                  yes

                                  routing table

                                  Destination	Gateway	Flags	Use	Mtu	Netif	Expire
                                  0.0.0.0/1	10.8.2.1	UGS	2057	1500	ovpnc3	
                                  default	192.168.10.1	UGS	112	1500	igb0	
                                  10.8.2.0/24	10.8.2.1	UGS	0	1500	ovpnc3	
                                  10.8.2.1	link#10	UH	7060	1500	ovpnc3	
                                  10.8.2.19	link#10	UHS	0	16384	lo0	
                                  10.8.3.1	link#8	UH	7074	1500	ovpnc1	
                                  10.8.3.10	link#8	UHS	0	16384	lo0	
                                  10.8.8.0/24	10.8.8.1	UGS	0	1500	ovpnc2	
                                  10.8.8.1	link#9	UH	7078	1500	ovpnc2	
                                  10.8.8.4	link#9	UHS	0	16384	lo0	
                                  127.0.0.1	link#4	UH	1350047	16384	lo0	
                                  128.0.0.0/1	10.8.2.1	UGS	57242	1500	ovpnc3	
                                  192.168.1.0/24	link#2	U	815693	1500	igb1	
                                  192.168.1.1	link#2	UHS	0	16384	lo0	
                                  192.168.5.0/24	link#7	U	1927	1500	igb1.5	
                                  192.168.5.1	link#7	UHS	0	16384	lo0	
                                  192.168.10.0/24	link#1	U	0	1500	igb0	
                                  192.168.10.1	6c:b3:11:1c:6c:76	UHS	53316	1500	igb0	
                                  192.168.10.3	link#1	UHS	0	16384	lo0	
                                  217.146.82.191/32	192.168.10.1	UGS	24899	1500	igb0	
                                  
                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by johnpoz

                                    Well that looks correct.. you have 192.168.5 and using the interface..

                                    And it was seeing traffic - your not running any sort of IPS are you?

                                    Can you post output of

                                    cat /tmp/rules.debug

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    R 1 Reply Last reply Reply Quote 0
                                    • R
                                      r79c @johnpoz
                                      last edited by

                                      @johnpoz said in Netgear/Vlans/Pfsense:

                                      • your not running any sort of IPS are you?

                                      snort

                                      1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by

                                        Dude!!!! you need to give this info.... Disable it!!! What do its logs say..

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        R 1 Reply Last reply Reply Quote 0
                                        • R
                                          r79c @johnpoz
                                          last edited by r79c

                                          @johnpoz said in Netgear/Vlans/Pfsense:

                                          So maybe its just an issue with this nic and vlans

                                          perhaps the card that I bought off Amazon does not support VLAN's, although I presumed it did. Also I saw that pfsense only shows interfaces that VLAN's can be created on so if the card didn't support VLAN's it should not show in the pfsense drop down.

                                          igb0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
                                          	options=6400bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,VLAN_HWTSO,RXCSUM_IPV6,TXCSUM_IPV6>
                                          	ether 6c:b3:11:1c:6c:76
                                          	hwaddr 6c:b3:11:1c:6c:76
                                          	inet6 fe80::6eb3:11ff:fe1c:6c76%igb0 prefixlen 64 scopeid 0x1
                                          	inet6 fdc0:13c1:78f1:0:6eb3:11ff:fe1c:6c76 prefixlen 64 autoconf
                                          	inet 192.168.10.3 netmask 0xffffff00 broadcast 192.168.10.255
                                          	nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>
                                          	media: Ethernet autoselect (1000baseT <full-duplex>)
                                          	status: active
                                          igb1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
                                          	options=6500bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,VLAN_HWFILTER,VLAN_HWTSO,RXCSUM_IPV6,TXCSUM_IPV6>
                                          	ether 6c:b3:11:1c:6c:77
                                          	hwaddr 6c:b3:11:1c:6c:77
                                          	inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255
                                          	inet6 fe80::1:1%igb1 prefixlen 64 scopeid 0x2
                                          	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                                          	media: Ethernet autoselect (1000baseT <full-duplex>)
                                          	status: active
                                          enc0: flags=0<> metric 0 mtu 1536
                                          	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                                          	groups: enc
                                          lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
                                          	options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
                                          	inet6 ::1 prefixlen 128
                                          	inet6 fe80::1%lo0 prefixlen 64 scopeid 0x4
                                          	inet 127.0.0.1 netmask 0xff000000
                                          	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                                          	groups: lo
                                          pflog0: flags=100<PROMISC> metric 0 mtu 33160
                                          	groups: pflog
                                          pfsync0: flags=0<> metric 0 mtu 1500
                                          	groups: pfsync
                                          	syncpeer: 224.0.0.240 maxupd: 128 defer: on
                                          	syncok: 1
                                          igb1.5: flags=88843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,STATICARP> metric 0 mtu 1500
                                          	options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
                                          	ether 6c:b3:11:1c:6c:77
                                          	inet6 fe80::6eb3:11ff:fe1c:6c77%igb1.5 prefixlen 64 scopeid 0x7
                                          	inet 192.168.5.1 netmask 0xffffff00 broadcast 192.168.5.255
                                          	nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>
                                          	media: Ethernet autoselect (1000baseT <full-duplex>)
                                          	status: active
                                          	vlan: 5 vlanpcp: 0 parent interface: igb1
                                          	groups: vlan
                                          ovpnc1: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1500
                                          	options=80000<LINKSTATE>
                                          	inet6 fe80::6eb3:11ff:fe1c:6c76%ovpnc1 prefixlen 64 scopeid 0x8
                                          	inet 10.8.3.10 --> 10.8.3.1 netmask 0xffffff00
                                          	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                                          	groups: tun openvpn
                                          	Opened by PID 7054
                                          ovpnc2: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1500
                                          	options=80000<LINKSTATE>
                                          	inet6 fe80::6eb3:11ff:fe1c:6c76%ovpnc2 prefixlen 64 scopeid 0x9
                                          	inet 10.8.8.4 --> 10.8.8.1 netmask 0xffffff00
                                          	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                                          	groups: tun openvpn
                                          	Opened by PID 82209
                                          ovpnc3: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1500
                                          	options=80000<LINKSTATE>
                                          	inet6 fe80::6eb3:11ff:fe1c:6c76%ovpnc3 prefixlen 64 scopeid 0xa
                                          	inet 10.8.2.19 --> 10.8.2.1 netmask 0xffffff00
                                          	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                                          	groups: tun openvpn
                                          	Opened by PID 33738
                                          
                                          1 Reply Last reply Reply Quote 0
                                          • dotdashD
                                            dotdash
                                            last edited by

                                            You've made a lot of changes, I suggest you reboot the firewall to make sure the pfb/snort is off.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.