Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Netgear/Vlans/Pfsense

    Scheduled Pinned Locked Moved L2/Switching/VLANs
    58 Posts 4 Posters 10.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      r79c @johnpoz
      last edited by

      @johnpoz said in Netgear/Vlans/Pfsense:

      You were sniffing on the vlan interface right!!

      yes

      routing table

      Destination	Gateway	Flags	Use	Mtu	Netif	Expire
      0.0.0.0/1	10.8.2.1	UGS	2057	1500	ovpnc3	
      default	192.168.10.1	UGS	112	1500	igb0	
      10.8.2.0/24	10.8.2.1	UGS	0	1500	ovpnc3	
      10.8.2.1	link#10	UH	7060	1500	ovpnc3	
      10.8.2.19	link#10	UHS	0	16384	lo0	
      10.8.3.1	link#8	UH	7074	1500	ovpnc1	
      10.8.3.10	link#8	UHS	0	16384	lo0	
      10.8.8.0/24	10.8.8.1	UGS	0	1500	ovpnc2	
      10.8.8.1	link#9	UH	7078	1500	ovpnc2	
      10.8.8.4	link#9	UHS	0	16384	lo0	
      127.0.0.1	link#4	UH	1350047	16384	lo0	
      128.0.0.0/1	10.8.2.1	UGS	57242	1500	ovpnc3	
      192.168.1.0/24	link#2	U	815693	1500	igb1	
      192.168.1.1	link#2	UHS	0	16384	lo0	
      192.168.5.0/24	link#7	U	1927	1500	igb1.5	
      192.168.5.1	link#7	UHS	0	16384	lo0	
      192.168.10.0/24	link#1	U	0	1500	igb0	
      192.168.10.1	6c:b3:11:1c:6c:76	UHS	53316	1500	igb0	
      192.168.10.3	link#1	UHS	0	16384	lo0	
      217.146.82.191/32	192.168.10.1	UGS	24899	1500	igb0	
      
      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by johnpoz

        Well that looks correct.. you have 192.168.5 and using the interface..

        And it was seeing traffic - your not running any sort of IPS are you?

        Can you post output of

        cat /tmp/rules.debug

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        R 1 Reply Last reply Reply Quote 0
        • R
          r79c @johnpoz
          last edited by

          @johnpoz said in Netgear/Vlans/Pfsense:

          • your not running any sort of IPS are you?

          snort

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            Dude!!!! you need to give this info.... Disable it!!! What do its logs say..

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            R 1 Reply Last reply Reply Quote 0
            • R
              r79c @johnpoz
              last edited by r79c

              @johnpoz said in Netgear/Vlans/Pfsense:

              So maybe its just an issue with this nic and vlans

              perhaps the card that I bought off Amazon does not support VLAN's, although I presumed it did. Also I saw that pfsense only shows interfaces that VLAN's can be created on so if the card didn't support VLAN's it should not show in the pfsense drop down.

              igb0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
              	options=6400bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,VLAN_HWTSO,RXCSUM_IPV6,TXCSUM_IPV6>
              	ether 6c:b3:11:1c:6c:76
              	hwaddr 6c:b3:11:1c:6c:76
              	inet6 fe80::6eb3:11ff:fe1c:6c76%igb0 prefixlen 64 scopeid 0x1
              	inet6 fdc0:13c1:78f1:0:6eb3:11ff:fe1c:6c76 prefixlen 64 autoconf
              	inet 192.168.10.3 netmask 0xffffff00 broadcast 192.168.10.255
              	nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>
              	media: Ethernet autoselect (1000baseT <full-duplex>)
              	status: active
              igb1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
              	options=6500bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,VLAN_HWFILTER,VLAN_HWTSO,RXCSUM_IPV6,TXCSUM_IPV6>
              	ether 6c:b3:11:1c:6c:77
              	hwaddr 6c:b3:11:1c:6c:77
              	inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255
              	inet6 fe80::1:1%igb1 prefixlen 64 scopeid 0x2
              	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
              	media: Ethernet autoselect (1000baseT <full-duplex>)
              	status: active
              enc0: flags=0<> metric 0 mtu 1536
              	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
              	groups: enc
              lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
              	options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
              	inet6 ::1 prefixlen 128
              	inet6 fe80::1%lo0 prefixlen 64 scopeid 0x4
              	inet 127.0.0.1 netmask 0xff000000
              	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
              	groups: lo
              pflog0: flags=100<PROMISC> metric 0 mtu 33160
              	groups: pflog
              pfsync0: flags=0<> metric 0 mtu 1500
              	groups: pfsync
              	syncpeer: 224.0.0.240 maxupd: 128 defer: on
              	syncok: 1
              igb1.5: flags=88843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,STATICARP> metric 0 mtu 1500
              	options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
              	ether 6c:b3:11:1c:6c:77
              	inet6 fe80::6eb3:11ff:fe1c:6c77%igb1.5 prefixlen 64 scopeid 0x7
              	inet 192.168.5.1 netmask 0xffffff00 broadcast 192.168.5.255
              	nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>
              	media: Ethernet autoselect (1000baseT <full-duplex>)
              	status: active
              	vlan: 5 vlanpcp: 0 parent interface: igb1
              	groups: vlan
              ovpnc1: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1500
              	options=80000<LINKSTATE>
              	inet6 fe80::6eb3:11ff:fe1c:6c76%ovpnc1 prefixlen 64 scopeid 0x8
              	inet 10.8.3.10 --> 10.8.3.1 netmask 0xffffff00
              	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
              	groups: tun openvpn
              	Opened by PID 7054
              ovpnc2: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1500
              	options=80000<LINKSTATE>
              	inet6 fe80::6eb3:11ff:fe1c:6c76%ovpnc2 prefixlen 64 scopeid 0x9
              	inet 10.8.8.4 --> 10.8.8.1 netmask 0xffffff00
              	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
              	groups: tun openvpn
              	Opened by PID 82209
              ovpnc3: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1500
              	options=80000<LINKSTATE>
              	inet6 fe80::6eb3:11ff:fe1c:6c76%ovpnc3 prefixlen 64 scopeid 0xa
              	inet 10.8.2.19 --> 10.8.2.1 netmask 0xffffff00
              	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
              	groups: tun openvpn
              	Opened by PID 33738
              
              1 Reply Last reply Reply Quote 0
              • dotdashD
                dotdash
                last edited by

                You've made a lot of changes, I suggest you reboot the firewall to make sure the pfb/snort is off.

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by johnpoz

                  Well I am out of ideas to be honest... You say your sniffing on your vlan, and seeing the ping request.. Your rule you posted shows your allowing it... And your showing hits..

                  So makes no sense..

                  But your running IPS, and you had pfblocker with rules that would block rfc1918 space, etc..

                  Your nic is some no name???, never heard off - and its mac address does not even lookup... So maybe its just an issue with this nic and vlans... Lets see a ifconfig output from pfsense. I want to see what is showing for options on your igb1...

                  example - here is an interface I am running vlans on.

                  igb2: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
                          options=6500bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,VLAN_HWFILTER,VLAN_HWTSO,RXCSUM_IPV6,TXCSUM_IPV6>
                          ether 00:08:a2:0c:e6:20
                          hwaddr 00:08:a2:0c:e6:20
                          inet6 fe80::208:a2ff:fe0c:e620%igb2 prefixlen 64 scopeid 0x3 
                          inet 192.168.2.253 netmask 0xffffff00 broadcast 192.168.2.255 
                          nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                          media: Ethernet autoselect (1000baseT <full-duplex>)
                          status: active
                  
                  igb2.4: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
                          options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
                          ether 00:08:a2:0c:e6:20
                          inet6 fe80::208:a2ff:fe0c:e620%igb2.4 prefixlen 64 scopeid 0xb 
                          inet 192.168.4.253 netmask 0xffffff00 broadcast 192.168.4.255 
                          nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                          media: Ethernet autoselect (1000baseT <full-duplex>)
                          status: active
                          vlan: 4 vlanpcp: 0 parent interface: igb2
                          groups: vlan 
                  igb2.6: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
                          options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
                          ether 00:08:a2:0c:e6:20
                          inet6 fe80::208:a2ff:fe0c:e620%igb2.6 prefixlen 64 scopeid 0xc 
                          inet 192.168.6.253 netmask 0xffffff00 broadcast 192.168.6.255 
                          nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                          media: Ethernet autoselect (1000baseT <full-duplex>)
                          status: active
                          vlan: 6 vlanpcp: 0 parent interface: igb2
                          groups: vlan 
                  
                  
                  

                  Only other thing would be to run tcpdump on pfsense with -e flag so you can see the tagging is happening or not happening... Maybe its answering without the tag???? So your sniff on vlan wouldn't show it - that is guess..

                  But sure a reload of your rules, or reboot couldn't hurt.

                  From pfsense - sniff on your vlan 5, and try to ping your client 192.168.5.50..

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  R 1 Reply Last reply Reply Quote 0
                  • R
                    r79c @johnpoz
                    last edited by r79c

                    @johnpoz said in Netgear/Vlans/Pfsense:

                    So maybe its just an issue with this nic and vlans

                    Perhaps it is, I presumed the card that I purchased off amazon supported vlan's and the pfsense drop down showed the card as an interface that could create vlans on...

                    amazon nic

                    igb0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
                    	options=6400bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,VLAN_HWTSO,RXCSUM_IPV6,TXCSUM_IPV6>
                    	ether 6c:b3:11:1c:6c:76
                    	hwaddr 6c:b3:11:1c:6c:76
                    	inet6 fe80::6eb3:11ff:fe1c:6c76%igb0 prefixlen 64 scopeid 0x1
                    	inet6 fdc0:13c1:78f1:0:6eb3:11ff:fe1c:6c76 prefixlen 64 autoconf
                    	inet 192.168.10.3 netmask 0xffffff00 broadcast 192.168.10.255
                    	nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>
                    	media: Ethernet autoselect (1000baseT <full-duplex>)
                    	status: active
                    igb1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
                    	options=6500bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,VLAN_HWFILTER,VLAN_HWTSO,RXCSUM_IPV6,TXCSUM_IPV6>
                    	ether 6c:b3:11:1c:6c:77
                    	hwaddr 6c:b3:11:1c:6c:77
                    	inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255
                    	inet6 fe80::1:1%igb1 prefixlen 64 scopeid 0x2
                    	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                    	media: Ethernet autoselect (1000baseT <full-duplex>)
                    	status: active
                    enc0: flags=0<> metric 0 mtu 1536
                    	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                    	groups: enc
                    lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
                    	options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
                    	inet6 ::1 prefixlen 128
                    	inet6 fe80::1%lo0 prefixlen 64 scopeid 0x4
                    	inet 127.0.0.1 netmask 0xff000000
                    	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                    	groups: lo
                    pflog0: flags=100<PROMISC> metric 0 mtu 33160
                    	groups: pflog
                    pfsync0: flags=0<> metric 0 mtu 1500
                    	groups: pfsync
                    	syncpeer: 224.0.0.240 maxupd: 128 defer: on
                    	syncok: 1
                    igb1.5: flags=88843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,STATICARP> metric 0 mtu 1500
                    	options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
                    	ether 6c:b3:11:1c:6c:77
                    	inet6 fe80::6eb3:11ff:fe1c:6c77%igb1.5 prefixlen 64 scopeid 0x7
                    	inet 192.168.5.1 netmask 0xffffff00 broadcast 192.168.5.255
                    	nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>
                    	media: Ethernet autoselect (1000baseT <full-duplex>)
                    	status: active
                    	vlan: 5 vlanpcp: 0 parent interface: igb1
                    	groups: vlan
                    ovpnc1: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1500
                    	options=80000<LINKSTATE>
                    	inet6 fe80::6eb3:11ff:fe1c:6c76%ovpnc1 prefixlen 64 scopeid 0x8
                    	inet 10.8.3.10 --> 10.8.3.1 netmask 0xffffff00
                    	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                    	groups: tun openvpn
                    	Opened by PID 7054
                    ovpnc2: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1500
                    	options=80000<LINKSTATE>
                    	inet6 fe80::6eb3:11ff:fe1c:6c76%ovpnc2 prefixlen 64 scopeid 0x9
                    	inet 10.8.8.4 --> 10.8.8.1 netmask 0xffffff00
                    	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                    	groups: tun openvpn
                    	Opened by PID 82209
                    ovpnc3: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1500
                    	options=80000<LINKSTATE>
                    	inet6 fe80::6eb3:11ff:fe1c:6c76%ovpnc3 prefixlen 64 scopeid 0xa
                    	inet 10.8.2.19 --> 10.8.2.1 netmask 0xffffff00
                    	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
                    	groups: tun openvpn
                    	Opened by PID 33738
                    

                    just to recap the NAT automatic rules have added 192.168.1.0/24 and 192.168.5.0/24

                    can I just be sure that I'm not missing a specific mapping that needs to be added???? like you have said before would the automatic rule be enough???

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by johnpoz

                      Your nat rules have zero to do with pinging 192.168.5.1..

                      Who makes this card exactly??? 6c:b3:11 does not show up as vendor .. ipolex?

                      It really makes no sense at this point... Have you rebooted? And you disabled snort and pfblocker... What is looks like from your sniff is firewall not allowing the traffic..

                      edit: Why do you have this on your vlan interface??

                      STATICARP

                      Do you have this enabled???

                      enabled.jpg

                      OMG dude - did you just click every possible thing there is to click without clue one to what any of it does??? Why would you click that???

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      J 1 Reply Last reply Reply Quote 0
                      • J
                        jdeloach @johnpoz
                        last edited by jdeloach

                        @johnpoz said in Netgear/Vlans/Pfsense:

                        Who makes this card exactly??? 6c:b3:11 does not show up as vendor .. ipolex?

                        Not sure how accurate this information is but a Google search shows that his NIC is made by the following company in China. Never heard of them. Maybe this NIC is not compatible FreeBSD 11.x?

                        Company
                        Shenzhen Lianrui Electronics Co.,Ltd
                        Address
                        Block C4 XinTang Industrial Park
                        Baishixia FuYong Town BaoAn District
                        Shenzhen Guangdong 518000
                        CHINA
                        Range
                        6C:B3:11:00:00:00 - 6C:B3:11:FF:FF:FF
                        Type
                        IEEE MA-L

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.