Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Vlan in different subnets cannot connect...

    Scheduled Pinned Locked Moved L2/Switching/VLANs
    16 Posts 4 Posters 1.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator
      last edited by johnpoz

      Yeah.. You prob running into a host firewall issue.. Can your devices ping the IP of pfsense interface in the 10 vlan?

      Oh.. your rules are TCP only? - so you wouldn't be able to ping.. Make those any..

      And your rules are not allowing access to vlan3 from vlan 1 or 2?? Screenshots are always better!

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      1 Reply Last reply Reply Quote 0
      • S
        sho1sho1sho1
        last edited by

        MAIN_OFFICE is 192.168.30.x / 24
        TECH_DEPT is 10.0.0.x / 16
        OFFICE_WIFI is 192.168.40.x /24

        575c2b86-4b3b-42e6-993c-e979d6a7989c-image.png

        c0168957-81cb-4f53-bd72-dfd7f23bdecc-image.png

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by

          Your forcing traffic out a gateway.. If you want a vlan to get to your other networks, you have to allow for that before you force traffic out a gateway

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          S 1 Reply Last reply Reply Quote 0
          • S
            sho1sho1sho1 @johnpoz
            last edited by

            @johnpoz Can you eloborate more on that? Which rule should I change? Or do I swap around the rule order?

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by johnpoz

              On your last pic your not allowing access to anything, above the last rule that forces traffic out the gateway... So how would that vlan get anywhere? Other than out the gateway... And comcast_att sure isn't going to let you access your other vlans.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              S 1 Reply Last reply Reply Quote 0
              • S
                sho1sho1sho1 @johnpoz
                last edited by

                @johnpoz But if I only want my staff to only be able to connect from Main office vlan 1 to tech dept vlan 2 and not the other way... is that possible?

                I think that's why I put allow rule with source vlan 1 and disallow rule with source vlan 2.

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by

                  You can allow or block anything you want... Rules are evaluated top down, first rule to match wins, no other rules are evaluated.

                  Why exactly are you forcing traffic out that gateway, is that not the default gateway, or only gateway?

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  S 1 Reply Last reply Reply Quote 0
                  • JKnottJ
                    JKnott @sho1sho1sho1
                    last edited by

                    @sho1sho1sho1 said in Vlan in different subnets cannot connect...:

                    As for using 10.0.0.0 / 16 subnet, we have systems that come and go. For the first batch, we use 10.0.0.x, for the second batch, we use 10.0.1.x. That way, I don't ever have to worry about duplicate ip in our dhcp file and we keep a log of mac addresses.

                    Maybe you should move to IPv6. You'd be extremely unlikely to see a duplicate in 18.4 billion, billion addresses. If you do, you could start investing in lottery tickets. ๐Ÿ˜‰

                    Do you really have 65K devices coming and going?

                    PfSense running on Qotom mini PC
                    i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                    UniFi AC-Lite access point

                    I haven't lost my mind. It's around here...somewhere...

                    S 1 Reply Last reply Reply Quote 0
                    • S
                      sho1sho1sho1 @johnpoz
                      last edited by

                      @johnpoz I setup a redundant gateway group. I have Comcast and ATT. I haven't figured out how to get redundant gateway group to work with VPN yet... so the default gateway is Comcast alone... With the rule, I had to put in the redundant gateway group or else traffic only goes out Comcast... I wonder if my setup is somewhat correct... I set these all up by studying the wiki ๐Ÿ˜ต

                      Let me study more in-depth about the rules and see if I can get it to work... but can you tell me the /24 and /16 should not be the issue?

                      johnpozJ 1 Reply Last reply Reply Quote 0
                      • S
                        sho1sho1sho1 @JKnott
                        last edited by

                        @JKnott I still haven't dug myself into ipv6 yet... Maybe soon though. I won't have 65k devices coming and going... but the batch of systems that I get might be a batch of 2 or as large as a batch of 500. So some ip 10.0.1.x, I would only use 10.0.1.1 and 10.0.1.2... and I move on to 10.0.2.1 for the next batch... Maybe there could be a better system out there... ๐Ÿ˜Š

                        JKnottJ 1 Reply Last reply Reply Quote 0
                        • JKnottJ
                          JKnott @sho1sho1sho1
                          last edited by

                          @sho1sho1sho1

                          Well, with databases, you need at least one unique key. Seems to me the MAC address would do that and just allow duplicate IP addresses. Also, with a /16 and 65K addresses, it would take a long time to go through all those addresses. You can play with lease time for this. Also, the expire time is much longer than the lease time, so that will cause an address to not be reused for a significant time. I don't know if there's a setting for that though. An expired address won't be used until all free addresses are used.

                          PfSense running on Qotom mini PC
                          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                          UniFi AC-Lite access point

                          I haven't lost my mind. It's around here...somewhere...

                          1 Reply Last reply Reply Quote 1
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator @sho1sho1sho1
                            last edited by johnpoz

                            @sho1sho1sho1 said in Vlan in different subnets cannot connect...:

                            but can you tell me the /24 and /16 should not be the issue?

                            No that is not an issue as long as the networks don't overlap.. and since one is 10.x and the others 192. there is no way they could.

                            There is a whole section about policy routing, which is what your doing when you set a gateway on a rule. And you have to allow intervlan traffic that you want to allow above where you force the traffic out a gateway. Pretty sure its in the multiwan parts of the doc.

                            But if you say what you want to allow and what you want to block - and post your rules happy to validate them for you.

                            And don't forget host firewalls, they don't like other non local vlans normally.. There be a flood of those threads as of late.

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            1 Reply Last reply Reply Quote 1
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.