Subnet to Subnet routing (LANs) not a windows firewall issue

farmwald

I'm new to pfsense, but pretty experenced with other routers/firewalls.

I have a path dependent subnet routing issue which seems to be pfsense specific.

pfsense (pf) is 10.1.0.1
edgerouter (er) is 10.2.0.1

both can directly see each other's subnets:
pf is 10.2.0.2 on edgerouter subnet
er is 10.1.0.2 on pfsense subnet

trying to ping from 10.2.0.3 to 10.1.0.3 fails, while 10.1.0.3 to 10.2.0.3 works

Firewalls on both 10.2.0.3 and 10.1.0.3 are not the problem.

ping path: 10.2.0.3 -> 10.2.0.1 -> 10.1.0.3
reply path: 10.1.0.3 -> 10.1.0.1 -> 10.2.0.3 <- This fails
but
ping path: 10.1.0.3 -> 10.1.0.1 -> 10.2.0.3
reply path: 10.2.0.3 -> 10.2.0.1 -> 10.1.0.3 <- This works

Something in pfsense is blocking the reply when the ping didn't come thru pfsense.
The edgerouter doesn't have this problem.
The firewall rules on pfsense for both subnets pass all traffic.

Also, if I add a client specific route for 10.2.0.3 to route to 10.1.0.1 instead of the default 10.2.0.1, the ping works. This is presumably because the ping and reply are taking the same path. Adding a similar route to 10.1.0.3 also makes the ping work.

How do I get pfsense to pass the reply even though it didn't originate the ping?

johnpoz

@farmwald said in Subnet to Subnet routing (LANs) not a windows firewall issue:

Something in pfsense is blocking the reply when the ping didn't come thru pfsense.

Well yeah - since that traffic is out of state.. Fix your asymmetrical traffic flow.

Routers should be connected via a transit network, there should be no clients on this network.. If there are - then its not a transit network.. And you would either need to host route on each client on this transit network... Or you would have to nat at the downstream router.

The correct solution is not to put hosts on a transit network.

farmwald

@johnpoz Thanks, this is what I expected. The Edgerouters have no firewall on the LANs, so they don't maintain state (assuming I correctly understand the ER.)
I thought the combined hosts+transit networks would be simpler (no manual gateways to configure ) and faster (one router transit, instead of two), but apparently, it doesn't work.
I did try the "Bypass firewall rules for traffic on the same interface", but that didn't help - the LANs aren't on the same interface. I might try the manual fix on the Troubleshooting Asymmetric Routing page, but I will just go with your solution.
I was hoping there was a way to completely disable the LAN firewall(s), but I don't see that option while keeping the WAN nat/firewall.