1 WAN 2 LAN
-
Hi all,
I have been running PFSense for my home network for a year with 1 WAN and 1 LAN. I am a little of a noob, and starting to grasp the concepts as I try to configure my PFSense.
I have recently upgraded the hardware and installed a new NIC.
I have configured the Interface as well as the DHCP Server. I now have :
1 WAN - getting Public IP from Router
1 LAN (old) - 192.168.1.1 - DHCP Range ; 192.168.1.100 - 199 /24
1 LAN (new) - 192.168.2.1 - DHCP Range ; 192.168.2.1 - 254 /24Although the computers on the LAN (new) do not get internet access. I have looked around but didn't manage to get i right. Nonetheless, the computer on LAN (new) are getting an IP, and I can connect to the PFSense from that part of the network.
I haven't changed anything in the 'old' network.
I am trying to have the new NIC for home guests and the 'old' NIC for private home network. The old NIC will be VPN'd in a near future as soon I get the 'new' NIC working properly.Can someone help me out here please ?
If you need I can upload some screen upon request.
Thank you very much all.
nevr0sed
-
Hi nevr0sed
Have you made the Firewall Rules for the new LAN?
Aaron
-
Hello
Yes this are the rules I have made.
But I am really not sure about them.
What kind of rule shall I put on the WAN interface ?
Thanks.
nevr0sed
-
Your WAN should have no rules unless you are allowing access in for port forwards, for example.
For testing purposes, you only need the very last rule that allows all traffic. Once it's working, then you can worry about tightening up your rules. Since the last rule will allow access to the Internet, I have to wonder if you have your problem is with your PUBLICLANINTERFACE clients or DHCP configuration. From a client, can you ping 8.8.8.8?
-
Hello KOM,
No from a Client I cannot ping 8.8.8.8
Request timeout for icmp_seq…Thanks
-
1 LAN (new) - 192.168.2.1 - DHCP Range ; 192.168.2.1 - 254 /24
What's the IP address of your client? In the above DHCP detail, you seem to be including the PUBLICLANINTERFACE IP address in your DHCP pool. I don't suppose your client is using the same IP address? From your client, please run a command prompt and post the output of ipconfig if Windows, or run a terminal and post the output of ifconfig if Linux.
-
The IP address of my client on PUBLICLANINTERFACE is : 192.168.2.2
Here is the ifconfig output
lo0: flags=8049 <up,loopback,running,multicast>mtu 16384 options=3 <rxcsum,txcsum>inet6 ::1 prefixlen 128 inet 127.0.0.1 netmask 0xff000000 inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 nd6 options=1 <performnud>gif0: flags=8010 <pointopoint,multicast>mtu 1280 stf0: flags=0<> mtu 1280 en0: flags=8863 <up,broadcast,smart,running,simplex,multicast>mtu 1500 options=10b <rxcsum,txcsum,vlan_hwtagging,av>ether 00:00:00:00:0:00 inet6 0000::0000:0000:0000:5764%en0 prefixlen 64 scopeid 0x4 inet 192.168.2.2 netmask 0xffffff00 broadcast 192.168.2.255 nd6 options=1 <performnud>media: autoselect (1000baseT <full-duplex,flow-control,energy-efficient-ethernet>) status: active en1: flags=8823 <up,broadcast,smart,simplex,multicast>mtu 1500 ether 00:00:00:00:0:00 nd6 options=1 <performnud>media: autoselect (<unknown type="">) status: inactive en2: flags=8963 <up,broadcast,smart,running,promisc,simplex,multicast>mtu 1500 options=60 <tso4,tso6>ether 00:00:00:00:0:00 media: autoselect <full-duplex>status: inactive fw0: flags=8863 <up,broadcast,smart,running,simplex,multicast>mtu 4078 lladdr 00:00:00:00:0:00 nd6 options=1 <performnud>media: autoselect <full-duplex>status: inactive p2p0: flags=8802 <broadcast,simplex,multicast>mtu 2304 ether 00:00:00:00:0:00 media: autoselect status: inactive awdl0: flags=8902 <broadcast,promisc,simplex,multicast>mtu 1452 ether 00:00:00:00:0:00 nd6 options=1 <performnud>media: autoselect status: inactive bridge0: flags=8863 <up,broadcast,smart,running,simplex,multicast>mtu 1500 options=63 <rxcsum,txcsum,tso4,tso6>ether 00:00:00:00:0:00 Configuration: id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0 maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200 root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0 ipfilter disabled flags 0x2 member: en2 flags=3 <learning,discover>ifmaxaddr 0 port 6 priority 0 path cost 0 nd6 options=1 <performnud>media: <unknown type="">status: inactive</unknown></performnud></learning,discover></rxcsum,txcsum,tso4,tso6></up,broadcast,smart,running,simplex,multicast></performnud></broadcast,promisc,simplex,multicast></broadcast,simplex,multicast></full-duplex></performnud></up,broadcast,smart,running,simplex,multicast></full-duplex></tso4,tso6></up,broadcast,smart,running,promisc,simplex,multicast></unknown></performnud></up,broadcast,smart,simplex,multicast></full-duplex,flow-control,energy-efficient-ethernet></performnud></rxcsum,txcsum,vlan_hwtagging,av></up,broadcast,smart,running,simplex,multicast></pointopoint,multicast></performnud></rxcsum,txcsum></up,loopback,running,multicast>
Thank you very much for your help.
-
Hello,
Any one can help ? I cannot figure out why it isn't working.
I is there anything to do with the DNS ?
What should be the DHCP server IP ?
What should be the DHCP server Range ?Thanks for your help.
nevr0sed
-
Do I need to configure a Gateway specific for each LAN i have ?
-
No, only WAN needs a gateway. Your clients on each LAN however DO need a gateway or they won't be able to send traffic out fro their local network.
Did you nuke all of your firewall rules and just keep the last one?
-
Hey,
Thanks for the reply
Here are the rules that I have currently modified as you said.
The weird thing is that I can ping from client on PUBLICLANINTERFACE any other clients on PRIVATELAN.
Find also my rules on my WAN.
Thank you
-
LAN source should be *. You should delete WAN rules 3 and 4 (the ones that reference PUBLICLANINTERFACE). Can your client ping 192.168.2.1?
-
Ok,
I have deleted the 2 rules mentioned.Yes I can ping 192.168.2.1
I can also have access to the PFsense Web Client…When I try to go on www.google.com I get "ERR_CONNECTION_TIMED_OUT" on the page from the client.
-
I'll get back to you after lunch.
-
-
OK, so your client that is timing everything out. You already gave me the output of ifconfig. Any difference if you manually configure the client with static IP, netmask, DNS and gateway?
-
Ok,
Just to be sure in the manual config:
IP : 192.168.2.2
netmask : 255.255.255.0
DNS : 192.168.2.1 (?)
Gateway: 192.168.2.1 (?)I'm not sure about the DNS and the GW.
Thank you.
n.
-
Ok,
Just to be sure in the manual config:
IP : 192.168.2.2
netmask : 255.255.255.0
DNS : 192.168.2.1 (?)
Gateway: 192.168.2.1 (?)I'm not sure about the DNS and the GW.
Thank you.
n.
Ok with the config above, I still can ping the PFsense, the other lan (PRIVATELAN).
Still no win with the pings on the www.
Before this config, when I pinged www.google.com I got an IP address as return but ICMP fail. Now it tell mecannot resolve www.google.com : Unknown host.
So I guess that there is something to do with the DNS ?
n.
-
Gateway is correct, DNS can be the same as the gateway (pfsense) as long as you're running the DNS forwarder or resolver. Just to be safe you could try setting DNS to 192.168.2.1 8.8.8.8 so that it falls back to Google DNS if pfSense DNS isn't running for whatever reason.
-
try deleting rule #1, 3, 4, and 5, keep only rule #2.
AND
you can also define your gateway in the advanced section of the setting, instead of using "destinations"
change PUBLICLAN address to PUBLICLAN net instead.
You can also consider using two different rules for IPV4 and IPV6.
this is what worked for me.
-
@KOM:
Gateway is correct, DNS can be the same as the gateway (pfsense) as long as you're running the DNS forwarder or resolver. Just to be safe you could try setting DNS to 192.168.2.1 8.8.8.8 so that it falls back to Google DNS if pfSense DNS isn't running for whatever reason.
Thanks, ok just to be sure where shall I add this DNS ?
In the DHCP configuration or elsewhere ?Find attached a couple of screens.
-
try deleting rule #1, 3, 4, and 5, keep only rule #2.
AND
change PUBLICLAN address to PUBLICLAN net instead.
You can also consider using two different rules for IPV4 and IPV6.
Hi Tigs,
Thanks for your help.This is the current rules I have. As I have modified some.
Let me know which ones to delete again, and on which interface.
Thank you very much !
n.
-
Thanks, ok just to be sure where shall I add this DNS ?
In your client's TCP/IP config. I'm a little busy in my real job at the moment applying a bunch of ESXi patches so I can't give this much attention for the next little while.
-
try deleting rule #1, 3, 4, and 5, keep only rule #2.
AND
change PUBLICLAN address to PUBLICLAN net instead.
You can also consider using two different rules for IPV4 and IPV6.
Hi Tigs,
Thanks for your help.This is the current rules I have. As I have modified some.
Let me know which ones to delete again, and on which interface.
Thank you very much !
n.
You need to define "source" which is the "PUBLICLANINTERFACE net".
-
Ok,
I have done what you said. I have tried putting other rules such as :
But nothing works.-
PUBLICLANINTERFACE
-
Source: * – Dest: *
-
Source: EXTERNALWAN – Dest: *
-
Source: * – Dest: EXTERNALWAN
-
EXTERNALWAN
-
Source: PUBLICLANINTERFACE – Dest: *
-
Source: * – Dest: PUBLICLANINTERFACE
Maybe, but I am no expert, can't it be something related to the DNS or Gateway ?
Thanks again for all the support guys.
n.
-
-
Ok,
I have done what you said. I have tried putting other rules such as :
But nothing works.-
PUBLICLANINTERFACE
-
Source: * – Dest: *
-
Source: EXTERNALWAN – Dest: *
-
Source: * – Dest: EXTERNALWAN
-
EXTERNALWAN
-
Source: PUBLICLANINTERFACE – Dest: *
-
Source: * – Dest: PUBLICLANINTERFACE
Maybe, but I am no expert, can't it be something related to the DNS or Gateway ?
Thanks again for all the support guys.
n.
-
-
What you did is not what I said for sure. You need to read carefully.
You are over-complicating things, which may not always be a good thing.
You need:
1, Get rid of all your WAN rules, at least for the sake of trouble shooting. Someone already mentioned that to you.
2, you only need one rule for the PUBLICLANINTERFACE, Which I also said as well. I have attached a picture of what a working rule should look like.Yes sure, it's what I did. I have tried in the very first place what you guys told me, and redid it, with no success.
I have tried with and without the Gateway. Still the same, no internet connection. But all networks are pingable.
Thanks again.
n.
-
This really shouldn't be this hard. Let's start from the beginning.
Your OPT1 interface, aka new NIC, is configured as 192.168.2.1. You havea firewall rule on OPT1 tab that allows all for IPv4. You have DHCP enabled with a range of 1-254, which isn't correct as the gateway address (192.168.2.1) should not be part of the DHCP address pool. Your client gets its net config via DHCP (192.168.2.2), but attempts to access websites result in a timeout.
How is your client connected to OPT1, via a switch? What OS is your client running?
-
Hello KOM,
@KOM:
This really shouldn't be this hard. Let's start from the beginning.
I know ! It's just amazing how wicked it is that it ain't working… :o
Your OPT1 interface, aka new NIC, is configured as 192.168.2.1.
Yes.
You havea firewall rule on OPT1 tab that allows all for IPv4.
Yes.
You have DHCP enabled with a range of 1-254, which isn't correct as the gateway address (192.168.2.1) should not be part of the DHCP address pool. Your client gets its net config via DHCP (192.168.2.2), but attempts to access websites result in a timeout.
Yes. So I have changed to range to 192.168.2.16 - 192.168.2.32
How is your client connected to OPT1, via a switch? What OS is your client running?
My client IP now is 192.168.2.17
My client Subnet Mask is : 255.255.255.0
Routeur is : 192.168.2.1
DNS Server : 192.168.2.1
Search Domain : myhomedomain.orgMy client is connected through a Home Switch http://www.staples.com/NETGEAR-ProSAFE-5-Port-Gigabit-Ethernet-Desktop-Switch-GS105NA/product_565423
The client is a Mac Mini.
I am pretty sure that there is something to do with the DNS… Although I have no clue what do to with it.
Thanks for your help again.
n.
-
I am pretty sure that there is something to do with the DNS
What's your output if you drop to a shell and type nslookup www.google.com?
-
Hi,
Server: 192.168.2.1 Address: 192.168.2.1#53 ** server can't find wwww.google.com: NXDOMAIN
I have no idea what that means…
n.
-
It means that you can't resolve hostnames to IP addresses, as if your DNS isn't working. Your DNS server is pfSense itself. Previous screens show you're running the DNS Resolver. Under your DNS Resolver settings, uncheck the Enable forwarding mode box and try it again. Do you have anything configured under General Settings - DNS Servers?
-
@KOM:
It means that you can't resolve hostnames to IP addresses, as if your DNS isn't working. Your DNS server is pfSense itself. Previous screens show you're running the DNS Resolver. Under your DNS Resolver settings, uncheck the Enable forwarding mode box and try it again. Do you have anything configured under General Settings - DNS Servers?
Hi,
I have done what you requested. Still no changes in the problem.
I have 2 DNS servers that will be used on the PRIVATELANINTERFACE to configure a VPN on it. I have tried with them and without, and nothing changes.Thanks again. This issue is starting to make me crazy… :)
n.
![Image 1.png](/public/imported_attachments/1/Image 1.png)
![Image 1.png_thumb](/public/imported_attachments/1/Image 1.png_thumb)
![Image 2.png](/public/imported_attachments/1/Image 2.png)
![Image 2.png_thumb](/public/imported_attachments/1/Image 2.png_thumb) -
I don't know then. Maybe someone else has some suggestions.
-
Ok ! I Will be here looking at the topic from time to time.
On my side, I will maybe reset to factory defaults and see what will happen then. I will post any further results here.
I am giving you an applaud for your help ! :)
Thanks again.
n.
-
Do you have DNS resolver enabled? If not, check it and enable on all interfaces. Go into the Interface tab and remove "Block private networks" checkbox. If you get things working then you can tighten it back up. Then go to your DHCP server and on the interface erase any DNS and Gateway settings you might have.
-
Ok the issue was the NAT. Didn't have an outbound rule…
Stupid of me.
Thanks to you all for the help and support.
n.
-
This post is deleted! -
This post is deleted!