Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Can't access pfsense web GUI from VLANs [Solved]

    General pfSense Questions
    3
    58
    10157
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      PFbest last edited by

      Hi all,

      Anyone can help me to resolve this issue?

      PCs in VLAN can get internet access, they can ping pfsense LAN IP (parent interface).
      But can't access the web GUI of pfsense from VLANs

      LAN/pfsense: 192.168.0.1 192.168.0.0/24
      VLAN/pfsense: 192.168.3.1 192.168.3.0/24
      PC: 192.168.3.10/24

      PC <- http/https -> Google OK
      PC <- ping -> LAN OK
      PC <- http/https -> LAN/pfsense Can't access, ERR_TIMED_OUT

      Any help will be appreciated!!!

      Thank you!

      1 Reply Last reply Reply Quote 0
      • johnpoz
        johnpoz LAYER 8 Global Moderator last edited by

        "PC: 192.168.3.10/32"

        You have your pcs set with a 32 bit mask??

        What are the firewall rules you have on your vlan interface?

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

        1 Reply Last reply Reply Quote 0
        • P
          PFbest last edited by

          @johnpoz:

          "PC: 192.168.3.10/32"

          You have your pcs set with a 32 bit mask??

          What are the firewall rules you have on your vlan interface?

          Sorry that was wrong, 192.168.3.10/24

          For vlan, rules are all like, IPv4* * * * * *, so yea, shouldn't have any limits isn't it  ???

          1 Reply Last reply Reply Quote 0
          • johnpoz
            johnpoz LAYER 8 Global Moderator last edited by

            vs saying they are all like and then some *, if you have a rule that is any any, where does that rule sit in the list?

            With your statement rules are "all" like I am thinking there is more than one.  So rules are evaluated top down first rule to trigger wins.  So its quite possible that even if you have any any rule at the bottom that some rule blocks access above that.

            How about a simple post of the rules and we can take a look see if there is anything there that could be causing your problem.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

            1 Reply Last reply Reply Quote 0
            • P
              PFbest last edited by

              Sure thing!

              (Default vlan is not been used, or tested currently, can be ignored)
              PC is in guest vlan
              voip vlan works fine, it only needs to connect to internet, not much to do with that.












              1 Reply Last reply Reply Quote 0
              • P
                PFbest last edited by

                for SW
                ID
                01: all untagged
                11 (voip): 01 tagged, 04 untagged
                12 (guest): 01 tagged, 07 untagged

                1 Reply Last reply Reply Quote 0
                • johnpoz
                  johnpoz LAYER 8 Global Moderator last edited by

                  So pfsense is connected to your switch on port 1

                  On this port you have vlan 1 as native untagged.  Ok then all your other vlans are tagged.. Ok that makes sense.

                  Then on port your AP is plugged into?? Port 7 vlan 12 is untagged.

                  Ok that is fine if all traffic on your AP is on one vlan and no SSID based vlans being used.

                  So this client that can not get to pfsense web interface is wifi, and you say it can ping pfsense lan.  But not access its gui.  Is this client using a proxy?  Can it access the gui via the IP in that network.

                  Not quite understanding your switch setup.

                  So you say vlan 1 is untagged on all ports?  But vlan 12 is also untaged on port 7?  So port 7 as untagged vlan 1 and vlan 12 ???  That is broke!

                  So Pfsense gui listens on all interfaces..  It just has lock out rule on lan interface.  But I for example can hit my wlan pfsense IP 192.168.2.253 from my lan network 192.168.9.0/24 because I do not block that traffic.  But from say my wifi network I can not get to any web gui on pfsense on any IP because I specifically block that.

                  I think you have some problem in your switch configs and how your vlans are tagged and untagged.

                  A port should only have 1 native (untagged) vlan on it..

                  So as you see I can access my web gui on any vlan IP address, from my lan network.


                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                  1 Reply Last reply Reply Quote 0
                  • P
                    PFbest last edited by

                    Yep, I created a basic layout image, with only related stuff in it.
                    You are so experiences!  :o Most parts you presumed are right!

                    Then on port your AP is plugged into?? Port 7 vlan 12 is untagged.

                    Yes, I'm going to put AP on port 7 once all the VLAN thing working as desired (After I get the console for the AP) AP will be capable for SSID/VLAN stuff i guess, so I will change port7 to tagged once AP is connected.
                    So currently port 7 is directly connected to a PC, for testing VLAN, and is untagged.

                    So this client that can not get to pfsense web interface is wifi, and you say it can ping pfsense lan.  But not access its gui.  Is this client using a proxy?  Can it access the gui via the IP in that network.

                    Yep it can't access pfsense web interface (via CAT6 directly connected to switch port 7) (PC IP:192.168.3.10). Yes it can ping the pfsense LAN ip (192.168.0.1) and any devices within LAN (e.g. 192.168.0.101, 192.168.0.102 etc.), can ping VLAN 11 and anything within that VLAN (192.168.2.1) VOIP box (192.168.2.2), can ping VLAN 12 (192.168.3.1).

                    So you say vlan 1 is untagged on all ports?  But vlan 12 is also untaged on port 7?  So port 7 as untagged vlan 1 and vlan 12 ???  That is broke!

                    I was fiddling around, previously port 7 was not in that VLAN as untagged, anyway, now it's removed, you can see from the new image :) Now looking more right I guess.

                    So Pfsense gui listens on all interfaces..  It just has lock out rule on lan interface.  But I for example can hit my wlan pfsense IP 192.168.2.253 from my lan network 192.168.9.0/24 because I do not block that traffic.  But from say my wifi network I can not get to any web gui on pfsense on any IP because I specifically block that.

                    Yep and that is exactly what I want to achieve.
                    But currently it seems interesting, and I have spent two days on this and still have no idea how to resolve it.

                    I think you have some problem in your switch configs and how your vlans are tagged and untagged.

                    Will those images be helpful?
                    It's a smart switch, not layer 3, so i guess there's not too much I can mess around  :P (Netgear JGS524E-v2, if that helps ;D)

                    A port should only have 1 native (untagged) vlan on it..

                    Yep, as you said, I just did it, removed port 7 and port 4 from VLAN 1

                    So as you see I can access my web gui on any vlan IP address, from my lan network.

                    Yep That's what I want to see, and currently I can't figure out why it's not doing it :-[

                    Thank you very much for your time to the reply!
                    And thank you for your patience for reading this one.

                    (I'm new to VLAN stuff, So I can go wrong with some basic things like one port tagged twice for troubleshooting, which probably can bring more trouble actually  :P :P :P )
















                    1 Reply Last reply Reply Quote 0
                    • P
                      PFbest last edited by

                      I found one interesting thing is.
                      You know the VOIP gateway is connected to switch, on port 4, vlan 11.
                      If I connect my pc to that gateway, LAN port, I can access 192.168.0.1 (pfsense LAN, web gui)
                      But if I connect my pc directly to port 4, I can't access 192.168.0.1 then, ping is fine.

                      Anyone know why and how to resolve this?

                      Thanks

                      1 Reply Last reply Reply Quote 0
                      • johnpoz
                        johnpoz LAYER 8 Global Moderator last edited by

                        Ok you changed the native untagged on the ports.  But why do you have vlan 1 tagged on port 7 if all your doing is plugging in a computer?

                        Oh Shit this is a VM…  Dude you need to say that in your FIRST POST!!!

                        What are you settings in vmware.. And your using usb nics... JFC yeah that is going to be smooth freaking sailing.. rolleyes..

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                        1 Reply Last reply Reply Quote 0
                        • P
                          PFbest last edited by

                          @johnpoz:

                          Ok you changed the native untagged on the ports.  But why do you have vlan 1 tagged on port 7 if all your doing is plugging in a computer?

                          Oh Shit this is a VM…  Dude you need to say that in your FIRST POST!!!

                          What are you settings in vmware.. And your using usb nics... JFC yeah that is going to be smooth freaking sailing.. rolleyes..

                          Do you mean why port 1 is tagged on vlan 12?
                          Because DHCP is enabled on pfsense and pfsense is the main router and firewall, so PC on port 7 need to communicate with it. Also port 7 will be used for access point later, after at least I figure out the PC first, otherwise the AP will not work as expected I guess.

                          Or do you mean, port 7 is tagged on vlan 1? port 7 already removed from vlan 1 as you can see.

                          Yes, Sorry mate, I will mention that in first post next time  ;) I know it is crazy, but I have limited resources, the host is a Windows 2012 R2, on a laptop, now more crazy I know.
                          USB NIC are configured dedicated for pfsense in the VM, only VM service is checked in the property page, not used by host. Also I've selected vlan disabled for that USB nic on host, so vlan tag will not be stripped (Enable vlan for USB NIC on host will strip it, I tested) so now vlan tag seems works, otherwise VOIP phone will not ring when calls incoming.
                          Um, what else, USB NIC for VM is set to bridge.
                          Other parts are working fine, it sit like that for 2 years.
                          It's just vlan, which I want to add now, having some issues.

                          And yes, I can see it's going to be JFC, smooth freaking sailing.. rolleyes.. etc. etc….

                          Thanks again for still replying me, even you know it's crazy  :P

                          1 Reply Last reply Reply Quote 0
                          • johnpoz
                            johnpoz LAYER 8 Global Moderator last edited by

                            Ok upon looking at it again, your ok with the new pointing 12 is untagged on 7, and tagged on port 1.

                            PC connected on port 7 gets IP in vlan 12 from pfsense dhcp - right?  It can ping pfsense IP in vlan 12? It can get to internet?

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                            1 Reply Last reply Reply Quote 0
                            • P
                              PFbest last edited by

                              Oh, finally you are here, seems we have time difference, I've been waiting for you for whole day haha  ;D
                              You are my a life-saving straw  ;D ;D
                              Let me confirm right now

                              1 Reply Last reply Reply Quote 0
                              • johnpoz
                                johnpoz LAYER 8 Global Moderator last edited by

                                Yeah I am in chicagoland, just woke up bit ago.. I am a early riser.. Is before 7am here..

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                                1 Reply Last reply Reply Quote 0
                                • P
                                  PFbest last edited by

                                  @johnpoz:

                                  Ok upon looking at it again, your ok with the new pointing 12 is untagged on 7, and tagged on port 1.

                                  PC connected on port 7 gets IP in vlan 12 from pfsense dhcp - right?  It can ping pfsense IP in vlan 12? It can get to internet?

                                  Yep, For VLAN 12, port 1 (pfsense) tagged, port 7 (only 1 PC) untagged. Yep the PC get IP from pfsense DHCP with no problem.
                                  Yep, PC can ping pfsense IP in vlan 12.
                                  Yep, this PC can get to internet.

                                  Extra detail: if required:
                                  Real LAN/or native vlan if that's how we should call it. pfsense IP: 192.168.0.1
                                  vlan 12, pfsense IP: 192.168.3.1
                                  PC IP from dhcp (currently): 192.168.3.10
                                  (vlan 11 voip, pfsense IP 192.168.2.1, voip box 192.168.2.2)

                                  Ping results:
                                  PC (192.168.3.10) <-> LAN, pfsense (192.168.0.1)        OK
                                  PC (192.168.3.10) <-> LAN, PC (192.168.0.101)            OK
                                  PC (192.168.3.10) <-> vlan 11, pfsense (192.168.2.1)  OK
                                  PC (192.168.3.10) <-> vlan 11, voip box (192.168.2.2) OK
                                  PC (192.168.3.10) <-> vlan 12, pfsense (192.168.3.1)  OK
                                  PC (192.168.3.10) <-> google.com                                OK
                                  PC(192.168.0.101) <-> PC (192.168.3.10)                    OK
                                  PC(192.168.0.101) <-> vlan 12, pfsense (192.168.3.1) OK

                                  1 Reply Last reply Reply Quote 0
                                  • P
                                    PFbest last edited by

                                    @johnpoz:

                                    Yeah I am in chicagoland, just woke up bit ago.. I am a early riser.. Is before 7am here..

                                    Oh that's why, I'm in AU  ;)
                                    Nice to meet you! (on internet)

                                    *Hand shaking icon should be inserted here  ;)

                                    Oh, and thanks you are still with me!!

                                    (early bird gets juicy worms, good to hear that  ;), and you are so kind BTW  ;D)
                                    It's 9:55 PM here haha

                                    Heaps thanks!! :D

                                    1 Reply Last reply Reply Quote 0
                                    • johnpoz
                                      johnpoz LAYER 8 Global Moderator last edited by

                                      Well everything looks fine there..  Your issue is you can not get to web gui on 192.168.0.1?  But you can get to it on 192.168.3.1?

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                                      1 Reply Last reply Reply Quote 0
                                      • P
                                        PFbest last edited by

                                        Yep, It's looking good to me as well, that's why I feel so lost.
                                        From the PC on port 7, it can't open 192.168.0.1, or 192.168.3.1 or 192.168.2.1 at all, but ping to those IP works.
                                        But from the laptop I'm using (IP is 192.168.0.75,  in default/native vlan or real LAN) I can go to 192.168.0.1, or 192.168.3.1 or 192.168.2.1 with no problem.

                                        1 Reply Last reply Reply Quote 0
                                        • P
                                          PFbest last edited by

                                          Also I've searched on google a lot.
                                          I found this one http://superuser.com/questions/753472/pfsense-to-route-between-multiple-subnets-on-same-lan
                                          Which some what looks similar to my situation I think.

                                          I tried the solution in answer, still the same result

                                          1 Reply Last reply Reply Quote 0
                                          • johnpoz
                                            johnpoz LAYER 8 Global Moderator last edited by

                                            So I have multiple vlans..  Comes down to your rules be it you can access or not..

                                            So see attached, on my wifi segment I can access gui on both my wlan pfsense IP, and my pfsense Lan IP..  This is because I have a specific rule for my ipad to go anywhere.  If I try it from my wifes laptop the block all to firewall ips block it, etc.

                                            Do you have any floating rules that would block this - that would be my guess!!


                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                                            1 Reply Last reply Reply Quote 0
                                            • johnpoz
                                              johnpoz LAYER 8 Global Moderator last edited by

                                              My the way that link is not something I would ever suggest anyone should ever be in.. He is running 2 layer 3 networks over the same layer 2.. That is BROKEN no matter how you look at it.. Period, your not in that sort of setup..

                                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                                              If you get confused: Listen to the Music Play
                                              Please don't Chat/PM me for help, unless mod related
                                              2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                                              1 Reply Last reply Reply Quote 0
                                              • P
                                                PFbest last edited by

                                                @johnpoz:

                                                My the way that link is not something I would ever suggest anyone should ever be in.. He is running 2 layer 3 networks over the same layer 2.. That is BROKEN no matter how you look at it.. Period, your not in that sort of setup..

                                                Yep, cool, I don't have layer 3 switch
                                                Thanks for confirming!

                                                1 Reply Last reply Reply Quote 0
                                                • P
                                                  PFbest last edited by

                                                  @johnpoz:

                                                  So I have multiple vlans..  Comes down to your rules be it you can access or not..

                                                  So see attached, on my wifi segment I can access gui on both my wlan pfsense IP, and my pfsense Lan IP..  This is because I have a specific rule for my ipad to go anywhere.  If I try it from my wifes laptop the block all to firewall ips block it, etc.

                                                  Do you have any floating rules that would block this - that would be my guess!!

                                                  My floating rules is not blocking anything I guess?
                                                  I've attached as image.






                                                  1 Reply Last reply Reply Quote 0
                                                  • johnpoz
                                                    johnpoz LAYER 8 Global Moderator last edited by

                                                    Not sure what you thought that article had to do with a layer 3 switch.. That idiot was running 2 different networks on the same layer 2 with just trying to put a vip on the interface in the other network..

                                                    Ok you sure your just not having a problem accessing the web gui from this client, something wrong with its browser, the cert you have on the gui, you runnint it on some odd port?  You using a proxy on this client?  Do you have transparent proxy setup on psfense?

                                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                                    If you get confused: Listen to the Music Play
                                                    Please don't Chat/PM me for help, unless mod related
                                                    2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                                                    1 Reply Last reply Reply Quote 0
                                                    • P
                                                      PFbest last edited by

                                                      @johnpoz:

                                                      Not sure what you thought that article had to do with a layer 3 switch.. That idiot was running 2 different networks on the same layer 2 with just trying to put a vip on the interface in the other network..

                                                      Ok you sure your just not having a problem accessing the web gui from this client, something wrong with its browser, the cert you have on the gui, you runnint it on some odd port?  You using a proxy on this client?  Do you have transparent proxy setup on psfense?

                                                      Ok, forget about the link haha  ;D
                                                      Um, client should be fine I think, previously I tried on physical laptop, now I'm using windows in my VM workstation in my laptop.
                                                      (I passed the same module of USB nic directly to this VM, so eliminate bridge/NAT etc.)
                                                      But same results anyway. Can't access to web gui but no problem to ping.
                                                      Actually I do have proxy on 192.168.0.102 (I promise I eliminated proxy), but I did not use the proxy for testing web gui. (BTW, 192.168.3.1 can't access proxy as well, but it can access 192.168.101, I guess it's the iptable's problem) (Again, browsers are setted to not using proxy, not even auto proxy) (It's not transparent as well, so should be fine I think)
                                                      Now the pfsense cert part, it's the default one comes with pfsense, so it's invalid, I used it for 2 years, just click ignore in browser you know. (Will that be problem??  :o)
                                                      Odd port? Um, shouldn't be I think. all things should be normal I guess.
                                                      No transparent proxy, and in pfsense there's no proxy at all  :P (squid is not installed on pfsense and pfsense is not using proxy from 192.168.0.102)

                                                      1 Reply Last reply Reply Quote 0
                                                      • P
                                                        PFbest last edited by

                                                        Also this is what I get when I hit enter key in browser url input filed.
                                                        (url is https://192.168.3.1)
                                                        (Two times)




                                                        1 Reply Last reply Reply Quote 0
                                                        • P
                                                          PFbest last edited by

                                                          from 192.168.0.74
                                                          (ignore cert error already clicked)


                                                          1 Reply Last reply Reply Quote 0
                                                          • johnpoz
                                                            johnpoz LAYER 8 Global Moderator last edited by

                                                            looks like your seeing dup.. I would turn off https for testing.. And then can you post up the actual pcap so I can open it in wireshark.

                                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                                            If you get confused: Listen to the Music Play
                                                            Please don't Chat/PM me for help, unless mod related
                                                            2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                                                            1 Reply Last reply Reply Quote 0
                                                            • P
                                                              PFbest last edited by

                                                              Not a problem.
                                                              I'm on it.
                                                              Heaps thanks man!!!!

                                                              1 Reply Last reply Reply Quote 0
                                                              • P
                                                                PFbest last edited by

                                                                This is the pcap from PC on port 7.
                                                                (The icon on browser tab just turning and turning, no pfsense page title showing, weird thing is it's not like when we don't have internet, it will show you error page directly.)
                                                                Eventually the browser will show ERR_TIMED_OUT.
                                                                (For this pcap, I didn't wait untill the browser come up with that error, it's going to be long)
                                                                I I just start wireshark, put address in browser hit enter, wait 5/10 seconds, then save the pcap.
                                                                If wait until the error shows up will help I can do that, just say it.
                                                                (Also I tried to connect to 192.168.3.1, and 192.168.0.1)
                                                                (Last thing, https turned off in this pcap)
                                                                Thank you!!!

                                                                [PC on port 7, 192.168.3.10.pcap](/public/imported_attachments/1/PC on port 7, 192.168.3.10.pcap)

                                                                1 Reply Last reply Reply Quote 0
                                                                • johnpoz
                                                                  johnpoz LAYER 8 Global Moderator last edited by

                                                                  ok just started looking at it, but why your browser try so many connections at the same time?? to 443?

                                                                  What browser are you using?

                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36


                                                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                                                  If you get confused: Listen to the Music Play
                                                                  Please don't Chat/PM me for help, unless mod related
                                                                  2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                                                                  1 Reply Last reply Reply Quote 0
                                                                  • P
                                                                    PFbest last edited by

                                                                    Thanks man!
                                                                    It's chrome, google chrome  :o
                                                                    And yes, that's exactly the user-agent string for chrome 50.0.2661.102 m

                                                                    1 Reply Last reply Reply Quote 0
                                                                    • P
                                                                      PFbest last edited by

                                                                      It's late night here, I need to go to bed, sorry  :-.
                                                                      I will back here tomorrow, many thanks to you!!!!

                                                                      1 Reply Last reply Reply Quote 0
                                                                      • P
                                                                        PFbest last edited by

                                                                        Oh, another weird thing is
                                                                        If I do nslookup google.com 192.168.0.1 or nslookup google.com 192.168.3.1 nslookup google.com 192.168.0.101
                                                                        They all work.

                                                                        1 Reply Last reply Reply Quote 0
                                                                        • P
                                                                          PFbest last edited by

                                                                          Another finding:
                                                                          On the pc on port 7
                                                                          If I do telnet 192.168.0.1 80 or telnet 192.168.3.1 80
                                                                          as you see in p1, it seems I can get reply.
                                                                          If I do telnet 192.168.100.1 80, it will fail, of course 192.168.100.1 does not exist on my network.




                                                                          1 Reply Last reply Reply Quote 0
                                                                          • P
                                                                            PFbest last edited by

                                                                            More finding
                                                                            If I set rules in firewall for GUEST_AP_VL like this.

                                                                            reject GUEST_AP_VL net to any destination any port.

                                                                            I try to open 192.168.0.1 and 192.168.3.1 in PC on port 7, the browser returns ERR_CONNECTION_REFUSED, which is right.

                                                                            Any ideas?  ??? ??? ???

                                                                            1 Reply Last reply Reply Quote 0
                                                                            • P
                                                                              PFbest last edited by

                                                                              Interesting, I think I've found problem.
                                                                              I changed the MTU for vlan 12 to 1492. (My adsl MTU is 1492, but I don't understand why vlan MTU is related to gateway/ADSL MTU) (By default MTU it set to 1500)
                                                                              But it works now. As long as I change the MTU to 1492, pc on part 7 can go to 192.168.0.1, 192.168.3.1, 192.168.2.1, eben with https on for pfsense web gui, it works.
                                                                              Would you mind to confirm your MTU on vlans and your gateway for me and other on this forum please? So other won't get stuck like me  ;D
                                                                              Now I can move on on other rules etc. :P

                                                                              Your effort, help and time is appreciated!!

                                                                              Thank you johnpoz!!!

                                                                              1 Reply Last reply Reply Quote 0
                                                                              • K
                                                                                kpa last edited by

                                                                                I bet this has something to with the USB nics you're using, there's a reason why pros avoid them at all costs.

                                                                                1 Reply Last reply Reply Quote 0
                                                                                • P
                                                                                  PFbest last edited by

                                                                                  @kpa:

                                                                                  I bet this has something to with the USB nics you're using, there's a reason why pros avoid them at all costs.

                                                                                  You mean the MTU issue is caused by USB NIC?
                                                                                  Well, pros would have proper server, rack, UPS etc. don't they  8)
                                                                                  I'm still study though, but I would go PRO stuff if I have the money to buy and can afford bills etc. for sure  :D
                                                                                  That's the dream of every or at least most of the tech savvies isn't it  ;)

                                                                                  1 Reply Last reply Reply Quote 0
                                                                                  • johnpoz
                                                                                    johnpoz LAYER 8 Global Moderator last edited by

                                                                                    My mtu is 1500.. on all devices.

                                                                                    There clearly was something going on in your trace.. Its like you just lost connection packets, possible it could of been large packet that got fragged..

                                                                                    USB interfaces are utter crap, why would you use them, you can pick up normal nics for like $10 that would be better than some usb nic.

                                                                                    Glad you got it sorted, for sure it was strange.  But you can see in your sniff that your client is talking, you have a good handshake but when then its like something was missing.. And that packet you did get was not the next one..

                                                                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                                                                    If you get confused: Listen to the Music Play
                                                                                    Please don't Chat/PM me for help, unless mod related
                                                                                    2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                                                                                    1 Reply Last reply Reply Quote 0
                                                                                    • First post
                                                                                      Last post