Can't access pfsense web GUI from VLANs [Solved]
-
Hi all,
Anyone can help me to resolve this issue?
PCs in VLAN can get internet access, they can ping pfsense LAN IP (parent interface).
But can't access the web GUI of pfsense from VLANsLAN/pfsense: 192.168.0.1 192.168.0.0/24
VLAN/pfsense: 192.168.3.1 192.168.3.0/24
PC: 192.168.3.10/24PC <- http/https -> Google OK
PC <- ping -> LAN OK
PC <- http/https -> LAN/pfsense Can't access, ERR_TIMED_OUTAny help will be appreciated!!!
Thank you!
-
"PC: 192.168.3.10/32"
You have your pcs set with a 32 bit mask??
What are the firewall rules you have on your vlan interface?
-
"PC: 192.168.3.10/32"
You have your pcs set with a 32 bit mask??
What are the firewall rules you have on your vlan interface?
Sorry that was wrong, 192.168.3.10/24
For vlan, rules are all like, IPv4* * * * * *, so yea, shouldn't have any limits isn't it ???
-
vs saying they are all like and then some *, if you have a rule that is any any, where does that rule sit in the list?
With your statement rules are "all" like I am thinking there is more than one. So rules are evaluated top down first rule to trigger wins. So its quite possible that even if you have any any rule at the bottom that some rule blocks access above that.
How about a simple post of the rules and we can take a look see if there is anything there that could be causing your problem.
-
Sure thing!
(Default vlan is not been used, or tested currently, can be ignored)
PC is in guest vlan
voip vlan works fine, it only needs to connect to internet, not much to do with that.
-
for SW
ID
01: all untagged
11 (voip): 01 tagged, 04 untagged
12 (guest): 01 tagged, 07 untagged -
So pfsense is connected to your switch on port 1
On this port you have vlan 1 as native untagged. Ok then all your other vlans are tagged.. Ok that makes sense.
Then on port your AP is plugged into?? Port 7 vlan 12 is untagged.
Ok that is fine if all traffic on your AP is on one vlan and no SSID based vlans being used.
So this client that can not get to pfsense web interface is wifi, and you say it can ping pfsense lan. But not access its gui. Is this client using a proxy? Can it access the gui via the IP in that network.
Not quite understanding your switch setup.
So you say vlan 1 is untagged on all ports? But vlan 12 is also untaged on port 7? So port 7 as untagged vlan 1 and vlan 12 ??? That is broke!
So Pfsense gui listens on all interfaces.. It just has lock out rule on lan interface. But I for example can hit my wlan pfsense IP 192.168.2.253 from my lan network 192.168.9.0/24 because I do not block that traffic. But from say my wifi network I can not get to any web gui on pfsense on any IP because I specifically block that.
I think you have some problem in your switch configs and how your vlans are tagged and untagged.
A port should only have 1 native (untagged) vlan on it..
So as you see I can access my web gui on any vlan IP address, from my lan network.
-
Yep, I created a basic layout image, with only related stuff in it.
You are so experiences! :o Most parts you presumed are right!Then on port your AP is plugged into?? Port 7 vlan 12 is untagged.
Yes, I'm going to put AP on port 7 once all the VLAN thing working as desired (After I get the console for the AP) AP will be capable for SSID/VLAN stuff i guess, so I will change port7 to tagged once AP is connected.
So currently port 7 is directly connected to a PC, for testing VLAN, and is untagged.So this client that can not get to pfsense web interface is wifi, and you say it can ping pfsense lan. But not access its gui. Is this client using a proxy? Can it access the gui via the IP in that network.
Yep it can't access pfsense web interface (via CAT6 directly connected to switch port 7) (PC IP:192.168.3.10). Yes it can ping the pfsense LAN ip (192.168.0.1) and any devices within LAN (e.g. 192.168.0.101, 192.168.0.102 etc.), can ping VLAN 11 and anything within that VLAN (192.168.2.1) VOIP box (192.168.2.2), can ping VLAN 12 (192.168.3.1).
So you say vlan 1 is untagged on all ports? But vlan 12 is also untaged on port 7? So port 7 as untagged vlan 1 and vlan 12 ??? That is broke!
I was fiddling around, previously port 7 was not in that VLAN as untagged, anyway, now it's removed, you can see from the new image :) Now looking more right I guess.
So Pfsense gui listens on all interfaces.. It just has lock out rule on lan interface. But I for example can hit my wlan pfsense IP 192.168.2.253 from my lan network 192.168.9.0/24 because I do not block that traffic. But from say my wifi network I can not get to any web gui on pfsense on any IP because I specifically block that.
Yep and that is exactly what I want to achieve.
But currently it seems interesting, and I have spent two days on this and still have no idea how to resolve it.I think you have some problem in your switch configs and how your vlans are tagged and untagged.
Will those images be helpful?
It's a smart switch, not layer 3, so i guess there's not too much I can mess around :P (Netgear JGS524E-v2, if that helps ;D)A port should only have 1 native (untagged) vlan on it..
Yep, as you said, I just did it, removed port 7 and port 4 from VLAN 1
So as you see I can access my web gui on any vlan IP address, from my lan network.
Yep That's what I want to see, and currently I can't figure out why it's not doing it :-[
Thank you very much for your time to the reply!
And thank you for your patience for reading this one.(I'm new to VLAN stuff, So I can go wrong with some basic things like one port tagged twice for troubleshooting, which probably can bring more trouble actually :P :P :P )
-
I found one interesting thing is.
You know the VOIP gateway is connected to switch, on port 4, vlan 11.
If I connect my pc to that gateway, LAN port, I can access 192.168.0.1 (pfsense LAN, web gui)
But if I connect my pc directly to port 4, I can't access 192.168.0.1 then, ping is fine.Anyone know why and how to resolve this?
Thanks
-
Ok you changed the native untagged on the ports. But why do you have vlan 1 tagged on port 7 if all your doing is plugging in a computer?
Oh Shit this is a VM… Dude you need to say that in your FIRST POST!!!
What are you settings in vmware.. And your using usb nics... JFC yeah that is going to be smooth freaking sailing.. rolleyes..
-
Ok you changed the native untagged on the ports. But why do you have vlan 1 tagged on port 7 if all your doing is plugging in a computer?
Oh Shit this is a VM… Dude you need to say that in your FIRST POST!!!
What are you settings in vmware.. And your using usb nics... JFC yeah that is going to be smooth freaking sailing.. rolleyes..
Do you mean why port 1 is tagged on vlan 12?
Because DHCP is enabled on pfsense and pfsense is the main router and firewall, so PC on port 7 need to communicate with it. Also port 7 will be used for access point later, after at least I figure out the PC first, otherwise the AP will not work as expected I guess.Or do you mean, port 7 is tagged on vlan 1? port 7 already removed from vlan 1 as you can see.
Yes, Sorry mate, I will mention that in first post next time ;) I know it is crazy, but I have limited resources, the host is a Windows 2012 R2, on a laptop, now more crazy I know.
USB NIC are configured dedicated for pfsense in the VM, only VM service is checked in the property page, not used by host. Also I've selected vlan disabled for that USB nic on host, so vlan tag will not be stripped (Enable vlan for USB NIC on host will strip it, I tested) so now vlan tag seems works, otherwise VOIP phone will not ring when calls incoming.
Um, what else, USB NIC for VM is set to bridge.
Other parts are working fine, it sit like that for 2 years.
It's just vlan, which I want to add now, having some issues.And yes, I can see it's going to be JFC, smooth freaking sailing.. rolleyes.. etc. etc….
Thanks again for still replying me, even you know it's crazy :P
-
Ok upon looking at it again, your ok with the new pointing 12 is untagged on 7, and tagged on port 1.
PC connected on port 7 gets IP in vlan 12 from pfsense dhcp - right? It can ping pfsense IP in vlan 12? It can get to internet?
-
Oh, finally you are here, seems we have time difference, I've been waiting for you for whole day haha ;D
You are my a life-saving straw ;D ;D
Let me confirm right now -
Yeah I am in chicagoland, just woke up bit ago.. I am a early riser.. Is before 7am here..
-
Ok upon looking at it again, your ok with the new pointing 12 is untagged on 7, and tagged on port 1.
PC connected on port 7 gets IP in vlan 12 from pfsense dhcp - right? It can ping pfsense IP in vlan 12? It can get to internet?
Yep, For VLAN 12, port 1 (pfsense) tagged, port 7 (only 1 PC) untagged. Yep the PC get IP from pfsense DHCP with no problem.
Yep, PC can ping pfsense IP in vlan 12.
Yep, this PC can get to internet.Extra detail: if required:
Real LAN/or native vlan if that's how we should call it. pfsense IP: 192.168.0.1
vlan 12, pfsense IP: 192.168.3.1
PC IP from dhcp (currently): 192.168.3.10
(vlan 11 voip, pfsense IP 192.168.2.1, voip box 192.168.2.2)Ping results:
PC (192.168.3.10) <-> LAN, pfsense (192.168.0.1) OK
PC (192.168.3.10) <-> LAN, PC (192.168.0.101) OK
PC (192.168.3.10) <-> vlan 11, pfsense (192.168.2.1) OK
PC (192.168.3.10) <-> vlan 11, voip box (192.168.2.2) OK
PC (192.168.3.10) <-> vlan 12, pfsense (192.168.3.1) OK
PC (192.168.3.10) <-> google.com OK
PC(192.168.0.101) <-> PC (192.168.3.10) OK
PC(192.168.0.101) <-> vlan 12, pfsense (192.168.3.1) OK -
Yeah I am in chicagoland, just woke up bit ago.. I am a early riser.. Is before 7am here..
Oh that's why, I'm in AU ;)
Nice to meet you! (on internet)*Hand shaking icon should be inserted here ;)
Oh, and thanks you are still with me!!
(early bird gets juicy worms, good to hear that ;), and you are so kind BTW ;D)
It's 9:55 PM here hahaHeaps thanks!! :D
-
Well everything looks fine there.. Your issue is you can not get to web gui on 192.168.0.1? But you can get to it on 192.168.3.1?
-
Yep, It's looking good to me as well, that's why I feel so lost.
From the PC on port 7, it can't open 192.168.0.1, or 192.168.3.1 or 192.168.2.1 at all, but ping to those IP works.
But from the laptop I'm using (IP is 192.168.0.75, in default/native vlan or real LAN) I can go to 192.168.0.1, or 192.168.3.1 or 192.168.2.1 with no problem. -
Also I've searched on google a lot.
I found this one http://superuser.com/questions/753472/pfsense-to-route-between-multiple-subnets-on-same-lan
Which some what looks similar to my situation I think.I tried the solution in answer, still the same result
-
So I have multiple vlans.. Comes down to your rules be it you can access or not..
So see attached, on my wifi segment I can access gui on both my wlan pfsense IP, and my pfsense Lan IP.. This is because I have a specific rule for my ipad to go anywhere. If I try it from my wifes laptop the block all to firewall ips block it, etc.
Do you have any floating rules that would block this - that would be my guess!!
-
My the way that link is not something I would ever suggest anyone should ever be in.. He is running 2 layer 3 networks over the same layer 2.. That is BROKEN no matter how you look at it.. Period, your not in that sort of setup..
-
My the way that link is not something I would ever suggest anyone should ever be in.. He is running 2 layer 3 networks over the same layer 2.. That is BROKEN no matter how you look at it.. Period, your not in that sort of setup..
Yep, cool, I don't have layer 3 switch
Thanks for confirming! -
So I have multiple vlans.. Comes down to your rules be it you can access or not..
So see attached, on my wifi segment I can access gui on both my wlan pfsense IP, and my pfsense Lan IP.. This is because I have a specific rule for my ipad to go anywhere. If I try it from my wifes laptop the block all to firewall ips block it, etc.
Do you have any floating rules that would block this - that would be my guess!!
My floating rules is not blocking anything I guess?
I've attached as image.
-
Not sure what you thought that article had to do with a layer 3 switch.. That idiot was running 2 different networks on the same layer 2 with just trying to put a vip on the interface in the other network..
Ok you sure your just not having a problem accessing the web gui from this client, something wrong with its browser, the cert you have on the gui, you runnint it on some odd port? You using a proxy on this client? Do you have transparent proxy setup on psfense?
-
Not sure what you thought that article had to do with a layer 3 switch.. That idiot was running 2 different networks on the same layer 2 with just trying to put a vip on the interface in the other network..
Ok you sure your just not having a problem accessing the web gui from this client, something wrong with its browser, the cert you have on the gui, you runnint it on some odd port? You using a proxy on this client? Do you have transparent proxy setup on psfense?
Ok, forget about the link haha ;D
Um, client should be fine I think, previously I tried on physical laptop, now I'm using windows in my VM workstation in my laptop.
(I passed the same module of USB nic directly to this VM, so eliminate bridge/NAT etc.)
But same results anyway. Can't access to web gui but no problem to ping.
Actually I do have proxy on 192.168.0.102 (I promise I eliminated proxy), but I did not use the proxy for testing web gui. (BTW, 192.168.3.1 can't access proxy as well, but it can access 192.168.101, I guess it's the iptable's problem) (Again, browsers are setted to not using proxy, not even auto proxy) (It's not transparent as well, so should be fine I think)
Now the pfsense cert part, it's the default one comes with pfsense, so it's invalid, I used it for 2 years, just click ignore in browser you know. (Will that be problem?? :o)
Odd port? Um, shouldn't be I think. all things should be normal I guess.
No transparent proxy, and in pfsense there's no proxy at all :P (squid is not installed on pfsense and pfsense is not using proxy from 192.168.0.102) -
Also this is what I get when I hit enter key in browser url input filed.
(url is https://192.168.3.1)
(Two times)
-
from 192.168.0.74
(ignore cert error already clicked)
-
looks like your seeing dup.. I would turn off https for testing.. And then can you post up the actual pcap so I can open it in wireshark.
-
Not a problem.
I'm on it.
Heaps thanks man!!!! -
This is the pcap from PC on port 7.
(The icon on browser tab just turning and turning, no pfsense page title showing, weird thing is it's not like when we don't have internet, it will show you error page directly.)
Eventually the browser will show ERR_TIMED_OUT.
(For this pcap, I didn't wait untill the browser come up with that error, it's going to be long)
I I just start wireshark, put address in browser hit enter, wait 5/10 seconds, then save the pcap.
If wait until the error shows up will help I can do that, just say it.
(Also I tried to connect to 192.168.3.1, and 192.168.0.1)
(Last thing, https turned off in this pcap)
Thank you!!
-
ok just started looking at it, but why your browser try so many connections at the same time?? to 443?
What browser are you using?
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
-
Thanks man!
It's chrome, google chrome :o
And yes, that's exactly the user-agent string for chrome 50.0.2661.102 m -
It's late night here, I need to go to bed, sorry :-.
I will back here tomorrow, many thanks to you!!!! -
Oh, another weird thing is
If I do nslookup google.com 192.168.0.1 or nslookup google.com 192.168.3.1 nslookup google.com 192.168.0.101
They all work. -
Another finding:
On the pc on port 7
If I do telnet 192.168.0.1 80 or telnet 192.168.3.1 80
as you see in p1, it seems I can get reply.
If I do telnet 192.168.100.1 80, it will fail, of course 192.168.100.1 does not exist on my network.
-
More finding
If I set rules in firewall for GUEST_AP_VL like this.reject GUEST_AP_VL net to any destination any port.
I try to open 192.168.0.1 and 192.168.3.1 in PC on port 7, the browser returns ERR_CONNECTION_REFUSED, which is right.
Any ideas? ??? ??? ???
-
Interesting, I think I've found problem.
I changed the MTU for vlan 12 to 1492. (My adsl MTU is 1492, but I don't understand why vlan MTU is related to gateway/ADSL MTU) (By default MTU it set to 1500)
But it works now. As long as I change the MTU to 1492, pc on part 7 can go to 192.168.0.1, 192.168.3.1, 192.168.2.1, eben with https on for pfsense web gui, it works.
Would you mind to confirm your MTU on vlans and your gateway for me and other on this forum please? So other won't get stuck like me ;D
Now I can move on on other rules etc. :PYour effort, help and time is appreciated!!
Thank you johnpoz!!!
-
I bet this has something to with the USB nics you're using, there's a reason why pros avoid them at all costs.
-
@kpa:
I bet this has something to with the USB nics you're using, there's a reason why pros avoid them at all costs.
You mean the MTU issue is caused by USB NIC?
Well, pros would have proper server, rack, UPS etc. don't they 8)
I'm still study though, but I would go PRO stuff if I have the money to buy and can afford bills etc. for sure :D
That's the dream of every or at least most of the tech savvies isn't it ;) -
My mtu is 1500.. on all devices.
There clearly was something going on in your trace.. Its like you just lost connection packets, possible it could of been large packet that got fragged..
USB interfaces are utter crap, why would you use them, you can pick up normal nics for like $10 that would be better than some usb nic.
Glad you got it sorted, for sure it was strange. But you can see in your sniff that your client is talking, you have a good handshake but when then its like something was missing.. And that packet you did get was not the next one..
