Can't access pfsense web GUI from VLANs [Solved]

johnpoz · May 27, 2016, 6:17 PM

"PC: 192.168.3.10/32"

You have your pcs set with a 32 bit mask??

What are the firewall rules you have on your vlan interface?

PFbest · May 27, 2016, 6:34 PM

"PC: 192.168.3.10/32"

You have your pcs set with a 32 bit mask??

What are the firewall rules you have on your vlan interface?

Sorry that was wrong, 192.168.3.10/24

For vlan, rules are all like, IPv4* * * * * *, so yea, shouldn't have any limits isn't it ???

johnpoz · May 27, 2016, 6:40 PM

vs saying they are all like and then some *, if you have a rule that is any any, where does that rule sit in the list?

With your statement rules are "all" like I am thinking there is more than one. So rules are evaluated top down first rule to trigger wins. So its quite possible that even if you have any any rule at the bottom that some rule blocks access above that.

How about a simple post of the rules and we can take a look see if there is anything there that could be causing your problem.

PFbest · May 27, 2016, 6:50 PM

Sure thing!

(Default vlan is not been used, or tested currently, can be ignored)
PC is in guest vlan
voip vlan works fine, it only needs to connect to internet, not much to do with that.

PFbest · May 27, 2016, 6:56 PM

for SW
ID
01: all untagged
11 (voip): 01 tagged, 04 untagged
12 (guest): 01 tagged, 07 untagged

johnpoz · May 27, 2016, 7:35 PM

So pfsense is connected to your switch on port 1

On this port you have vlan 1 as native untagged. Ok then all your other vlans are tagged.. Ok that makes sense.

Then on port your AP is plugged into?? Port 7 vlan 12 is untagged.

Ok that is fine if all traffic on your AP is on one vlan and no SSID based vlans being used.

So this client that can not get to pfsense web interface is wifi, and you say it can ping pfsense lan. But not access its gui. Is this client using a proxy? Can it access the gui via the IP in that network.

Not quite understanding your switch setup.

So you say vlan 1 is untagged on all ports? But vlan 12 is also untaged on port 7? So port 7 as untagged vlan 1 and vlan 12 ??? That is broke!

So Pfsense gui listens on all interfaces.. It just has lock out rule on lan interface. But I for example can hit my wlan pfsense IP 192.168.2.253 from my lan network 192.168.9.0/24 because I do not block that traffic. But from say my wifi network I can not get to any web gui on pfsense on any IP because I specifically block that.

I think you have some problem in your switch configs and how your vlans are tagged and untagged.

A port should only have 1 native (untagged) vlan on it..

So as you see I can access my web gui on any vlan IP address, from my lan network.

PFbest · May 28, 2016, 2:43 AM

Yep, I created a basic layout image, with only related stuff in it.
You are so experiences! :o Most parts you presumed are right!

Then on port your AP is plugged into?? Port 7 vlan 12 is untagged.

Yes, I'm going to put AP on port 7 once all the VLAN thing working as desired (After I get the console for the AP) AP will be capable for SSID/VLAN stuff i guess, so I will change port7 to tagged once AP is connected.
So currently port 7 is directly connected to a PC, for testing VLAN, and is untagged.

So this client that can not get to pfsense web interface is wifi, and you say it can ping pfsense lan. But not access its gui. Is this client using a proxy? Can it access the gui via the IP in that network.

Yep it can't access pfsense web interface (via CAT6 directly connected to switch port 7) (PC IP:192.168.3.10). Yes it can ping the pfsense LAN ip (192.168.0.1) and any devices within LAN (e.g. 192.168.0.101, 192.168.0.102 etc.), can ping VLAN 11 and anything within that VLAN (192.168.2.1) VOIP box (192.168.2.2), can ping VLAN 12 (192.168.3.1).

So you say vlan 1 is untagged on all ports? But vlan 12 is also untaged on port 7? So port 7 as untagged vlan 1 and vlan 12 ??? That is broke!

I was fiddling around, previously port 7 was not in that VLAN as untagged, anyway, now it's removed, you can see from the new image :) Now looking more right I guess.

So Pfsense gui listens on all interfaces.. It just has lock out rule on lan interface. But I for example can hit my wlan pfsense IP 192.168.2.253 from my lan network 192.168.9.0/24 because I do not block that traffic. But from say my wifi network I can not get to any web gui on pfsense on any IP because I specifically block that.

Yep and that is exactly what I want to achieve.
But currently it seems interesting, and I have spent two days on this and still have no idea how to resolve it.

I think you have some problem in your switch configs and how your vlans are tagged and untagged.

Will those images be helpful?
It's a smart switch, not layer 3, so i guess there's not too much I can mess around :P (Netgear JGS524E-v2, if that helps ;D)

A port should only have 1 native (untagged) vlan on it..

Yep, as you said, I just did it, removed port 7 and port 4 from VLAN 1

So as you see I can access my web gui on any vlan IP address, from my lan network.

Yep That's what I want to see, and currently I can't figure out why it's not doing it :-[

Thank you very much for your time to the reply!
And thank you for your patience for reading this one.

(I'm new to VLAN stuff, So I can go wrong with some basic things like one port tagged twice for troubleshooting, which probably can bring more trouble actually :P :P :P )

PFbest · May 28, 2016, 1:56 PM

I found one interesting thing is.
You know the VOIP gateway is connected to switch, on port 4, vlan 11.
If I connect my pc to that gateway, LAN port, I can access 192.168.0.1 (pfsense LAN, web gui)
But if I connect my pc directly to port 4, I can't access 192.168.0.1 then, ping is fine.

Anyone know why and how to resolve this?

Thanks

johnpoz · May 28, 2016, 2:12 PM

Ok you changed the native untagged on the ports. But why do you have vlan 1 tagged on port 7 if all your doing is plugging in a computer?

Oh Shit this is a VM… Dude you need to say that in your FIRST POST!!!

What are you settings in vmware.. And your using usb nics... JFC yeah that is going to be smooth freaking sailing.. rolleyes..

PFbest · May 29, 2016, 3:55 AM

@johnpoz:

Ok you changed the native untagged on the ports. But why do you have vlan 1 tagged on port 7 if all your doing is plugging in a computer?

Oh Shit this is a VM… Dude you need to say that in your FIRST POST!!!

What are you settings in vmware.. And your using usb nics... JFC yeah that is going to be smooth freaking sailing.. rolleyes..

Do you mean why port 1 is tagged on vlan 12?
Because DHCP is enabled on pfsense and pfsense is the main router and firewall, so PC on port 7 need to communicate with it. Also port 7 will be used for access point later, after at least I figure out the PC first, otherwise the AP will not work as expected I guess.

Or do you mean, port 7 is tagged on vlan 1? port 7 already removed from vlan 1 as you can see.

Yes, Sorry mate, I will mention that in first post next time ;) I know it is crazy, but I have limited resources, the host is a Windows 2012 R2, on a laptop, now more crazy I know.
USB NIC are configured dedicated for pfsense in the VM, only VM service is checked in the property page, not used by host. Also I've selected vlan disabled for that USB nic on host, so vlan tag will not be stripped (Enable vlan for USB NIC on host will strip it, I tested) so now vlan tag seems works, otherwise VOIP phone will not ring when calls incoming.
Um, what else, USB NIC for VM is set to bridge.
Other parts are working fine, it sit like that for 2 years.
It's just vlan, which I want to add now, having some issues.

And yes, I can see it's going to be JFC, smooth freaking sailing.. rolleyes.. etc. etc….

Thanks again for still replying me, even you know it's crazy :P

johnpoz · May 29, 2016, 11:07 AM

Ok upon looking at it again, your ok with the new pointing 12 is untagged on 7, and tagged on port 1.

PC connected on port 7 gets IP in vlan 12 from pfsense dhcp - right? It can ping pfsense IP in vlan 12? It can get to internet?

PFbest · May 29, 2016, 11:36 AM

Oh, finally you are here, seems we have time difference, I've been waiting for you for whole day haha ;D
You are my a life-saving straw ;D ;D
Let me confirm right now

johnpoz · May 29, 2016, 11:43 AM

Yeah I am in chicagoland, just woke up bit ago.. I am a early riser.. Is before 7am here..

PFbest · May 29, 2016, 11:49 AM

@johnpoz:

Ok upon looking at it again, your ok with the new pointing 12 is untagged on 7, and tagged on port 1.

PC connected on port 7 gets IP in vlan 12 from pfsense dhcp - right? It can ping pfsense IP in vlan 12? It can get to internet?

Yep, For VLAN 12, port 1 (pfsense) tagged, port 7 (only 1 PC) untagged. Yep the PC get IP from pfsense DHCP with no problem.
Yep, PC can ping pfsense IP in vlan 12.
Yep, this PC can get to internet.

Extra detail: if required:
Real LAN/or native vlan if that's how we should call it. pfsense IP: 192.168.0.1
vlan 12, pfsense IP: 192.168.3.1
PC IP from dhcp (currently): 192.168.3.10
(vlan 11 voip, pfsense IP 192.168.2.1, voip box 192.168.2.2)

Ping results:
PC (192.168.3.10) <-> LAN, pfsense (192.168.0.1) OK
PC (192.168.3.10) <-> LAN, PC (192.168.0.101) OK
PC (192.168.3.10) <-> vlan 11, pfsense (192.168.2.1) OK
PC (192.168.3.10) <-> vlan 11, voip box (192.168.2.2) OK
PC (192.168.3.10) <-> vlan 12, pfsense (192.168.3.1) OK
PC (192.168.3.10) <-> google.com OK
PC(192.168.0.101) <-> PC (192.168.3.10) OK
PC(192.168.0.101) <-> vlan 12, pfsense (192.168.3.1) OK

PFbest · May 29, 2016, 11:56 AM

@johnpoz:

Yeah I am in chicagoland, just woke up bit ago.. I am a early riser.. Is before 7am here..

Oh that's why, I'm in AU ;)
Nice to meet you! (on internet)

*Hand shaking icon should be inserted here ;)

Oh, and thanks you are still with me!!

(early bird gets juicy worms, good to hear that ;), and you are so kind BTW ;D)
It's 9:55 PM here haha

Heaps thanks!! :D

johnpoz · May 29, 2016, 11:55 AM

Well everything looks fine there.. Your issue is you can not get to web gui on 192.168.0.1? But you can get to it on 192.168.3.1?

PFbest · May 29, 2016, 11:59 AM

Yep, It's looking good to me as well, that's why I feel so lost.
From the PC on port 7, it can't open 192.168.0.1, or 192.168.3.1 or 192.168.2.1 at all, but ping to those IP works.
But from the laptop I'm using (IP is 192.168.0.75, in default/native vlan or real LAN) I can go to 192.168.0.1, or 192.168.3.1 or 192.168.2.1 with no problem.

PFbest · May 29, 2016, 12:02 PM

Also I've searched on google a lot.
I found this one http://superuser.com/questions/753472/pfsense-to-route-between-multiple-subnets-on-same-lan
Which some what looks similar to my situation I think.

I tried the solution in answer, still the same result

johnpoz · May 29, 2016, 12:20 PM

So I have multiple vlans.. Comes down to your rules be it you can access or not..

So see attached, on my wifi segment I can access gui on both my wlan pfsense IP, and my pfsense Lan IP.. This is because I have a specific rule for my ipad to go anywhere. If I try it from my wifes laptop the block all to firewall ips block it, etc.

Do you have any floating rules that would block this - that would be my guess!!

johnpoz · May 29, 2016, 12:23 PM

My the way that link is not something I would ever suggest anyone should ever be in.. He is running 2 layer 3 networks over the same layer 2.. That is BROKEN no matter how you look at it.. Period, your not in that sort of setup..