Can't access pfsense web GUI from VLANs [Solved]

PFbest · May 28, 2016, 1:56 PM

I found one interesting thing is.
You know the VOIP gateway is connected to switch, on port 4, vlan 11.
If I connect my pc to that gateway, LAN port, I can access 192.168.0.1 (pfsense LAN, web gui)
But if I connect my pc directly to port 4, I can't access 192.168.0.1 then, ping is fine.

Anyone know why and how to resolve this?

Thanks

johnpoz · May 28, 2016, 2:12 PM

Ok you changed the native untagged on the ports. But why do you have vlan 1 tagged on port 7 if all your doing is plugging in a computer?

Oh Shit this is a VM… Dude you need to say that in your FIRST POST!!!

What are you settings in vmware.. And your using usb nics... JFC yeah that is going to be smooth freaking sailing.. rolleyes..

PFbest · May 29, 2016, 3:55 AM

@johnpoz:

Ok you changed the native untagged on the ports. But why do you have vlan 1 tagged on port 7 if all your doing is plugging in a computer?

Oh Shit this is a VM… Dude you need to say that in your FIRST POST!!!

What are you settings in vmware.. And your using usb nics... JFC yeah that is going to be smooth freaking sailing.. rolleyes..

Do you mean why port 1 is tagged on vlan 12?
Because DHCP is enabled on pfsense and pfsense is the main router and firewall, so PC on port 7 need to communicate with it. Also port 7 will be used for access point later, after at least I figure out the PC first, otherwise the AP will not work as expected I guess.

Or do you mean, port 7 is tagged on vlan 1? port 7 already removed from vlan 1 as you can see.

Yes, Sorry mate, I will mention that in first post next time ;) I know it is crazy, but I have limited resources, the host is a Windows 2012 R2, on a laptop, now more crazy I know.
USB NIC are configured dedicated for pfsense in the VM, only VM service is checked in the property page, not used by host. Also I've selected vlan disabled for that USB nic on host, so vlan tag will not be stripped (Enable vlan for USB NIC on host will strip it, I tested) so now vlan tag seems works, otherwise VOIP phone will not ring when calls incoming.
Um, what else, USB NIC for VM is set to bridge.
Other parts are working fine, it sit like that for 2 years.
It's just vlan, which I want to add now, having some issues.

And yes, I can see it's going to be JFC, smooth freaking sailing.. rolleyes.. etc. etc….

Thanks again for still replying me, even you know it's crazy :P

johnpoz · May 29, 2016, 11:07 AM

Ok upon looking at it again, your ok with the new pointing 12 is untagged on 7, and tagged on port 1.

PC connected on port 7 gets IP in vlan 12 from pfsense dhcp - right? It can ping pfsense IP in vlan 12? It can get to internet?

PFbest · May 29, 2016, 11:36 AM

Oh, finally you are here, seems we have time difference, I've been waiting for you for whole day haha ;D
You are my a life-saving straw ;D ;D
Let me confirm right now

johnpoz · May 29, 2016, 11:43 AM

Yeah I am in chicagoland, just woke up bit ago.. I am a early riser.. Is before 7am here..

PFbest · May 29, 2016, 11:49 AM

@johnpoz:

Ok upon looking at it again, your ok with the new pointing 12 is untagged on 7, and tagged on port 1.

PC connected on port 7 gets IP in vlan 12 from pfsense dhcp - right? It can ping pfsense IP in vlan 12? It can get to internet?

Yep, For VLAN 12, port 1 (pfsense) tagged, port 7 (only 1 PC) untagged. Yep the PC get IP from pfsense DHCP with no problem.
Yep, PC can ping pfsense IP in vlan 12.
Yep, this PC can get to internet.

Extra detail: if required:
Real LAN/or native vlan if that's how we should call it. pfsense IP: 192.168.0.1
vlan 12, pfsense IP: 192.168.3.1
PC IP from dhcp (currently): 192.168.3.10
(vlan 11 voip, pfsense IP 192.168.2.1, voip box 192.168.2.2)

Ping results:
PC (192.168.3.10) <-> LAN, pfsense (192.168.0.1) OK
PC (192.168.3.10) <-> LAN, PC (192.168.0.101) OK
PC (192.168.3.10) <-> vlan 11, pfsense (192.168.2.1) OK
PC (192.168.3.10) <-> vlan 11, voip box (192.168.2.2) OK
PC (192.168.3.10) <-> vlan 12, pfsense (192.168.3.1) OK
PC (192.168.3.10) <-> google.com OK
PC(192.168.0.101) <-> PC (192.168.3.10) OK
PC(192.168.0.101) <-> vlan 12, pfsense (192.168.3.1) OK

PFbest · May 29, 2016, 11:56 AM

@johnpoz:

Yeah I am in chicagoland, just woke up bit ago.. I am a early riser.. Is before 7am here..

Oh that's why, I'm in AU ;)
Nice to meet you! (on internet)

*Hand shaking icon should be inserted here ;)

Oh, and thanks you are still with me!!

(early bird gets juicy worms, good to hear that ;), and you are so kind BTW ;D)
It's 9:55 PM here haha

Heaps thanks!! :D

johnpoz · May 29, 2016, 11:55 AM

Well everything looks fine there.. Your issue is you can not get to web gui on 192.168.0.1? But you can get to it on 192.168.3.1?

PFbest · May 29, 2016, 11:59 AM

Yep, It's looking good to me as well, that's why I feel so lost.
From the PC on port 7, it can't open 192.168.0.1, or 192.168.3.1 or 192.168.2.1 at all, but ping to those IP works.
But from the laptop I'm using (IP is 192.168.0.75, in default/native vlan or real LAN) I can go to 192.168.0.1, or 192.168.3.1 or 192.168.2.1 with no problem.

PFbest · May 29, 2016, 12:02 PM

Also I've searched on google a lot.
I found this one http://superuser.com/questions/753472/pfsense-to-route-between-multiple-subnets-on-same-lan
Which some what looks similar to my situation I think.

I tried the solution in answer, still the same result

johnpoz · May 29, 2016, 12:20 PM

So I have multiple vlans.. Comes down to your rules be it you can access or not..

So see attached, on my wifi segment I can access gui on both my wlan pfsense IP, and my pfsense Lan IP.. This is because I have a specific rule for my ipad to go anywhere. If I try it from my wifes laptop the block all to firewall ips block it, etc.

Do you have any floating rules that would block this - that would be my guess!!

johnpoz · May 29, 2016, 12:23 PM

My the way that link is not something I would ever suggest anyone should ever be in.. He is running 2 layer 3 networks over the same layer 2.. That is BROKEN no matter how you look at it.. Period, your not in that sort of setup..

PFbest · May 29, 2016, 12:27 PM

@johnpoz:

My the way that link is not something I would ever suggest anyone should ever be in.. He is running 2 layer 3 networks over the same layer 2.. That is BROKEN no matter how you look at it.. Period, your not in that sort of setup..

Yep, cool, I don't have layer 3 switch
Thanks for confirming!

PFbest · May 29, 2016, 12:30 PM

@johnpoz:

So I have multiple vlans.. Comes down to your rules be it you can access or not..

So see attached, on my wifi segment I can access gui on both my wlan pfsense IP, and my pfsense Lan IP.. This is because I have a specific rule for my ipad to go anywhere. If I try it from my wifes laptop the block all to firewall ips block it, etc.

Do you have any floating rules that would block this - that would be my guess!!

My floating rules is not blocking anything I guess?
I've attached as image.

johnpoz · May 29, 2016, 1:59 PM

Not sure what you thought that article had to do with a layer 3 switch.. That idiot was running 2 different networks on the same layer 2 with just trying to put a vip on the interface in the other network..

Ok you sure your just not having a problem accessing the web gui from this client, something wrong with its browser, the cert you have on the gui, you runnint it on some odd port? You using a proxy on this client? Do you have transparent proxy setup on psfense?

PFbest · May 29, 2016, 2:15 PM

@johnpoz:

Not sure what you thought that article had to do with a layer 3 switch.. That idiot was running 2 different networks on the same layer 2 with just trying to put a vip on the interface in the other network..

Ok you sure your just not having a problem accessing the web gui from this client, something wrong with its browser, the cert you have on the gui, you runnint it on some odd port? You using a proxy on this client? Do you have transparent proxy setup on psfense?

Ok, forget about the link haha ;D
Um, client should be fine I think, previously I tried on physical laptop, now I'm using windows in my VM workstation in my laptop.
(I passed the same module of USB nic directly to this VM, so eliminate bridge/NAT etc.)
But same results anyway. Can't access to web gui but no problem to ping.
Actually I do have proxy on 192.168.0.102 (I promise I eliminated proxy), but I did not use the proxy for testing web gui. (BTW, 192.168.3.1 can't access proxy as well, but it can access 192.168.101, I guess it's the iptable's problem) (Again, browsers are setted to not using proxy, not even auto proxy) (It's not transparent as well, so should be fine I think)
Now the pfsense cert part, it's the default one comes with pfsense, so it's invalid, I used it for 2 years, just click ignore in browser you know. (Will that be problem?? :o)
Odd port? Um, shouldn't be I think. all things should be normal I guess.
No transparent proxy, and in pfsense there's no proxy at all :P (squid is not installed on pfsense and pfsense is not using proxy from 192.168.0.102)

PFbest · May 29, 2016, 2:36 PM

Also this is what I get when I hit enter key in browser url input filed.
(url is https://192.168.3.1)
(Two times)

PFbest · May 29, 2016, 2:26 PM

from 192.168.0.74
(ignore cert error already clicked)

johnpoz · May 29, 2016, 2:45 PM

looks like your seeing dup.. I would turn off https for testing.. And then can you post up the actual pcap so I can open it in wireshark.