Can't access pfsense web GUI from VLANs [Solved]
-
Well everything looks fine there.. Your issue is you can not get to web gui on 192.168.0.1? But you can get to it on 192.168.3.1?
-
Yep, It's looking good to me as well, that's why I feel so lost.
From the PC on port 7, it can't open 192.168.0.1, or 192.168.3.1 or 192.168.2.1 at all, but ping to those IP works.
But from the laptop I'm using (IP is 192.168.0.75, in default/native vlan or real LAN) I can go to 192.168.0.1, or 192.168.3.1 or 192.168.2.1 with no problem. -
Also I've searched on google a lot.
I found this one http://superuser.com/questions/753472/pfsense-to-route-between-multiple-subnets-on-same-lan
Which some what looks similar to my situation I think.I tried the solution in answer, still the same result
-
So I have multiple vlans.. Comes down to your rules be it you can access or not..
So see attached, on my wifi segment I can access gui on both my wlan pfsense IP, and my pfsense Lan IP.. This is because I have a specific rule for my ipad to go anywhere. If I try it from my wifes laptop the block all to firewall ips block it, etc.
Do you have any floating rules that would block this - that would be my guess!!
-
My the way that link is not something I would ever suggest anyone should ever be in.. He is running 2 layer 3 networks over the same layer 2.. That is BROKEN no matter how you look at it.. Period, your not in that sort of setup..
-
My the way that link is not something I would ever suggest anyone should ever be in.. He is running 2 layer 3 networks over the same layer 2.. That is BROKEN no matter how you look at it.. Period, your not in that sort of setup..
Yep, cool, I don't have layer 3 switch
Thanks for confirming! -
So I have multiple vlans.. Comes down to your rules be it you can access or not..
So see attached, on my wifi segment I can access gui on both my wlan pfsense IP, and my pfsense Lan IP.. This is because I have a specific rule for my ipad to go anywhere. If I try it from my wifes laptop the block all to firewall ips block it, etc.
Do you have any floating rules that would block this - that would be my guess!!
My floating rules is not blocking anything I guess?
I've attached as image.
-
Not sure what you thought that article had to do with a layer 3 switch.. That idiot was running 2 different networks on the same layer 2 with just trying to put a vip on the interface in the other network..
Ok you sure your just not having a problem accessing the web gui from this client, something wrong with its browser, the cert you have on the gui, you runnint it on some odd port? You using a proxy on this client? Do you have transparent proxy setup on psfense?
-
Not sure what you thought that article had to do with a layer 3 switch.. That idiot was running 2 different networks on the same layer 2 with just trying to put a vip on the interface in the other network..
Ok you sure your just not having a problem accessing the web gui from this client, something wrong with its browser, the cert you have on the gui, you runnint it on some odd port? You using a proxy on this client? Do you have transparent proxy setup on psfense?
Ok, forget about the link haha ;D
Um, client should be fine I think, previously I tried on physical laptop, now I'm using windows in my VM workstation in my laptop.
(I passed the same module of USB nic directly to this VM, so eliminate bridge/NAT etc.)
But same results anyway. Can't access to web gui but no problem to ping.
Actually I do have proxy on 192.168.0.102 (I promise I eliminated proxy), but I did not use the proxy for testing web gui. (BTW, 192.168.3.1 can't access proxy as well, but it can access 192.168.101, I guess it's the iptable's problem) (Again, browsers are setted to not using proxy, not even auto proxy) (It's not transparent as well, so should be fine I think)
Now the pfsense cert part, it's the default one comes with pfsense, so it's invalid, I used it for 2 years, just click ignore in browser you know. (Will that be problem?? :o)
Odd port? Um, shouldn't be I think. all things should be normal I guess.
No transparent proxy, and in pfsense there's no proxy at all :P (squid is not installed on pfsense and pfsense is not using proxy from 192.168.0.102) -
Also this is what I get when I hit enter key in browser url input filed.
(url is https://192.168.3.1)
(Two times)
-
from 192.168.0.74
(ignore cert error already clicked)
-
looks like your seeing dup.. I would turn off https for testing.. And then can you post up the actual pcap so I can open it in wireshark.
-
Not a problem.
I'm on it.
Heaps thanks man!!!! -
This is the pcap from PC on port 7.
(The icon on browser tab just turning and turning, no pfsense page title showing, weird thing is it's not like when we don't have internet, it will show you error page directly.)
Eventually the browser will show ERR_TIMED_OUT.
(For this pcap, I didn't wait untill the browser come up with that error, it's going to be long)
I I just start wireshark, put address in browser hit enter, wait 5/10 seconds, then save the pcap.
If wait until the error shows up will help I can do that, just say it.
(Also I tried to connect to 192.168.3.1, and 192.168.0.1)
(Last thing, https turned off in this pcap)
Thank you!!
-
ok just started looking at it, but why your browser try so many connections at the same time?? to 443?
What browser are you using?
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
-
Thanks man!
It's chrome, google chrome :o
And yes, that's exactly the user-agent string for chrome 50.0.2661.102 m -
It's late night here, I need to go to bed, sorry :-.
I will back here tomorrow, many thanks to you!!!! -
Oh, another weird thing is
If I do nslookup google.com 192.168.0.1 or nslookup google.com 192.168.3.1 nslookup google.com 192.168.0.101
They all work. -
Another finding:
On the pc on port 7
If I do telnet 192.168.0.1 80 or telnet 192.168.3.1 80
as you see in p1, it seems I can get reply.
If I do telnet 192.168.100.1 80, it will fail, of course 192.168.100.1 does not exist on my network.
-
More finding
If I set rules in firewall for GUEST_AP_VL like this.reject GUEST_AP_VL net to any destination any port.
I try to open 192.168.0.1 and 192.168.3.1 in PC on port 7, the browser returns ERR_CONNECTION_REFUSED, which is right.
Any ideas? ??? ??? ???
