Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Hosts on LAN can't connect to each other, but can reach Internet and pfsense.

    General pfSense Questions
    5
    7
    1666
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      seanmcb last edited by

      Hello,

      Setting up pfsense for the first time. The web interface works at 192.168.4.1. It correctly hands out 192.168.4.x IPs to one computer plugged in, and to one over wifi.  Both these computers can visit the pfsense web UI and both can connect to the public Internet.  However, neither can ping the other.  Bonjour/zeroconf seems to work between machines though, because the macOS Finder shows their samba Shares, but I can't connect over Samba and can't even ping:

      $ ping 192.168.4.9
      PING 192.168.4.9 (192.168.4.9): 56 data bytes
      Request timeout for icmp_seq 0

      I'm not sure where I should be looking to debug this…  Any suggestions?  Thanks.

      1 Reply Last reply Reply Quote 0
      • Derelict
        Derelict LAYER 8 Netgate last edited by

        Traffic on the same subnet isn't handled by the firewall at all.

        Assuming a /24 netmask, if 192.168.4.8 wants to communicate with 192.168.4.9 it ARPs for the MAC address and sends the traffic directly.

        If 192.168.4.8 wants to send traffic to something outside 192.168.4.0/24 it consults its routing table which generally consists only of the default gateway. It then ARPs for the MAC address of the next hop gateway and sends the traffic there to be routed as needed.

        How is your wifi provided?

        Chattanooga, Tennessee, USA
        The pfSense Book is free of charge!
        DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • S
          seanmcb last edited by

          Thanks for your reply and info. I've read up on ARP a bit, and tried 'arp -a -l' on my Mac, and see other IPs and MACs that I expect. The pfsense's Diagnostics>ARP Table looks right too.  To eliminate the difference of one Mac being plugged by ethernet and the other connected by Wifi, I also connected the first by Wifi too now, and also did 'sudo arp -d -a'.  Now 'arp -a -l' seems to fail to get a MAC address:

          $ arp -a -l
          Neighbor                Linklayer Address Expire(O) Expire(I)    Netif Refs Prbs
          pfsense.localdomain    2:3:45:AB:CD:EF    40s      38s            en2    1
          192.168.4.9            (incomplete)      (none)    (none)        en2

          My wifi is provided by my pfsense SG-2220 <https: store.pfsense.org="" sg-2220="">which is also the device doing DHCP.

          So my situation now seems to be: two Macs both connected by Wifi to an SG-2220 can each see the Internet and the pfsense, but arp on one Mac doesn't find the MAC address of the other Mac.</https:>

          1 Reply Last reply Reply Quote 0
          • johnpoz
            johnpoz LAYER 8 Global Moderator last edited by

            wifi to wifi communication is what your talking about? And this can be blocked with isolation.  Pfsense calls it

            https://doc.pfsense.org/index.php/Wireless_Details

            Allow intra-BSS communication: Check this to allow wireless clients to contact each other

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.01

            1 Reply Last reply Reply Quote 1
            • stephenw10
              stephenw10 Netgate Administrator last edited by

              If your wifi is also being provided by the SG-2220 does it have a wireless interface directly? (mini-PCIe card and antennas in the case?)

              If so I assume you bridged the wifi and LAN interfaces in order to get them on the same subnet. In that situation you need firewall rules to allow traffic between the wifi and Ethernet segments.

              For both clients on wifi see what johnpoz wrote ^.

              Steve

              1 Reply Last reply Reply Quote 0
              • jahonix
                jahonix last edited by

                @stephenw10:

                … assume you bridged the wifi and LAN interfaces ... you need firewall rules to allow traffic between the wifi and Ethernet segments

                …unless you use these "System Tunables":
                net.link.bridge.pfil_member Set to 0 to disable filtering on the incoming and outgoing member interfaces.
                net.link.bridge.pfil_bridge Set to 1 to enable filtering on the bridge interface

                BTW: does this mean that setting both to '0' will lead to no filtering at all?

                1 Reply Last reply Reply Quote 0
                • Derelict
                  Derelict LAYER 8 Netgate last edited by

                  I have never done that but I would think that would mean all rules on both the member interfaces and the bridge interface are ignored.

                  Chattanooga, Tennessee, USA
                  The pfSense Book is free of charge!
                  DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post