Routing between subnets/interfaces

spartasolutions

Ex.
LAN Bridge LAN + WIFI(ath0_wlan0): 192.168.2.1
Devices ath0_wlan1: 192.168.30.1

Due to our desire to have subnet specific content filtering rules, how would we be able to get these two networks to communicate with each other? i.e. An end user on the LAN interface could communicate with their chromecast or other smart devices attached to the devices network.

It's probably not a hard task, but my pfsense box is acting up. Currently:

Device on LAN can ping: 192.168.2.1 (obviously), 192.168.30.1, but not a device on the other subnet 192.168.30.20
Device on Devices can ping: 192.168.30.1 and 192.168.2.1 but not the device on the lan, 192.168.2.20

Thanks for the help everyone!

Derelict

Sounds like the rules are correct (since you can ping the other interface addresses). Maybe something on the local hosts not allowing pings from other subnets?

Traffic capture for ICMP from the source host on the destination interface. If you see the pings going out and no reply, it's something on the target host.

spartasolutions

So here's some updates:

1. The WLAN continues to be re-recognized as a new, public network. (think we're not connecting to Atheros 13 (SSID is Atheros), this increments every couple of days and the box is recognized as a new network

2. We've located the cause of the issue. Firstly, our network setup is as follows (we've disabled some interfaces to make it easier to diagnose.

OS: pfSense 2.3.1 (10-3 STABLE)
Wireless Card: Atheros AR9380

WAN - igb0 (obvious) - outbound IP address
LAN - BRIDGE0 (LANPORT + WIFI) - 192.168.2.0
WIFI - ath0 (using an Atheros AR9380) - None
LANPORT - igb1 [the lan itself] - None

-Firewall Rules

Bridge Members
WIFI: Pass IPV4 | any | any
LANPORT: Pass IPv4 | any | any

Current working pings:

WIFI device to LANPORT device

Not working pings:

LANPORT to WIFI
WIFI to WIFI
(have not checked LANPORT to LANPORT yet, will do)

Here's the kicker: the issue is Windows Firewall. Specifically, it's not recognizing these bridged networks as the same "local subnet". When I disabled Windows Firewall everything worked well. Then, just for fun, I enabled ICMP IPv4 Inbound Echo Requests (ping in) for all "remote IP addresses" instead of "local subnet". Voila, ping works.

So I guess it's turned into a larger problem of: Why isn't this bridge working? All devices have the same default gateway regardless of interface. Seems very bizarre to me.

Hope someone has some insight into how to get this resolved!

Derelict

Windows firewall doesn't care about layer 2, only layer 3.

If the ip address is outside the local subnet as the host sees it, it is not on the local subnet.

spartasolutions

All devices have a default gateway of 192.168.2.1 and have received their IP addresses from DHCP.

The bridged network is 192.168.2.1/24.

So, I don't quite know what you're saying; it works with windows firewall disabled and it doesn't when it's enabled. That's what I've figured out and am asking help resolve

johnpoz

"BRIDGE0 (LANPORT + WIFI) - 192.168.2.0"

So your saying all your devices on this bridge are on this 192.168.2/24 network??

But your windows firewall is blocking the traffic? But if you allow ""remote IP addresses" instead of "local subnet"" then it works??

That makes zero sense, so we must be missing someinfo.. So your client that is on wifi gets a 192.168.2/24 address. And it tries to ping something on the bridge network of 192.168.2/24 and the windows firewall blocks this because it thinks its an outside network??

spartasolutions

Absolutely that's what was happening. Two clients, attached to the bridged networks via two separate interfaces (LAN for one, WIFI for the other).

However, I've really just about had it with the wireless card. After testing the same routes with an AP installed, there were no issues with communication across the bridged network. Just another L for wireless cards and pfSense.

Regardless, thanks for the help. It was definitely a weird situation that I might look into again if I ever need to have a wireless card in the box.

johnpoz

"if I ever need to have a wireless card in the box."

If that was ever the case you would be doing it wrong ;) If you want wifi, then get AP - get multiple AP if the area you need to cover warrants.. I really can not think of situation where the router would be properly placed for wifi coverage of any area.. Unless you have place your router in the ceiling in the center of the area you want to cover with wifi ;)