Cant ping my gateway on op1 interface, but can access pfsense web….
-
Hello! I am currently scratching my head and loosing hair by the minute. I have a setup for my home network with Pfsense. And I am experiencing rather odd problems. first thing first. When I first where installing the Pfsense I had problems detecting the 3rd interface aka opt1. I dont know if this is normal or not. I had also problems getting an Ip-adress from my wan port (I rent a basement) But afther som fiddling i got an ip-adress for my wan and lan, configured as I wanted, but had to activate the opt1 interface in the web gui.
When I had activated the opt1 nic I aslo enabled DHCP on that nic. So all my servers and stuff would get an ip. The DHCP server is working fine and lending out ip-adresses. I made rules so that I could connect from my desktop to my ESXI server how is running on the opt1 nic. (See attachemts for my full network setup)So my setup looks like this.
WAN 192.168.10.123 (Gets Ip from the router of the land lord)
LAN 192.168.1.1
OPT1/lab 172.29.229.1I made a rule that says any any on the opt1 as well as a rule on LAN that says 172.29.229.2 (ESXI) port * Destination * gateway *
Now I can access my ESXI from my desktop. My dekstop is on LAN with ip 192.168.1.100 So I achived what I wanted.
But here comes the strange part. I cant reach my gateway on OPT1/lab I try pinging it, no response. I try to access the web gui from opt1 I can access it.
I can access the internet on my lan no problem. Any one got the slightets idea on what is going on ?
-
It shows all my interfaces to be up to…
-
You should not have any gateway on OPT1 network, no idea what's this about.
-
I cant access the internett from opt1… Eader can I ping the 172.29.229.1 but I can access the web gui.
-
" I made rules so that I could connect from my desktop to my ESXI server how is running on the opt1 nic. (See attachemts for my full network setup)"
There would be no need to create such rules in the default out of the box config because the default rule on lan is any any.. Lan can go anywhere it wants, internet, other local networks you create on pfsense, etc.
Why don't you post up your rules for both your lan and new opt1 and we can discuss why stuff will or will not work.
Rules are evaluated top down on an interface, first rule to trigger wins no other rules are looked at. You create your rules on interface where traffic will first enter pfsense.
"I made a rule that says any any on the opt1 as well as a rule on LAN that says 172.29.229.2 (ESXI) port * Destination * gateway * "
Post up your rules or we are just going to be guessing what your did..
-
thanks for the reply here are my rules
 -
and
 -
Sigh.
- The first rule on LAN is useless.
- The 172. rules on LAN have no effect, that's not where you put them
- The first rule on OPT1 makes no sense either, it's already covered by the second one. - DNS is UDP/TCP, not TCP.
- Ping is ICMP, not TCP.
- The first rule on LAN is useless.
-
Pretty much none of those rules makes sense on lan since you have an any any on the bottom and that source of 172.29 would never be seen inbound into lan unless you had a downstream router and lan was your transit network.
Your rules on opt are pointless as well, as dok pints out dns is UDP, with now and then some possible tcp..
And where in those rules do you allow ICMP or Any your 2nd rule is any any for tcp only - ping is icmp.
https://doc.pfsense.org/index.php/Firewall_Rule_Basics
Firewall rules on Interface and Group tabs process traffic in the Inbound direction and are processed from the top down, stopping at the first match. Where no user-configured firewall rules match, traffic is denied.
Maybe this should be worded better? Maybe we need to put in pictures??
-
Okey I removed them, but still no changes
 -
1
-
I cannot see anything removed or improved, plus you are missing the absolutely basic rule: you do NOT allow OPT1 traffic on LAN. You allow it on OPT1 (the interfaces where the traffic first hits the firewall)
-
yeah looks like you got this .6 wanting to talk to googledns.. Going to be hard for it resolve local stuff that way ;)
What I would highly suggest is put in any any rule on Opt1, get your stuff talking!! Then put in block rules for what you don't want to talk.. Unless you don't want opt talking to lan at all?
-
update of rules
 -
updated opt1
 -
And again completely pointless with that TCP rule with a rule right below it that says any any.. You do not need this rule!!! Unless you wanted to log or something - which you clearly do not have marked.
And you rule on opt is only allow TCP, not ping (icmp) or dns which is UDP..
-
The first rule is still pointless. But yet again: You are showing us the WRONG INTERFACE!!!
You need to allow the traffic on OPT1, NOT LAN!!!!
-
Okey god… I am such an idiot............ Figured it out now........ God dam.......
-
thanks guys for sticking it out…. I am such a freaking dumb ass.....
-
Well no problem, you figured out the issue pretty fast. Some people don't get it even after a couple of days. :D
