Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Routing between interfaces

    Routing and Multi WAN
    3
    12
    1914
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      djm0 last edited by

      Hello All,

      Fairly new to pfsense, I have a fairly simple setup:

      PFSense box with connected WAN
      OVPN Server
      OVPN Client (for guest network to use)

      LAN - 192.168.2.0/24
      OPT1 - 192.168.4.0/24

      Now everything on OPT1 is working, DHCP is assigned from the PFSense box.
      LAN has a separate DHCP server but the PFSense box is the default gateway.

      from the PFsense router I can ping LAN -> OPT1 and OPT1 -> LAN, the firewall shows communication and logs it.

      from any device connected on LAN: Can PING 192.168.4.1 on PFSense router
      from any device connected on OPT1: Can PING 192.168.2.1 on PFSense router

      No device connected on LAN or OPT1 can communicate with each other past the router. If it the problem were rules why is there no logging to show this? I have enabled logging on all my rules to ensure I don't miss anything.

      Any advise?

      Thanks!

      1 Reply Last reply Reply Quote 0
      • KOM
        KOM last edited by

        Local firewalls, perhaps?  What devices are we talking about here?

        1 Reply Last reply Reply Quote 0
        • D
          djm0 last edited by

          No firewalls in place on connected devices as part of troubleshooting.

          LAN can all ping within LAN

          OPT1 can all ping within OPT1

          Example: 192.168.2.3 can ping 192.168.2.250, 192.168.2.3 can also ping 192.168.4.1 but not 192.168.4.52
          Example 192.168.4.52 (zoneminder) can ping 192.168.4.54 (camera). 192.168.4.52 can also ping 192.168.4.1, 192.168.2.1 but NOT 192.168.2.250

          Windows 192.168.2.250 ICMP 192.168.4.52 -> PFSense 192.168.2.1 -> 192.168.4.1 -> notta.

          I just decided to do a trace route on my windows host. it seems the routes are not working.
          When I attempt to traceroute to 192.168.4.52 it goes out to my internet connection.
          Traceroute 192.168.4.1 and it's instant.

          Okay so why is PFSense redirecting traffic to my WAN for that ip?

          1 Reply Last reply Reply Quote 0
          • Derelict
            Derelict LAYER 8 Netgate last edited by

            Check the netmasks on all your pfSense interfaces. They should probably be /24 and are likely /32.

            Are you using policy routing (Setting gateways on LAN/OPT1 rules)?

            1 Reply Last reply Reply Quote 0
            • D
              djm0 last edited by

              Everything is /24 for the full 192.168.2/4.x subnets

              Yes I have the LAN interface set to go through the WAN_DHCP gateway and Guest network to go trough the OVPN Client for it's gateway.

              1 Reply Last reply Reply Quote 0
              • D
                djm0 last edited by

                Rules:


                1 Reply Last reply Reply Quote 0
                • Derelict
                  Derelict LAYER 8 Netgate last edited by

                  What you are seeing is normal and expected.

                  https://doc.pfsense.org/index.php/Bypassing_Policy_Routing

                  1 Reply Last reply Reply Quote 0
                  • D
                    djm0 last edited by

                    How do I enforce just my guest network uses the OVPN Client gateway without it? When I use default WAN connectivity is gone.

                    1 Reply Last reply Reply Quote 0
                    • D
                      djm0 last edited by

                      What I mean is if I set my outbound rules to default there is no WAN connectivity on the LAN anymore with that PIA rule enabled.

                      1 Reply Last reply Reply Quote 0
                      • Derelict
                        Derelict LAYER 8 Netgate last edited by

                        You probably need to check "Don't pull routes" on your PIA client.

                        There are probably a thousand threads on this, bro.

                        1 Reply Last reply Reply Quote 0
                        • D
                          djm0 last edited by

                          Slaps hand on head. Yup. That's it.

                          Thanks so much, honestly I had no idea what to search for to figure out this mess.

                          1 Reply Last reply Reply Quote 0
                          • Derelict
                            Derelict LAYER 8 Netgate last edited by

                            "PIA"

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post

                            Products

                            • Platform Overview
                            • TNSR
                            • pfSense Plus
                            • Appliances

                            Services

                            • Training
                            • Professional Services

                            Support

                            • Subscription Plans
                            • Contact Support
                            • Product Lifecycle
                            • Documentation

                            News

                            • Media Coverage
                            • Press
                            • Events

                            Resources

                            • Blog
                            • FAQ
                            • Find a Partner
                            • Resource Library
                            • Security Information

                            Company

                            • About Us
                            • Careers
                            • Partners
                            • Contact Us
                            • Legal
                            Our Mission

                            We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

                            Subscribe to our Newsletter

                            Product information, software announcements, and special offers. See our newsletter archive to sign up for future newsletters and to read past announcements.

                            © 2021 Rubicon Communications, LLC | Privacy Policy