Inter-VLAN routing goes out WAN?

  • I have several VLANs set up, and everything was working perfectly until I rebooted the systems (to move them to a new UPS). Now, the VLANs cannot reach each other (where they could before).

    For example, the pfSense box is and My workstation is on VLAN 10. The FreePBX server is on VLAN 20.
    The workstation and FreePBX server both pulled IPs from the DHCP server as expected.
    From pfSense I can ping both IPs as expected. The route tables look correct:

    But pinging from FreePBX to the workstation returns:

    [root@phones ~]# ping
    PING ( 56(84) bytes of data.
    From icmp_seq=1 Destination Net Unreachable

    Pinging from the workstation to FreePBX returns:

    [~] ⇛ ping
    PING ( 56 data bytes
    Request timeout for icmp_seq 0
    Request timeout for icmp_seq 1
    Request timeout for icmp_seq 2
    Request timeout for icmp_seq 3
    Request timeout for icmp_seq 4
    Request timeout for icmp_seq 5
    Request timeout for icmp_seq 6
    36 bytes from ( Destination Net Unreachable
    Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst
     4  5  00 5400 50bf   0 0000  3e  01 f9de

    Traceroutes (in either direction) show:

    [~] ⇛ traceroute
    traceroute to (, 64 hops max, 52 byte packets
     1 (74.42.XXX.XXX)  0.693 ms  0.496 ms  0.451 ms
     2 (  5.796 ms  5.443 ms  5.740 ms
     3 (  5.434 ms !N  5.347 ms !N  5.437 ms !N

    If it were just a timeout, or "Destination Net Unreachable", I'd assume my firewall rules were broken, but since pings are redirected outside the LAN I think it might be something else. The address is on the same /16 as my ip, but its not anything I'm familiar with.

    Any thoughts?

  • LAYER 8 Global Moderator

    And what are you rules on your lan - are you forcing traffic out a gateway?

  • Found it!

    I have two WAN connections, and the failover rules were misconfigured. Instead of keeping all local traffic, it was sending anything not in its own /24 out the DSL line. I fixed it by using an alias for my local VLANs instead of the incorrect "network" match.

    All better now, thanks.

Log in to reply