Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Tracert to another lan goes to wan

    Scheduled Pinned Locked Moved Firewalling
    7 Posts 2 Posters 1.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • O
      ozlecz
      last edited by

      given
      lan1-192.168.10.0/24 dhcp
      lan2-192.168.20.0/24 dhcp
      WAN-192.168.2.1

      SVR1-192.168.10.250 static on lan1 with gw=lan1_interface address

      firewall rules
      lan1 = permit ipv4 ports-any lan1_net to lan2_net
      lan2 = permit ipv4 ports-any lan2_net to lan1_net

      problem
      =cant ping svr1 from lan2_net

      findings from lan2_net
      =can ping any lan1_net hosts except svr1
      =tracert to svr1 from lan2_net shows 1sthop=lan2_address 2ndhop is the WAN interface and goes to internet and timeout eternity

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        Do you have any rules setting a specific gateway?  Only reason it would route you out the wan if trying to go to a different lan address is you have set a gateway in the rule vs letting pfsense use its routing table.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • O
          ozlecz
          last edited by

          but why the rest of the host in lan1 is pingable from lan2….only svr1 is not

          note svr1 is centos with static ip and gw is same as the rest pointing to the lan1 interface

          1 Reply Last reply Reply Quote 0
          • O
            ozlecz
            last edited by

            default gw is *

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by

              "=tracert to svr1 from lan2_net shows 1sthop=lan2_address 2ndhop is the WAN interface and goes to internet and timeout eternity"

              This makes zero sense, if your saying you ping 192.168.10.10 and it works, but you ping 192.168.10.11 and it goes to wan.. Unless you have rules to do that.

              What does your traceroute look like when ping 192.168.10.10 (or some IP that works) and one that does not?

              To be honest your pfsense wan IP should never be listed in a traceroute either to another lan or the internet.. So you got something odd in your config.

              So for example

              traceroute to 192.168.3.10 (192.168.3.10), 30 hops max, 60 byte packets
              1  192.168.9.253  1.688 ms  1.983 ms  1.946 ms
              2  192.168.3.10  2.705 ms  3.477 ms  3.458 ms
              user@ubuntu:~$ traceroute -n 8.8.8.8
              traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
              1  192.168.9.253  1.214 ms  1.419 ms  1.355 ms
              2  96.120.snipped  12.749 ms  13.570 ms  21.963 ms
              3  162.151.90.117  19.353 ms  21.869 ms  21.883 ms
              4  68.86.188.93  23.632 ms  23.641 ms  23.608 ms

              I traceroute from a box on 192.168.9.0/24 to a IP on a different segment off pfsense.  It hits its gateway in the 192.168.9 network .253 (pfsense) then it hits the client.

              When I ping out to internet it hits pfsense interface.. 192.168.9.253 and then the next hop is the isp gateway on the internet that pfsense is connected too.. At no time should pfsense wan IP show up in your traceroute either to other lan networks or to the internet.  The only time your pfsense wan IP would be listed in a trace is if you were tracing from the internet to a network behind pfsense..

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • O
                ozlecz
                last edited by

                Thats why iam writing here..

                .other than svr1 tracert are just 2 lines and hit the target straight away…

                For tracert on the svr1 the second line points to the wan...

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by

                  What is the routing table in pfsense - post it. Did you mess with nat rules?

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post
                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.