Resolved: Unidirection inter subnet routing problem
-
Sorry, this is another one of those - cant route between two subnet problems, but this time it appears to be in one direction only….
Running a four port unit https://www.aliexpress.com/item/Tablet-Fanless-mini-pc-J1900-quad-core-4-LAN-Router-Windows-7-8-10-HTPC-HD/32782699018.html
Connected is:
em0 WAN
em1 LANA - Address 192.168.0.1/24, static IP, all other default
em2 unused
em3 LANB - Address 192.168.2.1/24, static IP, all other defaultLANA port ----------> Switch -> PC, etc
LANB port ----------> Switch -> AP and test laptopOn LANB there exist an access point (192.168.2.254) which I need to get access to from LANA for administration. Cannot ping or connect from LANA 192.168.0.x addresses to 192.168.2.x addresses
If I connect a laptop to LANB switch I can access onto the 192.168.0.0/24 network from the 192.168.2.0/24 and get out to the internet, all is fine. Verified I can ping the 192.168.2.254 access point from the 192.168.2.0/24 subnet. Note eventually I want to prevent access to 192.168.0.0/24 from 192.168.2.0/24 but first I need to resolve the routing.
LANA has just three default rules
- IPv4 & 6 LAN net * * * * none - default allow lan to any
- anti lockout rule
LANB has:
- IPV4 LANB net * * * * none - Outbound traffic
- Two easy rules pass from firewall log view - IGMP/ICMP source 192.168.2.0/24 *
No interface groups, vlans, bridges
Windows firewall off. Have used Linux client to verify and a separate laptop. Laptop confirms access from LANB to LANA and verifies failure of LANA to LANB (Note laptop dhcp and each subnet switch has a release/renew to ensure correct IP picked up and tested with subnet local addresses.)
Tried disabling the pfsense firewall and still doesnt route
Also just tried a complete reset of pfsense with only the default any rule and adding an any on LANB. Same result, only traffic from LANB to LANA and not from LANA.
From LANA I can ping 192.168.2.1, cant ping anything else on the 192.168.2.0 subnet
ARP Table shows mac for 192.168.2.1 and 192.168.2.254 AP
Packet capture only shows one way packet. Note 0a:e8:4e:68:11:d3 is the mac for em1 LAN nic
08:15:53.326271 30:85:a9:41:b1:16 > 0a:e8:4e:68:11:d3, ethertype IPv4 (0x0800), length 66: (tos 0x0, ttl 128, id 3159, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.67.60954 > 192.168.2.254.80: Flags ~~, cksum 0xae79 (correct), seq 632489959, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
08:15:53.326484 30:85:a9:41:b1:16 > 0a:e8:4e:68:11:d3, ethertype IPv4 (0x0800), length 66: (tos 0x0, ttl 128, id 3160, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.67.60955 > 192.168.2.254.80: Flags ~~, cksum 0xfe76 (correct), seq 4224573901, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
08:15:53.577268 30:85:a9:41:b1:16 > 0a:e8:4e:68:11:d3, ethertype IPv4 (0x0800), length 66: (tos 0x0, ttl 128, id 3161, offset 0, flags [DF], proto TCP (6), length 52)
192.168.0.67.60956 > 192.168.2.254.80: Flags ~~, cksum 0xc231 (correct), seq 802941444, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0Nothing showing in the firewall logs
Routes show:
127.0.0.1 link#8 UH 273 16384 lo0
192.168.0.0/24 link#2 U 19768 1500 em1
192.168.0.1 link#2 UHS 0 16384 lo0
192.168.2.0/24 link#4 U 153 1500 em3
192.168.2.1 link#4 UHS 0 16384 lo0At this point I'm completely stumped. It should just work as there's nothing special.
Is there anything to be run at the command line to give more information on the routing config?~~~~~~
-
On which interface have you taken this packet capture?
Take one form LANA while you try the same access from LANB to LANA.
-
The packet capture was from pfsense. Capturing from a pc on .0.67 shows similar.
Ok, so I set up a simple HTTP service on .0.67:8008 and connect to it by the browser from the laptop on .2.33. The wireshark capture shows correct source, mac address is the …:11:d3 (em1 of LANA):
-
LANA was a mistake, LANB is juicy, the outgoing interface, to see if the packets are passed out there and if responses come back from the Laptop.
-
So, a capture on the .2.33 laptop is showing as attached. ARP to find .2.1 which is at mac ending at :d5 which corresponds to em3 i/f
-
These captures show connections from LANB to LANA which work anyway.
For research you should take packet capture from connection attempts which don't work, from LANA to LANB. And take the capture on pfSense interfaces, please.
-
Ok, so setting up a test service on the .2.33 show I can connect from .0.67 so it appears to be an issue with the .2.254 access point (A TP-Link CPE-510). for some odd reason its not accepting packets from another network so that indicates a problem with its default gateway which I'll go and investigate further. What's interesting is that this device was working ok with a Zyxel USG-20 prior to the change to pfsense which must have been more tolerant??
Many thanks for the assistance.
Note to anyone else with subnet routing issues; If testing, set up alternative test source eg another device running a simple http server, etc so you verify with a known good source and eliminate configuration issues in the other
-
As a workaround you may set up an SNAT rule for the AP. Maybe that's what also the USG did. I've seen this also on a Fortigate.