Cannot access device in LAN2 from LAN, no apparent fw rule in action

[Pontiac_CZ]

Hello,

I need an advice. I am not able to access an AP in LAN2, but I used to be. I still have the bookmark in my browser. Network configuration:

LAN: 10.0.0.254/24 (source PC has IP 10.0.0.39)
LAN2: 10.0.1.254/24 (target AP has IP 10.0.1.1)

Both networks are connected to my pfSense, pfSense box NICs always have .254 in its IP.

I want to connect to an administration of an access point with IP 10.0.1.1 port 80. Connection cannot be established. The AP cannot even be pinged. Other devices in 10.0.1.x subnet are pingable, for instance my phone with 10.0.1.140. I even tried to run FTP server on my phone and could sucessfully connect to it from the PC so generally the pfSense routing works.

In firewall on LAN tab I only have three blocking rules, none of them relevant.

Now the most interesting part: pfSense has tools Ping and Test Port in Diagnostics.

Ping: I entered 10.0.1.1, with source addresss left to "automatically selected" or LAN2 everything goes well - ping under 1 ms. But when I set source address to LAN I get 100% packet loss. (?!)
Test Port: just the same case. With "automatically selected" or LAN2 I get "Port test to host: 10.0.1.1 Port: 80 successful." With LAN there's no response again.

What could be wrong?

pfSense 2.3.4-RELEASE-p1 (i386)

[viragomann]

Correct the default gateway on the AP.

[johnpoz]

What are you using for AP.. If some soho router just using as AP many of them do not allow for setting a gateway on their lan interface.  So you would need to use some 3rd party firmware on it that allows for that.  Or you would have to source nat your traffic so AP thinks traffic is from its local network 10.0.1

[Pontiac_CZ]

It's TP-LINK TL-WR702N.

You are probably right with the missing gateway setting. It's really not there. I tried changing the LAN interface static IP address to DHCP assigned hoping that pfSense would give it the gateway IP as well. But that did not help.

I am just wondering how come it used to work since I have that bookmark in my browser…  :o

[Derelict]

I am just wondering how come it used to work since I have that bookmark in my browser…  :o

Were you accessing it from the 10.0.1.0/24 network at the time?

[Pontiac_CZ]

No, always from my PC with IP 10.0.0.39.

FYI - the screenshots now taken using laptop connected to the AP.

[viragomann]

A workaround for your issue would be a source-NAT rule translating source IPs of packets destined to the AP to the interface address. You can do this by an outbound rule in pfSense.

[Pontiac_CZ]

I studied the documentation about how outbound NAT works but I have troubles with understanding.

The outbound NAT documentation (https://doc.pfsense.org/index.php/Outbound_NAT) says: "Outbound NAT does not control which interface traffic will leave, only how traffic is handled as it exits."

So if I get it right, when connecting the AP I need to have the source address of my packets translated to the pfSense LAN2 interface so the AP can reply to an address inside its subnet. That way it does not need a gateway.

I set it up as you can see in the attached screenshot but still cannot connect with the AP.

[johnpoz]

Your source nat is not enabled.. Its grayed out.

[Pontiac_CZ]

I noticed that too but the rule does not seem to be disabled…(?)

[johnpoz]

Well your in automatic mode, not hybrid mode!

[Pontiac_CZ]

That was it, thank you.  :) I've set it to hybrid and instantly regained the communication with my AP which does not support gateways! It's been a great lesson about using outbound NAT in pfSense.

Thank you all very much for help!