Routing problem between LAN and DMZ net

AMizil

Hello

I have setup a pfsense box at a friend's office a couple of years ago as follows:

2.2.1-RELEASE (i386) on a Atom D2500 mainboard, em0 having VLANs : LAN, DMZWIFI - NanoBSD 4G USB stick;
WAN 1 - PPoE ( Public IP addres 93.11x.y.z/32)
WAN 2 - DHCP ( from a 4G router , WAN 02 Ip address 192.168.8.1/24)
MultiWAN with Gateway Groups , Tier 1 WAN 1 and Tier 2 WAN 2

LAN address : 192.168.1.x/24 ( VLAN 1)
DMZWIFI address 10.0.2.x/24 ( VLAN 2)
DVR IP address 10.0.2.2
Switch L2 with management 192.168.1.12 ( used for testing).

The internet is working ok on both networks , from LAN to any , from DMZWIFI to any except LAN .
The problem is that users from LAN can't access the DVR located on 10.0.2.2/24 network. IN fact I can't access any device on DMZWIFI from LAN .

Primary troubleshooting makes me think that pfsense is routing 10.0.2.1/x network to its default gateway to the internet. But this only happends when requests are coming from LAN devices, if I ping from pfsense 10.0.2.2

I have started a ping from a L2 manged switch 192.168.1.12 to 10.0.2.2 and I have enabled packet capture on the LAN and WAN of pfsense :

INTERFACE LAN - packet capture
17:11:56.931082 IP 192.168.1.12 > 10.0.2.2: ICMP echo request, id 23756, seq 0, length 72
17:11:57.931170 IP 192.168.1.12 > 10.0.2.2: ICMP echo request, id 23756, seq 256, length 72
NO RESPONSE BACK ..

INTERFACE WAN .. packet capture

17:10:39.683694 IP 93.11x.y.z > 10.0.2.2: ICMP echo request, id 1958, seq 2048, length 72
17:10:40.684302 IP 93.11x.y.z > 10.0.2.2: ICMP echo request, id 1958, seq 2304, length 72

So it makes clear that the packets are routed outside the WAN …

Other considerations :

When I do a traceroute from a windows computer from LAN to DMZ the packets go outside the WAN ..
When I VPN from remote location I can access DMZWIFI network !!
When I ping from Pfsense the DMZWIFI it is ok ..

Routing table

192.168.1.0/24 link#7 U 2334657 1500 em0_vlan1
10.0.2.0/24 link#8 U 2123003 1500 em0_vlan2

Where is the problem ?

Thanks,
Adrian

johnpoz

"MultiWAN with Gateway Groups , Tier 1 WAN 1 and Tier 2 WAN 2"
"When I do a traceroute from a windows computer from LAN to DMZ the packets go outside the WAN .. "

Well yeah.. If your forcing traffic out a gateway how would it get to your other local network "dmz"

Just create a rule above the rule that is forcing your lan out the gateway to allow the access you want into the dmz.

AMizil

@johnpoz:

"MultiWAN with Gateway Groups , Tier 1 WAN 1 and Tier 2 WAN 2"
"When I do a traceroute from a windows computer from LAN to DMZ the packets go outside the WAN .. "

Well yeah.. If your forcing traffic out a gateway how would it get to your other local network "dmz"

Just create a rule above the rule that is forcing your lan out the gateway to allow the access you want into the dmz.

Thanks for the tip! Now it works with a new rule to allow traffic from LAN to DMZ, without forcing dual wan gateway, on top of default rule to internet.

BR,
Adrian