Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    [SOLVED]: NetBios browsing across subnets/VLANS

    Scheduled Pinned Locked Moved General pfSense Questions
    9 Posts 4 Posters 3.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      neilgreene
      last edited by

      I just noticed that when I got to a Windows PC on 1 of my networks/subnets/vlans, it can see Windows Netbios names from other networks/subnets/vlans.

      NETWORKS

      WAN - 192.168.50.1/24
      MGMTLAN - –> 192.168.1.0/24
      VLAN10 --> 192.168.10.0/24
      VLAN20 --> 192.168.20.0/24
      etc

      FIREWALL RULES

      I have a firewall rule on my networks which block seeing the other network:

      VLAN 10 - Blocking any packets (all protocols) to VLAN20
      VLAN 20 - Blocking any packets (all protocols) to VLAN10

      ISSUE

      Computers on VLAN10 can see computers on VLAN20 for instance in the Network tab under Windows.  Although, any attempts to connect to them fails.
      If I try to ping any hosts, I can not even ping the gateway to that network and no attempts to access them is working.
      BUT, I can not even understand how they can see these servers in the Network Neighborhood under Windows.

      EQUIPMENT

      pfSense: 2.4.3-DEVELOPMENT
      built on Friday, Nov 17 12:26:58 CST 2017

      Switches:  Ubiquiti

      THANKS IN ADVANCE

      1 Reply Last reply Reply Quote 0
      • JKnottJ
        JKnott
        last edited by

        ????

        If you have rules blocking everything, why would you expect to be able to access anything?

        Also, you shouldn't be able to browse NetBIOS file shares between networks.  It uses broadcasts, which are not passed by routers.  You need a WINS server to do that.

        PfSense running on Qotom mini PC
        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
        UniFi AC-Lite access point

        I haven't lost my mind. It's around here...somewhere...

        1 Reply Last reply Reply Quote 0
        • DerelictD
          Derelict LAYER 8 Netgate
          last edited by

          Sounds like your switch is broken/misconfigured or you don't understand the concept of VLANs.

          You might want to actually post your rules instead of a description of how you think you set them.

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 0
          • N
            neilgreene
            last edited by

            @JKnott:

            ????

            If you have rules blocking everything, why would you expect to be able to access anything?

            Also, you shouldn't be able to browse NetBIOS file shares between networks.  It uses broadcasts, which are not passed by routers.  You need a WINS server to do that.

            My point is, they should not be able to see each other via NetBios.  My question is, how are they?
            I can confirm they can not SCAN any ports on the other network, or perform any ip related access.
            So, how are they even showing up in the Network Neighborhood via NetBios (assuming this is a NB thing)

            Ng

            1 Reply Last reply Reply Quote 0
            • N
              neilgreene
              last edited by

              @Derelict:

              Sounds like your switch is broken/misconfigured or you don't understand the concept of VLANs.

              You might want to actually post your rules instead of a description of how you think you set them.

              I will keep all of the configuration details together in replies if/as more is added.

              Here are the block rules (network to network defined):

              block return in quick on em1.12 inet from 192.168.12.0/24 to 192.168.20.0/24 label "USER_RULE: Block access to VLAN20 Network"
              block return in quick on em1.20 inet from 192.168.20.0/24 to 192.168.12.0/24 label "USER_RULE: Block access to VLAN12 network"

              I was going to post the config from Unifi Switch.  Was posting quick.

              1 Reply Last reply Reply Quote 0
              • N
                neilgreene
                last edited by

                Figured it out.  Had to enable PORT ISOLATION on the switches for certain ports.  The broadcasts were bleeding over into other vlans and allowing for NetBios to show up even though they could not reach various other neteworks/subnets/vlans.  THANKS to Willie Howe for also verifying and assisting my review and for everyone here in the pfsense community that took the time to start helping as well.  Much appreciated.

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  So you're not using a managed switch and trying to use VLANs?

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • Raul RamosR
                    Raul Ramos
                    last edited by

                    @Derelict:

                    So you're not using a managed switch and trying to use VLANs?

                    If he use Ubiquiti Switches than they are managed.

                    pfSense:
                    ASRock -> Wolfdale1333-D667 (2GB TeamElite Ram)
                    Marvell 88SA8040 Sata to CF(Sandisk 4GB) Controller
                    NIC's: RTL8100E (Internal ) and Intel® PRO/1000 PT Dual (Intel 82571GB)

                    1 Reply Last reply Reply Quote 0
                    • DerelictD
                      Derelict LAYER 8 Netgate
                      last edited by

                      Then they are broken or improperly-configured if they are passing broadcasts between VLANs.

                      And proper configuration should not require anything such as "port isolation."

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • First post
                        Last post
                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.