• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

[SOLVED] VLAN Internet access

Scheduled Pinned Locked Moved Firewalling
17 Posts 4 Posters 8.6k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • J
    jutje
    last edited by Dec 14, 2017, 10:02 AM Dec 11, 2017, 12:49 PM

    Hello there,

    I would like my VLAN to have access to the internet but it ain’t woking at the moment.
    I have VLAN20 172.16.2.1/24 DATA_NET

    And the rule I have config at the moment is
    Action: Pass
    Interface: DATA_NET
    Protocol: Any
    Source: Any
    Desination: Any

    Please some help

    1 Reply Last reply Reply Quote 0
    • V
      viragomann
      last edited by Dec 11, 2017, 1:50 PM

      Is there an outbound NAT rule in place for that subnet? Firewall > NAT > Outbound.

      1 Reply Last reply Reply Quote 0
      • J
        johnpoz LAYER 8 Global Moderator
        last edited by Dec 11, 2017, 2:03 PM

        Unless you messed with the outbound nat, automatic would auto create the outbound nat.. But sure that is a common problem when users set it to manual.

        Is pfsense actually seeing the traffic on the vlan?  Did you setup the switch to send your vlan taggged as 20 on the port connected to physical interface your vlan is running on.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

        1 Reply Last reply Reply Quote 0
        • J
          jutje
          last edited by Dec 11, 2017, 2:39 PM

          Viragomann:
          What shoul be something like this?

          Interface: DATA_NET
          Source: 172.16.2.0/24
          Source port Any
          Destination: Any
          Destination port: Any
          Nat Address: WAN address
          Nat port: Any

          Johnpoz:
          No it's set to manual outbound. And yes ma VLAN is config including my Switch which at this moment my file server is receiving a ip address from pfsense (172.16.2.2)

          1 Reply Last reply Reply Quote 0
          • V
            viragomann
            last edited by Dec 11, 2017, 2:58 PM

            You have to change the interface to WAN in that rule. The rest is fine.

            1 Reply Last reply Reply Quote 0
            • J
              jutje
              last edited by Dec 11, 2017, 7:30 PM

              Still not working  :'(

              See attachments

              DATA_NET.png
              DATA_NET.png_thumb
              Firewall.jpg
              Firewall.jpg_thumb
              Outbound.png
              Outbound.png_thumb
              WAN.png
              WAN.png_thumb

              1 Reply Last reply Reply Quote 0
              • D
                Derelict LAYER 8 Netgate
                last edited by Dec 11, 2017, 8:49 PM

                Remove that Pass any any any rule from WAN before you do anything else, please.

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • J
                  jutje
                  last edited by Dec 11, 2017, 9:10 PM

                  Remove that Pass any any any rule from WAN

                  Step one Done

                  1 Reply Last reply Reply Quote 0
                  • D
                    Derelict LAYER 8 Netgate
                    last edited by Dec 11, 2017, 9:22 PM

                    You do realize you are only passing http and https and things like ping won't work right?

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • J
                      jutje
                      last edited by Dec 11, 2017, 9:33 PM

                      Yea but still my Outside traffic gets blocked when coming in.

                      I have a Synology NAS den my VLAN and am trying to do a frameware update i keep getting 'Connection failed. Check you Internet connection.'

                      1 Reply Last reply Reply Quote 0
                      • V
                        viragomann
                        last edited by Dec 11, 2017, 9:50 PM

                        Your pass rules on DATA_NET interface have the source "LAN net".  ???  Should be "DATA_NET net", I think.

                        1 Reply Last reply Reply Quote 0
                        • D
                          Derelict LAYER 8 Netgate
                          last edited by Dec 11, 2017, 10:44 PM

                          Nice.

                          And you probably need a port forward to access your NAS from the outside.

                          https://doc.pfsense.org/index.php/How_can_I_forward_ports_with_pfSense

                          Most people here would probably recommend against a port forward (especially from source address any) and opt for a VPN instead.

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • J
                            jutje
                            last edited by Dec 12, 2017, 11:57 AM

                            No i don't think that's the problem.

                            It just not has internet access. It cannot grab firmware update from the internet. It has to do with something about the firewall rules.

                            1 Reply Last reply Reply Quote 0
                            • D
                              Derelict LAYER 8 Netgate
                              last edited by Dec 12, 2017, 4:39 PM

                              You are bouncing all over the place from inbound to your NAS to outbound. Make sure you see the post by viragomann up there ^. That is certainly wrong.

                              https://doc.pfsense.org/index.php/Connectivity_Troubleshooting

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              1 Reply Last reply Reply Quote 0
                              • J
                                jutje
                                last edited by Dec 12, 2017, 6:42 PM Dec 12, 2017, 6:37 PM

                                Yea but i don't really get it… Why am seeing this in my firewall log

                                WAN Default deny rule IPv4 (1000000103)   37.143.0.0 (Public IP)   192.168.1.3 (Local IP) ICMP

                                My pfsense box is behind my ISP Router which is giving the pfsense box the private ip 192.168.1.3
                                But i keep seeing it get bocked by pfsense just after i try to search for new update for my Synology.

                                P.S. I even try to put my Synology in my LAN Network everything is working perfectly but not when i put it back in my VLAN

                                1 Reply Last reply Reply Quote 0
                                • D
                                  Derelict LAYER 8 Netgate
                                  last edited by Dec 14, 2017, 12:17 AM Dec 12, 2017, 10:11 PM

                                  Because there isn't a WAN rule passing the ICMP traffic from that
                                  source (or from source any).

                                  https://doc.pfsense.org/index.php/Firewall_Rule_Basics

                                  https://doc.pfsense.org/index.php/Firewall_Rule_Troubleshooting

                                  Even the pass any any rule I asked you to delete would not have passed pings since it was for TCP/UDP-only, not ICMP (ping is ICMP).

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    jutje
                                    last edited by Dec 13, 2017, 6:40 PM

                                    Yes i got it working now.
                                    I didn't select DATA_NET as Network Interfaces under DNS Resolver.
                                    And i also added this rull.

                                    Now i have another issue/question… but i'll open a new post for that.

                                    Rules.png
                                    Rules.png_thumb

                                    1 Reply Last reply Reply Quote 0
                                    7 out of 17
                                    • First post
                                      7/17
                                      Last post
                                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                      This community forum collects and processes your personal information.
                                      consent.not_received