How to configure pfSense as a router for two internal LAN subnets?
-
"I tested this by pinging machines within the same subnet and they worked fine"
That is not a test of firewall… That is a test of a firewall allowing something on the same subnet..
What is the gateway of these devices? What is the mask on these devices.. If you don't point back to pfsense as the gateway, the machine can not answer.. If the mask is wrong on the client then it would never even send back an answer to pfsense to get sent to the client sending the ping because it thinks that is on its own network, etc.
Did you setup these clients with statics or did they get their IP from pfsense dhcp server? Are these clients wired or wireless? How are you isolating these 2 networks - do you have a smart switch, 2 different physical switches for each network?
There is ZERO to do on pfsense other than what you have done - create the interfaces on the network and create the correct firewall rules on those interfaces. That you had some interface set as wan before.. Did you mess with outbound nat like set it to manual or something and are natting any traffic from these interfaces?
This is clickity clickity works out of the box.. So either you have something wrong on the clients, or you maybe dicked with outbound natting? You put in a floating rule that blocks? Without more info its impossible to say where your problem is.. But you would never need to create a route to a network that is directly connected to a router. That is any router not just pfsense.
-
Here's some more info. Machine snowdrop.duck.loc in network 10.0.1.0/24
On machine 10.0.0.3 in network 10.0.0.0/24:
-
To add some more info as we cross-posted… :) thanks v. much BTW for your time!
Machine 10.0.1.1 is a Hyper-V VM hosted by a machine called fluorine on IP 10.0.0..9. Connected to a vSwitch called Lab.
pfSense is a Hyper-V VM also hosted on fluorine with two vSwitches one is LAN and connected to the physical NIC and the other is a vSwitch connected to LAB.Machine 10.0.0.3 is a physical Windows 10 box.
The Hyper-V host and the desktop are connected via a gigabit hub.
EDIT:
Also add that there are no floating rules and I can ping both machines from within pfSense itself in the Diagnostics menu just fine. The devices can also ping the pfSense interface as well with no issues.
-
Your on hyper-V.. Should of mentioned that from the get go!!!
Where are your floating rules?
So looks like you can ping the gateway on your interface which is great… Ok ping the pfsense interface in the other network.. Ie ping 10.0.0.4 from your 10.0.1.x machine.. Does that work?
https://doc.pfsense.org/index.php/Virtualizing_pfSense_under_Hyper-V
-
Floating rules are above, none configured. Sorry yeah should have mentioned Hyper-V but it really shouldn't factor.
On machine 10.0.1.1 I can ping pfSense interface 10.0.0.4 fine.
On machine 10.0.1.1 I cannot ping physical machine (my desktop) 10.0.0.3 (Request timed out).
On machine 10.0.0.3 I cannot ping pfSense interface 10.0.1.4 (Request timed out).Odd.
Here's my Hyper-V switches in case it's relevant:
-
Getting strange.
I have a VM on the Hyper-V host called neon.localdomain with IP 10.0.0.10.
I can ping that from machine 10.0.1.1, but machine 10.0.1.1 cannot ping the Hyper-V host interface 10.0.0.9 or my desktop 10.0.0.3.
-
On machine 10.0.0.3 I cannot ping pfSense interface 10.0.1.4 (Request timed out).
Well that is going to be a problem.. What is the config of this machine, what is its gateway what is its mask.. Does it have any routes on it, vpn client? Do a simple traceroute from it to the 10.1.1.4 IP..
Hyper-V should not be a problem no - but there are some gotcha's with such a setup..
-
Here are the settings for machine 10.0.0.3. I do have Private Internet Access VPN client installed but it's not running. I also have the Hyper-V service on this machine but not currently using it. It is joined to domain duck.loc where machine 10.0.1.1 is the domain controller so quite important it can connect to it! :)
The default gateway is my Netgate device to go to the internet (10.0.0.1)
Here's the tracert
-
And look at the gateway… its 10.0.0.1 not 10.0.0.4 which is what you have pfsense lan IP set to..
How do you expect to get to the 10.0.1 network on pfsense if you point it towards your internet router?
Let me refer back to my first post ;) "did you set gateway on the machines correctly"
If your going to want to use a different gateway to get to the 10.0.1 network then you will need to put a host route on that machine that says hey you want to get to 10.0.1.0/24 use 10.0.0.4
-
A-ha!! :)
I added the second gateway into my machine and I can now ping 10.0.1.4 from 10.0.0.3. Feel like we're making some progress!
However, I can't ping 10.0.1.1 from 10.0.0.3…
What is odd is that I can ping the 10.0.1.1 machine from the LAN interface on pfSense:
-
You converted your WAN to LAB interface?
You have to disable all outbound NAT.
-
NO that is NOT the correct way to do it!!! Create a route to use not a default gateway - arrrgghhh..
-
You converted your WAN to LAB interface?
You have to disable all outbound NAT.
No I converted LAN to LAB interface and converted WAN to LAN interface. Here are my NAT outbound rules:
-
NO that is NOT the correct way to do it!!! Create a route to use not a default gateway - arrrgghhh..
OK, ok! :)
I've done this now and all good from 10.0.0.3 to 10.0.1.1!
I can also now ping from 10.0.1.1 to 10.0.0.3!!
I do however, have one small issue. I can't ping the netgate router (10.0.0.1) from my LAB network. Any ideas on why?
-
Hi everyone, thanks for reading, I still have an issue where no servers on the LAB domain can access the internet. I can't ping the LAN interface of my Netgate WAN router from the LAB network, but I can ping it from the LAN network. Any ideas?
-
Draw a picture of how you have this set up and talk about your ultimate goals.
-
Draw a picture of how you have this set up and talk about your ultimate goals.
OK. :)
Here's the network diagram.
I want pfSense on beryllium to allow traffic both ways between LAN and LAB networks unhindered. It seems that machines in LAB network can't reach some machines in LAN, but machines in LAN can reach all machines in LAB. Here are the results from a machine on each network.
On cowslip.duck.loc
Cannot ping 10.0.0.1, 10.0.0.8 (timed out)
Can ping 10.0.0.10, 10.0.0.4, 10.0.0.3, 10.0.0.9, 10.0.1.1, 10.0.1.4On lithium.duck.loc
Can ping everywhere fineHere are the firewall rules on beryllium.localdomain
-
All working now, I needed a static route to the LAB network on the SG-1000 router. Thanks for looking everyone!!
-
"I needed a static route to the LAB network on the SG-1000 router."
If your network is how you drew it you have asymmetrical setup.. If you want to use use your sg1000 router to get to the internet it should be on a transit network to your downstream router.. You shouldn't be using 10.0.0 as your transit or your going to have to put host routes on all boxes on that network..
-
Hmmm…
My SG-1000 only has two interfaces, so how would this work in practise? Would I have to create a VLAN for the transit network?
