How to configure pfSense as a router for two internal LAN subnets?

mewsense

Draw a picture of how you have this set up and talk about your ultimate goals.

OK. :)

Here's the network diagram.

I want pfSense on beryllium to allow traffic both ways between LAN and LAB networks unhindered. It seems that machines in LAB network can't reach some machines in LAN, but machines in LAN can reach all machines in LAB. Here are the results from a machine on each network.

On cowslip.duck.loc
Cannot ping 10.0.0.1, 10.0.0.8 (timed out)
Can ping 10.0.0.10, 10.0.0.4, 10.0.0.3, 10.0.0.9, 10.0.1.1, 10.0.1.4

On lithium.duck.loc
Can ping everywhere fine

Here are the firewall rules on beryllium.localdomain

mewsense

All working now, I needed a static route to the LAB network on the SG-1000 router. Thanks for looking everyone!!

johnpoz

"I needed a static route to the LAB network on the SG-1000 router."

If your network is how you drew it you have asymmetrical setup.. If you want to use use your sg1000 router to get to the internet it should be on a transit network to your downstream router.. You shouldn't be using 10.0.0 as your transit or your going to have to put host routes on all boxes on that network..

mewsense

Hmmm…

My SG-1000 only has two interfaces, so how would this work in practise? Would I have to create a VLAN for the transit network?

kpa

Using VLANs for that is fine but you must have a VLAN capable switch that can demux the tagged trunk traffic to selected switch ports.

Flowi001

@mewsense said in How to configure pfSense as a router for two internal LAN subnets?:

All working now, I needed a static route to the LAB network on the SG-1000 router. Thanks for looking everyone!!

May you please do elaborate on this solution?

Thank you

stephenw10

If you have a downstream (internal) router with other subnets behind it pfSense needs static route to those so it knows where to route traffic.

https://docs.netgate.com/pfsense/en/latest/routing/static.html#example-static-route