Firewall Rules to Allow VLAN and LAN to Communicate
-
Hi,
Hopefully this is relatively simple but i'm a newcomer to pfsense and networking in general. The last couple of months have been an excellent crash course and my knowledge is building up yet there is one problem i cannot solve logically.
I have added a VLAN to my pfsense setup and this all seems to be working ok, the switch is configured correctly and devices on the VLAN (my wireless AP's) receive an IP address from the VLAN. They can also reach the internet.
What i can't seem to do is allow the LAN and the VLAN to talk to one another. Most guides are about segregating the VLAN from the LAN, which i want to do with my next effort for an IOT VLAN, but first i want a VLAN for my wireless AP's so i can track data usage for the interface as a proxy for wifi data use which i am unable to get due to my AP's not supporting SNMP.
I have a rule on the VLAN interface allowing access to all. This seems to work in allowing access to the internet but not to the LAN. I'm not certain if i am supposed to be adding a firewall rule to the LAN interface? Logically this seems possible as i need the ping to be returned from LAN to VLAN. But there is already a rule on LAN which allows communication to all, this was added by pfsense during the initial config. I can see it is slightly different to the rule on the VLAN interface in that it has a gateway associated with it, but even with a manually inserted rule above this to mirror the rule on VLAN and simply allow to all, I cannot get a response from LAN while on VLAN.
Hopefully this is blindingly obvious to someone with more experience so please be gentle with your replies :)
Thanks!
-
If you have a rule on vlan that is any any, then you not talking to something on lan is most likely a local firewall on that devices not allowing the traffic.
-
thanks you helped me solve it.
my error, for anyone else that has the same issue is thinking that ping would respond even if a firewall was present. Actually everything was working, i just hadnt believed it and tried anything further as ping was not responding. a schoolboy error i am sure
