Can't access DMZ from LAN
-
I have created a LAN interface and DMZ interface. I am able to ping DMZ gateway from LAN, But i am unable to ping any DMZ hosts from LAN. Can anyone help me on this?
-
The common issue for this is dmz has host firewall, or using a different gateway.
-
I have done a Multi-WAN load balancer for LAN. So the default gateway is the gateway group created. I will try changing DMZ gateway too to the gateway group.
-
No that is not what you would do... You should of mentioned you were forcing traffic out a gateway.
Make sure you have a rule on your lan that allows access to your dmz before you policy route traffic out your gateway group.
-
Yes I have created a rule in LAn Protocol->Any Source->Lan Net Dest -> DMZ net. I can ping the gateway from the LAN host but not the DMZ servers
-
post up your lan rules please - picture. The rule has to be ABOVE your policy routing rule. If it is and you can not ping host in dmz.. Then again is dmz host running a firewall that allows access from your lan net, is the dmz host actually using pfsense dmz IP as its gateway.
Simple sniff would validate that pfsense is sending on the traffic to the dmz host.
-
I have allowed all the traffic from LAn net to DMZ_NET
-
I
Here is the picture of LAN rules.
-
Well don't see any hits on that rule.. ie the 0/0
Sniff on pfsense lan, do you see your traffic hit pfsense dest for dmz? Sniff on dmz interface on pfsense - do you see the traffic sent to the dmz host?
If so then its on the dmz host.. This is like 2 seconds to troubleshoot.
Do you have any rules in floating? Like blocking access to dmz, which would explain why you have zero hits on your dmz rule.
-
And this are the DMZ rules
-
I have enabled Snort on DMZ for IPS. Could that be an issue?
-
Dude your rules on dmz have ZERO to do with the problem..
You don't need any rules on dmz for lan to talk to dmz.. The return traffic from dmz back to your client starting the conversation with some on dmz would be allowed by the state.
Do you have any rules in floating?
If not then do a simple sniff on lan - do you see the traffic from your lan host going to your dmz IP your trying to talk to.. Great.. Do same sniff on dmz interface - do you see traffic when you try and talk to dmz? If so then problem on your dmz host.
Post back with your sniff results.. I can duplicate this for you in like 2 minutes if you need to see pictures or something..
