Netgate SG-3100 LAN ports cannot go through LAN Gateway.

mmajian · Oct 14, 2019, 7:46 PM

@Derelict Thank you very much for trace-route. But why can I ping 192.168.1.1 from WirelessNetwork. I think anything from WirelessNetwork net to LAN net should be blocked by default.

Derelict · Oct 14, 2019, 7:55 PM

Well, if you want to BLOCK traffic on from Wireless network to LAN net then BLOCK it. Don't block traffic with a pass rule.

Add a rule above what you have that blocks traffic to destination LAN net above what you have and see if the behavior changes.

mmajian · Oct 14, 2019, 8:21 PM

@Derelict Great, thank you. I created a BLOCK rule and it's working.
Now I am backing LAN ports can't reach LAN gateway problem. Looks like fixing problems with WirelessNetwork doesn't fix LAN net.

mmajian · Oct 14, 2019, 9:53 PM

@stephenw10 I connect one of the Win10 computer to LAN1 port and Switch setting is here:

🔒 Log in to view

It's getting correct IP address from LAN DHCP 192.168.1.115, but is't offline
🔒 Log in to view

I started Packet capture on LAN interface for IPv4 only.
🔒 Log in to view
Looks like LAN can receive from Win10 computer but never reply.

johnpoz · Oct 14, 2019, 10:40 PM

Ok that is good info, now lets see your actual switch config.

mmajian · Oct 14, 2019, 10:50 PM

@johnpoz Sorry I am new to pfSense. What is actual switch config and how to view it? Thanks.

Derelict · Oct 14, 2019, 11:30 PM

@mmajian said in Netgate SG-3100 LAN ports cannot go through LAN Gateway.:

@Derelict Great, thank you. I created a BLOCK rule and it's working.
Now I am backing LAN ports can't reach LAN gateway problem. Looks like fixing problems with WirelessNetwork doesn't fix LAN net.

Yet another victim.

Someday people will listen.

johnpoz · Oct 14, 2019, 11:39 PM

See that tab you showing the ports - hit the vlan tab.. lets make sure nothing messed up there

🔒 Log in to view

That is the default settings, from one of my 3100s

You don't have any rules in in your floating tab do you? And for good measure lets see the routes.. under diag..

mmajian · Oct 15, 2019, 3:44 AM

@johnpoz Yes, my VLANs setting are same as yours. And I don't have rules in floating tab. And here is the routes:
🔒 Log in to view

johnpoz · Oct 15, 2019, 12:28 AM

Have you tried reloading the firewall rules? Or I take it you have tried rebooting it? ;)
Try changing the IP to say 192.168.2.1/24 on the lan interface?

Everything looks right..

Are you seeing any errors on the interface, in the interface status?


LAN Interface (lan, igb0)

Status
    up
MAC Address
    00:08:a2:0c:e6:24 - ADI Engineering
IPv4 Address
    192.168.9.253
Subnet mask IPv4
    255.255.255.0
IPv6 Link Local
    fe80::208:a2ff:fe0c:e624%igb0
IPv6 Address
    2001:470:snipped::253
Subnet mask IPv6
    64
MTU
    1500
Media
    1000baseT <full-duplex>
In/out packets
    461831409/992950006 (321.12 GiB/1.27 TiB)
In/out packets (pass)
    461831409/992950006 (321.12 GiB/1.27 TiB)
In/out packets (block)
    8743/0 (506 KiB/0 B)
In/out errors
    0/0
Collisions
    0

You tried a different port?

stephenw10 · Oct 15, 2019, 12:27 AM

Looks like you have pfBlocker installed. Let's see the floating firewall rules. You maybe need to edit them to see all the info.

That can block and not log traffic in LAN if it;s not configured correctly.

Steve

johnpoz · Oct 15, 2019, 12:29 AM

He stated he has no rules on floating.

You didn't setup any port forward rules did you?

I would like to see the full output of the rules to be honest
https://docs.netgate.com/pfsense/en/latest/firewall/viewing-the-full-pf-ruleset.html

mmajian · Oct 15, 2019, 12:36 AM

@johnpoz No, zero errors on LAN interface and I did tried different ports. And I did tried change LAN IP to 192.168.10.1/24, still not working.

mmajian · Oct 15, 2019, 12:37 AM

@stephenw10 I disabled pfBlocker but no luck.

mmajian · Oct 15, 2019, 12:50 AM

@johnpoz No port forward rules. No errors on LAN interface:
🔒 Log in to view
Here are all rules
🔒 Log in to view
🔒 Log in to view

Derelict · Oct 15, 2019, 3:46 AM

@mmajian said in Netgate SG-3100 LAN ports cannot go through LAN Gateway.:

Yes, my VLANs setting are same as yours.

Please post them.

It's not rules (though it looks like you are still using a ! LAN net rule for some inexplicable reason.)

mmajian · Oct 15, 2019, 3:58 AM

@Derelict Sure, here is my VLAN:
🔒 Log in to view
Here are ports:
🔒 Log in to view
And I disabled all firewall rule here:
🔒 Log in to view
I uninstalled pfBlocker and disabled OpenVPN. Then reboot the firewall but still no luck.
Next thing I am going to try is reset to factory default.
But if that still not working I think it might be the hardware problem.

stephenw10 · Oct 15, 2019, 10:27 AM

Disabling pf will, as it says there, disable NAT so you will be unable to connect to any public IPs from any internal interface.
You should still be able to connect to LAN though...

It seems unlikely to be a hardware issue since clients on LAN are still able to pull a DHCP address, traffic is able to flow both ways for that to happen.

Do you see the connected LAN client in the ARP table? (Diag > ARP)

Steve

johnpoz · Oct 15, 2019, 1:01 PM

@stephenw10 said in Netgate SG-3100 LAN ports cannot go through LAN Gateway.:

Do you see the connected LAN client in the ARP table? (Diag > ARP)

That is a very good point... Do you maybe have anything with static arp setup?

When you ping pfsense, from you pc... What does pfsense show in its arp table for this client IP.. Does the mac in the table match?

where is that block ! mvneta1 inet from 192.168.1.0/24 to any coming from?

Make sure you remove any ! rules...

stephenw10 · Oct 15, 2019, 1:01 PM

@johnpoz said in Netgate SG-3100 LAN ports cannot go through LAN Gateway.:

where is that block ! mvneta1 inet from 192.168.1.0/24 to any coming from?

That's a system default rule. It blocks traffic from an assigned subnet arriving on any other interface.