Netgate SG-3100 LAN ports cannot go through LAN Gateway.

johnpoz

@stephenw10 said in Netgate SG-3100 LAN ports cannot go through LAN Gateway.:

Do you see the connected LAN client in the ARP table? (Diag > ARP)

That is a very good point... Do you maybe have anything with static arp setup?

When you ping pfsense, from you pc... What does pfsense show in its arp table for this client IP.. Does the mac in the table match?

where is that block ! mvneta1 inet from 192.168.1.0/24 to any coming from?

Make sure you remove any ! rules...

stephenw10

@johnpoz said in Netgate SG-3100 LAN ports cannot go through LAN Gateway.:

where is that block ! mvneta1 inet from 192.168.1.0/24 to any coming from?

That's a system default rule. It blocks traffic from an assigned subnet arriving on any other interface.

stephenw10

When DHCP works but nothing else does my first thought is a missing firewall rule. But those rules look good. And with pf disabled you should always be able to reach the LAN IP.
Also you should be able to ping out to a client on LAN with no rules in place.

So then why is it not replying... a bad route perhaps or subnet conflct. But those also look good.

So then we have mystery disappearing packets and that is usually either the IPSec daemon grabbing them or captive portal blocking that traffic in ipfw.
Do you have either IPSec or Captive Portal configured?

Steve

mmajian

@johnpoz @stephenw10 No I don't see connected LAN client in the ARP table. I only the LAN itself.

johnpoz

Well that going to be kind of problem answering something... But how did you sniff, you should of seen arp go out if pfsense did not know what it was..

mmajian

@johnpoz @stephenw10 And I don't have either IPSec or Captive Portal configured. Here is my IPSec Advanced Settings:

johnpoz

Well it would be impossible for pfsense to answer back if there is no mac for it to send the traffic too.

So sniff when you ping the pfsense again, making sure your sniffing all.. You should see an arp... and answer

kiokoman

reinstall from scratch, who know what experimentation you did in the last two month to end like this, i think it would be faster even if it would be more fun to understand what is it :)

mmajian

@johnpoz I sorry what do you mean to sniff when ping pfSense.

stephenw10

Run a packet capture on LAN. Set promiscuous mode. Leave the settings at 'any' to capture everything. Set, say, 1000 packets.
Connect the lan client and start pinging.

You should see the DHCP traffic at the very least.

If you see incoming ping requests and no replies you should see ARP requests instead if that client is still not in the ARP table.

Steve

kiokoman

and .. do you remember if you have made any changes inside System / Advanced / System Tunables ?

mmajian

@stephenw10 @johnpoz
Here is package capture: (LAN is 192.168.1.1, LAN client is 192.168.1.115)
packagecap.txt

mmajian

@kiokoman I don't remember I changed that, here is mine:

Derelict

@mmajian said in Netgate SG-3100 LAN ports cannot go through LAN Gateway.:

@stephenw10 @johnpoz
Here is package capture: (LAN is 192.168.1.1, LAN client is 192.168.1.115)
packagecap.txt

If that packet capture is still available for download, download it and attach it.

mmajian

@Derelict
packetcapture.cap
Attached is packet capture file.

Derelict

The first problem I see is 192.168.1.115 is asking 192.168.1.1 for DNS and it is not responding.

How is DNS configured on the firewall? Services > DNS Resolver or Services > DNS Forwarder needs to be enabled or the clients need to be configured to use something like google or cloudflare for DNS.

The second problem I see is that whatever device is d0:50:99:d0:00:ed ( D0:50:99 AsrockIn ASRock Incorporation) keeps asking for an ARP WHO HAS 192.168.1.115 when that is its own IP address. Of course nobody's going to answer, and why is it even asking?

I think you can start looking for causes of whatever it is you are seeing off the firewall.

Detach whatever switch is connected and connect to one of the LAN ports. Does it work?

mmajian

@Derelict Thank you.
The DNS Forwarder is disabled. The DNS resolver is below (I don't think I changed this):

And yes the device d0:50:99:d0:00:ed is the Win10 computer connect to LAN1. I will try disconnect all ports except LAN1 and see what will happen.

mmajian

@Derelict @stephenw10 @johnpoz
Very good news. I add a static mapping in DHCP server for Win10 computer and check "Create an ARP Table Static Entry for this MAC & IP Address pair.".

Now it can ping 192.168.1.1 and solve the immediate problem.
In LAN DHCP server I did check "Enable Static ARP entries"

Is this means all dynamic DHCP won't have entries in ARP?
Can anyone explain why? Thank you so much.
Jian

johnpoz

Oh my freaking gawd... So you had set static arps but had no static arps? So yeah no shit pfsense not going to be able to talk to your clients..

Why do people click on shit when they have no clue to what it does??

How exactly did you get to that where you clicked that??? Without actually hitting the gui at first, and then clicking that would of broken your connection.

Going to have to just stop thinking people didn't randomly start clicking shit without a clue.. And just say install clean do not touch a damn thing - does it work.. There you go!!! Just at a loss to how you did not mention that you clicked that - that sure and and the F is not default!! Why would you click on it - it clearly states what it does!!!

Do we have to explain - only the machines listed below will be able to communicate.. Seems pretty clear to me ;)

mmajian

@johnpoz Yeah I was trying to add some static mappings in DHCP several weeks ago so I checked this. But I didn't know it will dis-communicate normal DHCP client.
In my defense, I understand this as - only the machines listed below will be able to communicate when DHCP server is disabled.
And I would change this label as "Only Static ARP Entries"
Thank you.