• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

VLAN cannot access to internal website

Scheduled Pinned Locked Moved General pfSense Questions
18 Posts 2 Posters 1.8k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • M
    MR. Newbie
    last edited by Oct 30, 2019, 1:32 AM

    Please help!
    I configured pfsense with VLANs, and we have internal website for ticketing system.
    Setup on VLANs: firewall, all Vlans with protocol any and destination any.
    Setup on LAN: in default.
    DNS resolver: enabled
    Scenario:
    When I connect to LAN which network 192.168.20.0/22 I can access our internal website, (internet options: proxy-enabled and except our internal website. There is no problem when I browse the internal website, I can access everything inside of it and can browse the internet.
    But when I connect to Vlans with its port and network 192.168.2.0/23, I can access the internet there's no problem at all except from accessing our internal website. Internal website is not working.
    Is there somebody here can help me figure it out.

    Thank you all and God bless

    1 Reply Last reply Reply Quote 0
    • J
      johnpoz LAYER 8 Global Moderator
      last edited by johnpoz Oct 30, 2019, 1:39 AM Oct 30, 2019, 1:35 AM

      Post you rules - you sure you didn't force a gateway? Common problem with users and trying to access is other vlans is they are forcing traffic out a gateway before they allow access to other local networks.

      Can your vlan client ping the pfsense lan IP? 192.168.20.1 ? guessing?
      Can lan device ping the IP of the vlan IP guessing 192.168.2.1?

      Just out of pure curiosity why such large networks? Do you really have something close to 1k devices on your lan with that /22

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      M 2 Replies Last reply Oct 30, 2019, 1:39 AM Reply Quote 0
      • M
        MR. Newbie @johnpoz
        last edited by Oct 30, 2019, 1:39 AM

        @johnpoz Yes sir, from VLAN I can access the pfsense webgui. and I can access the internet. The only problem is browsing our internal website 192.168.20.5/portal/ inside VLAN, but in LAN no problem at all.
        Thanks for quick reply

        1 Reply Last reply Reply Quote 0
        • J
          johnpoz LAYER 8 Global Moderator
          last edited by johnpoz Oct 30, 2019, 1:42 AM Oct 30, 2019, 1:41 AM

          That is not what I asked..What IP are you accessing? The vlan IP or the Lan IP?

          Please post your rules!!! Even if you think they are default and correct... You have no rules in your floating?

          99 out of 100 times when user says they did X, they really did Y..

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • M
            MR. Newbie @johnpoz
            last edited by Oct 30, 2019, 1:42 AM

            @johnpoz from LAN I can ping all VLANs, all users connected to different VLANs can work without any problem. they can access their file server, all file server connected to LAN, and all user can access the internet but not the internal website

            1 Reply Last reply Reply Quote 0
            • J
              johnpoz LAYER 8 Global Moderator
              last edited by Oct 30, 2019, 1:44 AM

              And they are using the internal IP..

              If you can access another device in the vlan, then it has nothing to do with pfsense... You sure this http server doesn't have a firewall, and is using pfsense as its gateway?

              Simple sniff on pfsense lan IP when you try and access the web gui IP, 192.168.20.5 - if you see pfsense send the syn, then its on the web server - firewall maybe?

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              M 2 Replies Last reply Oct 30, 2019, 1:51 AM Reply Quote 0
              • M
                MR. Newbie @johnpoz
                last edited by Oct 30, 2019, 1:51 AM

                This post is deleted!
                1 Reply Last reply Reply Quote 0
                • J
                  johnpoz LAYER 8 Global Moderator
                  last edited by Oct 30, 2019, 1:53 AM

                  What is that suppose to be?

                  Do you not know how to post an image ?

                  postimage.jpg

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  M 1 Reply Last reply Oct 30, 2019, 1:58 AM Reply Quote 0
                  • M
                    MR. Newbie @johnpoz
                    last edited by Oct 30, 2019, 1:55 AM

                    @johnpoz said in VLAN cannot access to internal website:

                    You sure this http server doesn't have a firewall, and is using pfsense as its gateway?

                    http sir server firewall is off, and configured static ip with pfsense gateway. That is why I can access in LAN, I just wonder why in VLAN i cannot browse even it is exempted in internet option proxy.

                    Thank you sir for all your replies. God bless

                    1 Reply Last reply Reply Quote 0
                    • M
                      MR. Newbie @johnpoz
                      last edited by Oct 30, 2019, 1:58 AM

                      This post is deleted!
                      1 Reply Last reply Reply Quote 0
                      • J
                        johnpoz LAYER 8 Global Moderator
                        last edited by Oct 30, 2019, 1:59 AM

                        Well I can not see them.. ;)

                        Are you using an explicit proxy or transparent.. Again - take 2 seconds and sniff.. Do you see pfsense sending the syn?

                        Here sniffing on one of my vlans while I hit 80 from a different vlan

                        See while sniffing on the 192.168.3 interface I see packet from 192.168.9.100

                        sniff.jpg

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        M 1 Reply Last reply Oct 30, 2019, 2:07 AM Reply Quote 0
                        • J
                          johnpoz LAYER 8 Global Moderator
                          last edited by johnpoz Oct 30, 2019, 2:06 AM Oct 30, 2019, 2:01 AM

                          So your floating rule is forcing traffic out that loadbalancer gateway - so NO you wouldn't be able to get to you lan from there.

                          Create a rule That allows where your trying to go before you force traffic out a gateway. As I stated in post 1.

                          Put a rule above your floating that allows your annex net to get to your server IP on the lan net.. With such a rule I don't see how your saying your accessing your file servers to be honest.

                          BTW your 2 bottom rules on your lan are completely pointless and would never be triggered.. Since you have an any rule above them.

                          Rules are evaluated top down, first rule to trigger wins, no other rules evaluated.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          M 1 Reply Last reply Oct 30, 2019, 2:12 AM Reply Quote 0
                          • M
                            MR. Newbie @johnpoz
                            last edited by Oct 30, 2019, 2:07 AM

                            @johnpoz said in VLAN cannot access to internal website:

                            Are you using an explicit proxy or transparent

                            Transparent proxy : disabled . because I'm using squid proxy LDAP authentication

                            1 Reply Last reply Reply Quote 0
                            • M
                              MR. Newbie @johnpoz
                              last edited by Oct 30, 2019, 2:12 AM

                              @johnpoz said in VLAN cannot access to internal website:

                              Create a rule That allows where your trying to go before you force traffic out a gateway

                              After giving it a try. I think its working now. BIG HELP sir. Thank you so much . I love u. :)

                              1 Reply Last reply Reply Quote 0
                              • J
                                johnpoz LAYER 8 Global Moderator
                                last edited by Oct 30, 2019, 2:15 AM

                                Glad I could help..

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                M 1 Reply Last reply Oct 30, 2019, 2:21 AM Reply Quote 0
                                • M
                                  MR. Newbie @johnpoz
                                  last edited by Oct 30, 2019, 2:21 AM

                                  @johnpoz YES sir, All vlan can now access our internal websites. ehehe. Now I will try to create another rule for our loadbalancer. ehehe. currently I just remove it because today is my deadline for me to run the website on all users. :)

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by Oct 30, 2019, 2:22 AM

                                    You need to make sure you allow access to what you want locally to access before you shove anything out a gateway. Remember the rule orders.

                                    https://docs.netgate.com/pfsense/en/latest/firewall/firewall-rule-processing-order.html

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    M 1 Reply Last reply Oct 30, 2019, 2:33 AM Reply Quote 0
                                    • M
                                      MR. Newbie @johnpoz
                                      last edited by Oct 30, 2019, 2:33 AM

                                      @johnpoz Noted sir, Thank you. I will post another topic regarding failover, again that one is with VLAN problem :)
                                      Thank you for early christmas gift. new Knowledge ehehe

                                      1 Reply Last reply Reply Quote 0
                                      3 out of 18
                                      • First post
                                        3/18
                                        Last post
                                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                        This community forum collects and processes your personal information.
                                        consent.not_received