Ping problem
-
Hi,
Can anyone help me.
I have LAN and OPT1 interfaces.
Any host from LAN interface cannot ping host from OPT1 interface, and vice versa.I already allow ICMP traffic from both interface.
Thanks. -
And where did you put those rules.. On your lan? Please post up your full rules for lan and opt1
Lan defaults to any any, so you shouldn't have to mess with rules on lan to ping into opt
Keep in mind that out of the box for example the windows firewall would not allow ping from network other than its local network... So even if pfsense rules allow it, the local firewall would not allow ping from the other network.
-
This is my LAN rules
This is my OPT1 rules
-
rules are a bit messed up but
destination for icmp is wrong
on LAN your icmp destination should be OPT1
and on opt1 your destination must be LAN -
Hi @kiokoman thanks for the reply. But I already did that before, but got any luck.
-
Most of those rules are pretty pointless to be honest
Rules are evaluated top down, first rule to trigger wins.. No other rules are evaluated.
What is the point of pinging lan net when your on the lan net? You don't talk to pfsense to ping stuff on your own network... So that rule would never be used anyway. And you already have a rule that says lan net can do whatever it wants. So again what is the point of the icmp rule in the first place even if was used?
Again - just because you allow something on pfsense, doesn't mean the host firewall will allow it.. Your lan rules allow ping to opt... So if your not pinging something on opt.. Then possible the opt device doesn't allow it..
-
"Keep in mind that out of the box for example the windows firewall would not allow ping from network other than its local network... So even if pfsense rules allow it, the local firewall would not allow ping from the other network."
-I get this. I can ping other host within the same subnet. Just the LAN to OPT1 and OPT1 to LAN ping is not working. Also, I can ping the 192.168.0.1 and 172.16.0.1 from any of the host in both subnet.
Hope this helps.
-
@Tenggoy said in Ping problem:
Hope this helps.
Hope this helps what... I am not having the issue... You get what? What does pinging pfsense IP from the networks have to do with a firewall on the host saying sorry buddy not going to answer your ping your not from my local network...
Sniff on your opt interface, while you ping a device on opt from lan... Do you see the pings go out... If so then its NOT pfsense that is the problem.
-
And you already have a rule that says lan net can do whatever it wants. So again what is the point of the icmp rule in the first place even if was used?
-This is where my confusion falls. Even if I have the rule that LAN is permitting to any, I cannot ping any host from the OPT1 net.
-
@johnpoz said in Ping problem:
er your ping yo
To put my answer:
What does pinging pfsense IP from the networks have to do with a firewall on the host saying sorry buddy not going to answer your ping your not from my local network...
-I have a shared storage on each subnet that need to be access by the host from the other subnet.
Sniff on your opt interface, while you ping a device on opt from lan... Do you see the pings go out... If so then its NOT pfsense that is the problem.
-I don't get any PINGs out.
-
@Tenggoy said in Ping problem:
cannot ping any host from the OPT1 net.
And again!!! what firewall do you have on this device in opt1... Sniff on your opt interface while you ping - do you see pfsense send the pings to the device.. Do you see an answer, if not then its the opt device that is not answering!
that is not a sniff.. No shit if if the device doesn't allow pings from other networks, its not going to answer a ping from 172.16..
-
Just the standard Windows Defender installed on all PCs in both subnet buddy.
-
And out of the box windows does not allow pings from other network!!!!
-
@johnpoz I get it bud. But is there any work around for this? Or none?
-
Yes edit the local firewall rules... To allow what you want..
Either put in your opt network, or lan network depending on where the device is... Or allow any remote IP to ping it
-
red is wrong and pointless
yellow this rule permit everything from your lan network so LAN can ping everywhere (but this does not mean that other network can ping LAN)
yellow is wrong and pointless
red this permit your opt to go everywhere and ping LAN (but this does not mean that other network can ping OPT)so the rules you have already permit to ping and if there is no answer there must be another firewall on the machine itself that block it, under windows try to disable the firewall or add a rule that permit public ip to ping -> as johnpoz suggested!)
-
