Why cant i reach the other network while i have added the routes and firewall rules to allow traffic? (Pfsense/USG200)

CodeNinja

See my Stackexchange post for all details as askimet sees my config and diagram(s) as spam: https://networkengineering.stackexchange.com/questions/67889/why-cant-i-reach-the-other-network-while-i-have-added-the-routes-and-firewall-ru

I have 2 networks, the current one and the new one. The current one is not configured by me and one big mess and contains heavily out dated hardware (especially servers). I want to be able to access the complete current network from the new one so i can migrate server for server and device for device.

Some network details:

Current network:
- IP: 192.168.1.1
- IP range: 192.168.104.0/24
- Router/firewall: Zyxel USG200
- Contain all currently connected devices
- Gives DHCP address to Pfsense (192.168.104.4/24)
New network:
- IP: 10.128.10.1
- IP range: 10.128.10.0/24.
- Router/firewall: Pfsense
- Currently it contains only 1 device, my desktop but this network will replace the current one in future
- All devices will be "moved" from the old to the new network by time (one for one)
- Connected with old network by port with alias "WAN 2"

I added a route in each firewall to the other network.

Zyxel: 10.128.10.0/24 via 192.168.104.4
Pfsense: 192.168.104.0/24 via "WAN2"

I also added a firewall rule to each firewall to allow all traffic from all sources to all destinations (for testing)

When i ping 192.168.104.1 with pfsense diagnostics, i got a response. I cannot find a way to do a ping from the Zyxel to Pfsense but as the route bellow is in the routing table i assume the (at least) routing configuration must be okay.

When i try to ping 192.168.104.1 (or any other device in the 104.x network) from my desktop in the 10.128.10.x network, i got a "request timed out" response. I also cannot SSH or browse to any IP in the 104.x network. When i connect my desktop to the 104.x network and try to ping 10.128.10.1 or try to visit that IP in my browser (Pfsense web interface) i also got "request timed out"

A print screen of my firewall rule on Pfsense (on the desktop interface): enter image description here

And one from my firewall rule in the Zyxel: enter image description here

Probably i miss some configuration/settings but i have no idea what. Would be great when someone can help me out with this as i'm already struggling almost 2 days with this. When extra details are required, let me know and i will update my question.

stephenw10

Do you have outbound NAT in auto mode? Is pfSense NATing from WAN2?

If it is you should be able to reach devices in the pfSense WAN subnet (192.168.104.0/24).

If it is not you will have an asymmetric route as hosts in the WAN subnet try to reply via 192.168.104.1.
https://docs.netgate.com/pfsense/en/latest/firewall/troubleshooting-blocked-log-entries-due-to-asymmetric-routing.html

Steve

CodeNinja

@stephenw10 First of all, thanks for your answer.

I tried with Outbound NAT in automatic mode and in manual mode with the rules:
WAN1 10.128.10.0/24 * * * WAN1 address * this is not a rule to the WAN 2 where the 192.168.104.0 network exists.
Should i make a NAT rule to WAN2 ?
Something like:
WAN2 192.168.104.0/24 * * * WAN2 address * ?

I also tried to enable the Bypass firewall rules for traffic on the same interface setting. Unfortunately i still not able to reach the 192.168.104.0 network from the 10.128.10.0 or visa versa.

I thought adding a static route on each firewall and add the correct firewall rule (to allow traffic from the other network on the concerning interface) should do the trick? but how i understand from you i miss something (NAT?) ?

Note that i can ping the Zyxel USG200 interface and devices of the 192.168.104.0 network from the Pfsense diagnostics ping tool but not from my computer.