One host inaccessible, others are fine

peterlecki

OpenVPN works and I can connect just fine. I can access most hosts. Except one. They're all on the same network. I can ping 192.168.1.1 and .50 but not .11 even though it does respond to pings from hosts on that LAN. It's not only ICMP, same story with HTTP.

viragomann

@peterlecki
Check the hosts firewall. It might block access from outside the subnet it resides.

peterlecki

@viragomann
The device is a managed switch so it doesn't have a firewall but it could be hard-coded to only communicate with hosts on the same subnet. Which would explain why I can't reach from the VPN subnet.

viragomann

@peterlecki said in One host inaccessible, others are fine:

The device is a managed switch

Does it have a gateway setting?

Even this or any, you can do a workaround with masquerading on pfSense by setting up an outbound NAT rule for this device.

Bambos

i had this issue before. The problematic device gateway, is not the pfsense lan gateway as it should.

peterlecki

@viragomann @Bambos
Thanks guys for pointing out yet another user error ID10T

audiobahn

@viragomann said in One host inaccessible, others are fine:

@peterlecki said in One host inaccessible, others are fine:

The device is a managed switch

Does it have a gateway setting?

Even this or any, you can do a workaround with masquerading on pfSense by setting up an outbound NAT rule for this device.

Hi, I'm having a similar issue with some ports of a specific host not being accessible over an OpenVPN connection even though they're accessible over the LAN. Would the "NAT" work around work for this issue?

viragomann

@audiobahn
If a device is accessible from other devices within the same subnet, but not from the VPN or other network segments it should be accessible from outside with NAT though, because this way the packets get a source IP from its own subnet.

However, in most cases it is the firewall on the respective device itself, which is simply blocking outside access. So the NAT is a hack and not recommended. You should better configure the devices firewalls accordingly.

There are only rare dumb devices, which have no possibility to configure a gateway, where NAT is a good workaround.