Newbie - can't get two subnets to access each other
-
Hi SG-1100/pfsense newbie here,
I have the SG-1100 working as desired except for one aspect.
I have attached a JPEG showing what I’m trying to achieve:
a) LAN port/interface as the “regular” home network – let’s call this the LAN subnet
b) OPT port/interface as an IoT network – let’s call this the IOT_Devices subnetFor each of these interfaces, I had done these steps:
- Interfaces > [Interface Name]
a. Enabled it
b. IPv4 type -> static
c. Set the static IPv4 address as shown in the “networkpic_for_external” JPEG - Services > DHCP Server > [Interface Name]
a. Enabled the DHCP for the interface
b. Set the IP range
Currently, both subnets can access the internet. The LAN subnet can access the AT&T gateway webserver while the IOT_Devices subnet can’t. The LAN subnet can access the pfsense webserver while the IOT_Devices can’t. So, this is all as expected. I have also attached JPEGs for the firewall rules.
But what is not working is that the LAN subnet can’t access the IOT_Devices subnet.
Am I missing some steps or have configured something incorrectly? I haven’t done anything related to VLANs.
If anybody is curious: In the past, I had tried several times to get the AT&T Gateway to operate in Pass-through/bridge mode but I never got it to work. That’s why I have another subnet on the Netgate WAN port. The Netgate is using a static address of 192.168.1.1 on it’s WAN interface, which is outside of the AT&T DHCP server’s allowed range.
- Interfaces > [Interface Name]
-
@davidylau what are you trying to access on this iot network - does it have a firewall?
Users always forget host firewalls ;)
Your rules on lan would allow you iot devices net, so you could have zero rules on iot network and you would still be able to access stuff on iot, as long as its using pfsense iot IP as its gateway, it own firewall on the device iot allows it. Or its mask isn't messed up - have seen a few of those of late, where it thinks lan net is part of iot net, but since you say your handing out via dhcp that wouldn't be the case.
Simple test can access pfsense iot IP from lan net? Then lan rules are good, now do a packet capture on your iot interface, from lan net ping something in iot net.. Do you see the ping go out.. Then firewall is allowing the traffic, and your device in iot is not answering because of its own host firewall.
-
Hi johnpoz,
Your response was helpful.
I am able to ping other devices on the IOT_net from LAN_net. So it looks like the pfsense firewall rules are working.The original device that I was trying to access is a Wifi router that I'm using like an access point. So it's something specific to this wifi router that I can't access (or even ping).
I have turned off the firewall on the wifi router, but it's still not responding to any request from LAN_net. Maybe it's because the wifi router's WAN interface is turned off that it can't deal with requests from outside it's subnet?
I tried to add a static route to the Wifi router's LAN controls, so it goes through the Netgate firewall. But that didn't help.
I can access the wifi router from a computer inside IOT_Device net. Just can't access the wifi router from LAN_net.
-
@davidylau said in Newbie - can't get two subnets to access each other:
to access is a Wifi router that I'm using like an access point
Does this device have a gateway - most likely not.. You can run 3rd party firmware that allows for setting a gateway. Or you can source nat.. Reason you can not talk to that device is it doesn't know how to answer you, since it has no gateway set. I have plenty of threads here how to setup a source nat so you can.
-
It will be a routing problem. Unless that router has a dedicated Access Point mode it probably has no route back to the LAN subnet. Since when it's operating as a router it's default route will be via the WAN and that's probably not connected. Therefore it can only respond to traffic from inside it's own LAN subent (the IoT subnet here).
You might be able to add a static route to it but many devices like that are limited.
If you need to be able to access it from LAN you can add an outbound NAT rule in pfSense so that it sees traffic as coming from the pfSense IoT interface address and can reply.Steve
-
Sorry for the slow response, I spent the last couple of days fixing other connectivity issues.
Also sorry for this newbie request: Can somebody tell me if I wrote the Outbound NAT mapping incorrectly?
Reminder: LAN subnet = 192.168.99.x , IOT_Device subnet = 192.168.123.x
The Wifi router with disabled WAN interface is 192.168.123.252 . I’m trying to access it from LAN subnet.Below is the Outbound NAT mapping that I have tried, but no luck. I have also tried where the NAT’ed address is 192.168.123.5, an IO_Device subnet address that is outside of the DHCP range.
-
@davidylau why do you have this?
Leave those blank - tcp/udp/* is not a port..
-
Yeah, I would leave the protocol 'any' there too. No reason to restrict it to tcp/udp only and you won't be able to ping it with that. Also it doesn't need to be static port.
However I would expect to be able to hit the routers web interface with that in place...Steve
-
@stephenw10 good catch on the static - yeah that isn't something you would want/need either.
If you wanted to limited it to the port say your web gui is running on 443, that would be in the destination port.
What is odd is that pfsense didn't scream at him tcp/udp isn't a "port" prob should be some sort of validation check on that input..
-
That's not invalid, that's just how it shows an outbound NAT rule with the protocol set to TCP/UDP. There's an argument that's just confusing...
Steve
-
@stephenw10 ah - I get it.. So he set udp/tcp - so his ping test failed and thinks its not working is my guess then.
So sniff on your iot interface - now try and access your iot device from your lan - you should see the traffic coming from your iot IP address of pfsense.. I have gone over this multiple times - I know there is a thread where I specifically show when not source natting and when source natting what that sniff looks like.
-
Yup, if it was tested with ping it would have failed.
-
Hi stephenw10 and johnpoz,
I changed the NAT mapping protocol to "any", and now I can access the Wifi router from LAN net. Yay, it's working.
Thanks so much!
