VLAN cannot ping is gateway!
-
Hello everyone,
I have 2 VLAN :
VLAN9 and VLAN5
Same settings, VLAN9 in the Netgate "Diagnostics ping" section cannot ping itself the VLAN9 gateway from VLAN9 source BUT works fine for the VLAN5 for itself
So the result is :
LAN cannot reach VLAN9 devices and VLAN9 cannot reach LAN devices
PS : Of course, my rules ares open for my test
Any Idea ? The device is Netgate 7100U
Best regards
-
@snoopyski said in VLAN cannot ping is gateway!:
VLAN9 in the Netgate "Diagnostics ping" section cannot ping itself
So you set vlan IP to say 192.168.9.1/24 and you can not ping 192.168.9.1 on pfsense diagnostic ping?
Did you actually enable the interface?
-
@johnpoz Yes is already enabled, devices on the same VLAN get IP adresse from the VLAN DHCP server
-
@snoopyski then what you say is pretty much impossible.. There is no firewall rules that would prevent pfsense from pinging itself..
If pfsense can not ping its own IP address you got something wrong..
-
@johnpoz Don't understand this too, really strange :
-
@johnpoz From SSH works but not from GUI on LAN source:
-
@snoopyski You do not set gateways on vlans.. Are these vlans downstream? If they were they wouldn't be "vlans" on pfsense.
If your adding an interface to pfsense, why would you think it should have a gateway? A gateway is how to get off a network.. Wan interfaces would have gateways, not a local interface on pfsense.
Clients on this network would use pfsense IP as their gateway. But there is no gateway set on the interface for pfsense..
-
@johnpoz I add getway for this VLAN to do some test.
The point is :
My LAN cannot reach VLAN9 (VOIP) devices and VOIP Server on the same VLAN AND the VOIP server on VLAN9 cannot reach LAN address so cannot reach LAN gateway
But strange things if I connect remotely with OpenVPN, I can reach LAN and VLAN devices
That's our issue from the start, I try many things...
-
@snoopyski said in VLAN cannot ping is gateway!:
I try many things...
There is your problem to be honest, you shouldn't be "trying" many things - you should set it up correctly..
And I can tell you right now if you setup a network on pfsense, be it a vlan or native - there isn't a gateway set on the interface.
Your LAN wouldn't have a gateway either.. Your WAN would be the only gateway on pfsense.
Multiple networks on pfsense - there is no gateway on pfsense here other than to get to the internet -- ie your WAN.. 192.168.1 and 192.168.2 do not have gateways set.. Only the clients on these networks point to pfsense IP as their gateway.
-
@johnpoz That's how I set up my interfaces. No Gateway... Set to "none" like all my others Netgate and pfSense boxes
This is the first time I get this problem on pfSense/Netgate but it's my first 7100U device, all Natgate 2100 devices (20) no issue...
-
@snoopyski said in VLAN cannot ping is gateway!:
No Gateway... Set to "none" like all my others Netgate and pfSense boxes
Then why do you have this??
-
@johnpoz This is a test... I already removed all... Back to normal but same issue
-
@snoopyski Good morning. This is my setup now, back to standard but still not working :
-
@snoopyski said in VLAN cannot ping is gateway!:
back to standard but still not working :
What is not working? So you have an IP set on pfsense 192.168.x.1 and pfsense can not ping its own IP 192.168.x.1 ??
But you have another IP set 192.168.Y.1 and pfsense can ping that IP.
-
@johnpoz Hello, my pfsense is on 172.168.16.5, and he cannot ping gateway and devices on VLAN9 (10.10.1.0/24) but works for my VLAN5(10.0.0.0/24) and the VLAN9 cannot reach my LAN subnet and gateway
-
@snoopyski said in VLAN cannot ping is gateway!:
172.168.16.5, and he cannot ping gateway
And what gateway is that??? Again you do not set a gateway on a local network..
Are you saying you can not ping your wan/isp gateway IP using this source.. Or can not ping 8.8.8.8?
If so look to your outbound nat rules - Users shoot themselves in the foot all the time following some stupid vpn guide that says to change to manual outbound nat, and then they can not figure out why some new network they add doesn't work.
cannot reach my LAN subnet and gateway
Again - what gateway? There is no gateway IP on local network... Do you mean you can not ping from your vlan 9 IP to your vlan 5 IP? using the build in ping?
Or clients on your vlan 9 can not ping the vlan 5 IP, or IPs of devices on the vlan 5 network.. What are the rules on this vlan 9 interface?
-
@johnpoz said in VLAN cannot ping is gateway!:
@snoopyski said in VLAN cannot ping is gateway!:
172.168.16.5, and he cannot ping gateway
This is my pfsense LAN IP 172.168.16.5
And what gateway is that??? Again you do not set a gateway on a local network..
No gateway set... The only gateway we have is the WAN gateway
Are you saying you can not ping your wan/isp gateway IP using this source.. Or can not ping 8.8.8.8?
I said, I can ping local network and hosts, but I cannot ping VLAN9 and his hosts.
Internet works and I can ping/access VLAN5 hosts
If so look to your outbound nat rules - Users shoot themselves in the foot all the time following some stupid vpn guide that says to change to manual outbound nat, and then they can not figure out why some new network they add doesn't work.
My Outbound NAT is set to : Automatic
cannot reach my LAN subnet and gateway
Again - what gateway? There is no gateway IP on local network... Do you mean you can not ping from your vlan 9 IP to your vlan 5 IP? using the build in ping?
Yes, from my LAN I cannot ping VLAN9 hosts vice versa
Or clients on your vlan 9 can not ping the vlan 5 IP, or IPs of devices on the vlan 5 network.. What are the rules on this vlan 9 interface?
VLAN9 cannot ping local network (LAN)
Additional information : Strange things : From a OpenVPN connection I can ping LAN + VLAN9 + VLAN5 networks lol
-
@snoopyski said in VLAN cannot ping is gateway!:
Yes, from my LAN I cannot ping VLAN9 hosts vice versa
Can you ping the vlan9 IP of pfsense?
Users always forget host firewall rules. Please post up your rules on lan, vlan 5 and vlan 9.. Out of the box the any any rules of lan would allow you to talk to anything in vlan 5 or 9 as long as they are using pfsense as their gateway. No matter what rules are on vlan 5 or vlan 9.
Common mistakes users make.
-
They policy route traffic out vpn or gateway on their lan. Without creating rules above the policy route to allow traffic to their other networks they want to allow traffic.
-
Some host firewall running on device in their destination network that doesn't allow traffic from their source network..
-
The device in dest network is using some other than pfsense IP as their gateway.
-
The mask on the destination device is wrong, and thinks their source IP is local to the destination network - so the destination device never sends traffic back to pfsense.
-
floating rules preventing whatever it is they are wanting to allow.
-
Rule is tcp/udp, and they don't know why ping (icmp) doesn't work
There are other common mistakes users make..
Without details of you rules, your configuration it is impossible to help you figure out which of the many common mistakes your making..
Simple tests to do..
If your lan rules is default any any rule, with no specific gateway set on the rule.. Can a device on the lan network ping the IP of pfsense on your other network/vlan interface you setup?
Ok now try and ping an IP on this destination network.. If does not work - you sure this device answers ping, you sure its using pfsense as its gateway, you sure its not running a firewall or security software
when users insist they have it all setup correctly and not working.. Sniff on your destination interface in pfsense packet capture under diagnostics.. Now ping some IP in in this destination network do you see pfsense send on the pings - if so then its not a pfsense issue.
-
-
-
@snoopyski do you have any rules in the floating tab?
