Recommendations for my pfsense setup with 5 nics
-
I've got a PC with 1 onboard NIC and a 4 port NIC.
I plan on having 4 networks hanging off of the 4 port NIC and use the onboard for the WAN.
I also have a cisco 3560G 28 port Gig switch that I want to plug each of the 4 ports into.
Each port is configured as a trunk with the desired vlan tag.
I also would like to plug my fiber cable right into the WAN port. (Will this act as the router or do I need one in front of the WAN)
Networks are as follows:
LAN - 192.168.10.0/24 (10)
OPT1 - 192.168.20.0/24 (20)
OPT2 - 192.168.30.0/24 (30)
OPT3 - 192.168.40.0/24 (40)
I will be using a .1 for all of the interface IP's.I would like to set this up offline (no WAN) and then just put it in place but I've had no luck so far. Do I need the WAN plugged in to route between the networks?
The trouble I've had is I can't ping from LAN to any of the other 3 networks but I can ping from the other 3 to LAN.
I have no floating firewall rules and all of my interface rules are allow any any.
Any help would be great. -
@teke said in Recommendations for my pfsense setup with 5 nics:
Each port is configured as a trunk with the desired vlan tag.
No need to trunk the ports, you're plugging them directly into a router interface. It's the same as the LAN connection at that point. Just make sure you have the correct vlan on each switchport so the networks are available on any other ports needed.
I also would like to plug my fiber cable right into the WAN port. (Will this act as the router or do I need one in front of the WAN)
It is a router so that will be fine .
I would like to set this up offline (no WAN) and then just put it in place but I've had no luck so far. Do I need the WAN plugged in to route between the networks?
No. I'm guessing once you fix the switchports you'll be fine.
-
@jarhead
Thank you for the reply. I will delete the trunk ports on my switch.
4 of them, 1 for each pfsense NIC. I will just associate them to the correct vlan -
@jarhead
So I have setup the Nic ports and the Cisco ports as well as allowing all traffic from all networks in the firewall but I still can't ping. It is giving me a general failure.
Ports config
interface FastEthernet0/1
description pfSense Lan
switchport access vlan 30
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/2
description pfSense Cameras
switchport access vlan 20
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/3
description pfSense Wifi
switchport access vlan 40
switchport mode access
spanning-tree portfastip default-gateway 192.168.10.1
It's not picking up a default gateway. I'm just not sure how to set it in pfsense because everything I have read said not to do that. Is that because it grabs it from the WAN?
-
@teke Can the pc ping itself?
What port on the switch is the pc plugged into?
What vlan is on that port? -
@jarhead
It can ping itself (192.168.10.1) from the diagnostic web interface
I messed up the config above.
It's on fa0/1 and I listed the vlan wrong. It is now 10 but same ping issue.The laptop (192.168.40.100) is plugged into port fa0/9 which is vlan40 and my pc is plugged into fa0/16 (192.168.10.100) which is on vlan 10. They both get the correct IP address but they can't route.
When I do ipconfig/release and then renew there is no gateway listed.
-
@teke
How are the pfSense interfaces connected to the Cisco Switch ?Are they connected to the Cisco
fa0/1fa0/2
fa0/3
If yes ...
Where is the PC connected ?You do know that you have to make "inbound" allow rules on the pfSense interfaces , in order to get those to allow traffic from the switch in to the pfSense firewall ... Correct ?
-
@bingo600
How are the pfSense interfaces connected to the Cisco Switch ?
They are connected each with a cat6 cableAre they connected to the Cisco
fa0/1 - Lanfa0/2 - OPT1
fa0/3 - OTP2
If yes ...
Where is the PC connected ? Connected to port 16 on the cisco switch and it's tagged with vlan10You do know that you have to make "inbound" allow rules on the pfSense interfaces , in order to get those to allow traffic from the switch in to the pfSense firewall ... Correct ?
So on all firewall rule interfaces I have to add inbound rules for all other interfaces?
ex. if on Lan firewall would the rule be protocol any. source opt1 net, destination Lan allow? -
You could start out with a rule like this, on the interfaces (change Lan_net) to the respective (XXX_net) on the other interfaces.
That would allow anything for starters ....
Edit: DON'T do the above on WAN
-
@bingo600
I do have something similar to that but instead of Lan_Net I have any. -
@teke
That would also work ...Do you still have DHCP default GW issues on the PC ?
-
@bingo600
I have that but ping can't flow between a PC on the Lan and a laptop on the OPT2 network. I've been trying different configs the last 3 days but can't seem to make things work. I would have things working from OPT1 and 2 (ping wise) but I couldn't ping from LAN to OPT1/2. I can play with the firewall rules tomorrow when I'm back to work.I also thought that my switch ports had to be trunked with the corresponding vlans as well. If I don't need that it make things easier.
-
Do you still have DHCP default GW issues on the PC ?
I do. It grabs an IP but the gateway is blank. I was wondering if it is supposed to grab it from the WAN, which is not plugged in. -
@teke
Without def-gw set , the PC's would only be able to ping on their own Lan/Vlan.
Not even OPT2Do you use pfSense as DHCP server ???
@stephenw10
Would pfSense DHCP server NOT send out def-gw, if WAN isn't connected ?? -
@teke
The DHCP server has nothing to do with the WAN.Post screenshots of pfSense config's. All interfaces, all firewall rules.
Chances are this is a switch problem so if you can, connect the laptop and a pc directly to the pfSense interfaces and test from there to prove it.
-
@bingo600
I read a bunch of how to's and watch a few videos on how to set this up and they all say not to put in a default gateway even though I know that you need one to route. I was thinking this was because I have no WAN connected yet??I do use pfSense for the DHCP server.
Should I set the gateway up on each interface DHCP scope? -
@jarhead said in Recommendations for my pfsense setup with 5 nics:
@teke
The DHCP server has nothing to do with the WAN.Post screenshots of pfSense config's. All interfaces, all firewall rules.
I will post shortly.Chances are this is a switch problem so if you can, connect the laptop and a pc directly to the pfSense interfaces and test from there to prove it.
I have 2 laptops connected directly to the pfSense box.
Laptop 1 plugged into Lan
Laptop 2 plugged into OPT2
They both get an IP but they can't ping each other. -
@teke said in Recommendations for my pfsense setup with 5 nics:
Should I set the gateway up on each interface DHCP scope?
You don't need to do this - by default pfsense hands out its IP on the dhcp interface as the gateway.
But if client has no gateway, then no it wouldn't be able to talk to other networks/vlans on pfsense or the internet
Your saying when you look at the client that got an IP (from your dhcp) not some 169.254 address? It has no gateway?
-
@teke said in Recommendations for my pfsense setup with 5 nics:
@bingo600
I read a bunch of how to's and watch a few videos on how to set this up and they all say not to put in a default gateway even though I know that you need one to route. I was thinking this was because I have no WAN connected yet??Where exactly are you referring to about the gateway?
If you're talking about the LAN interface, then no, don't put one in.
Are you talking about the switch?? -
@teke said in Recommendations for my pfsense setup with 5 nics:
@jarhead said in Recommendations for my pfsense setup with 5 nics:
@teke
The DHCP server has nothing to do with the WAN.Post screenshots of pfSense config's. All interfaces, all firewall rules.
I will post shortly.Chances are this is a switch problem so if you can, connect the laptop and a pc directly to the pfSense interfaces and test from there to prove it.
I have 2 laptops connected directly to the pfSense box.
Laptop 1 plugged into Lan
Laptop 2 plugged into OPT2
They both get an IP but they can't ping each other.Show pics of your rules as I asked earlier.
Show the ipconfig of the laptops. -
J jimp moved this topic from Problems Installing or Upgrading pfSense Software on
