Can't route between VLANs
-
So, this worked at one point and then stopped. The only change I can think of is that I set up multi-WAN routing. I have a few VLANs that are in use but the 2 that are relevant are VLAN10 and VLAN20. VLAN10 is the private network. VLAN20 is the security network. I'm trying to get from the VLAN10 network into a machine on the VLAN20 network. At one point this worked but not anymore. From a device on the VLAN10 network (192.168.10.0/24) I can ping the interface address on the VLAN20 network (192.168.20.1) but no other device on the VLAN20 network. pfSense, however, is able to ping all devices on the VLAN20 network. This makes me think it's some kind of routing issue and the only change I've made to the routing was setting up for multi-wan.
These are my VLAN10 rules:
-
@stewart
From the point of routing it's only required that the pfSense interface IP is the default gateway on all devices.
Then you need a proper firewall rule to allow it.Assuming the VLANs on pfSense are configured properly, maybe the destination device is blocking accesss from outside of its own subnet.
To an easy test with Diagnostic > Ping on pfSense to get sure.
Ping the destination device. Then change the source to VLAN10 and try again.
Do both methods work? -
@viragomann said in Can't route between VLANs:
@stewart
From the point of routing it's only required that the pfSense interface IP is the default gateway on all devices.
Then you need a proper firewall rule to allow it.Assuming the VLANs on pfSense are configured properly, maybe the destination device is blocking accesss from outside of its own subnet.
To an easy test with Diagnostic > Ping on pfSense to get sure.
Ping the destination device. Then change the source to VLAN10 and try again.
Do both methods work?Indeed, if I choose the VLAN20 interface it will ping. If I choose the VLAN10 interface it will not ping. My gut feeling is that it is downstream in something that the security company put into place but I'm not sure how to verify that unless I plug something in that I know can be pinged.
-
@stewart
Don't you have access to the VLAN20 devices?Both options, I mentioned above, could be a possible reason.
Either the destination device use another default gateway or it blocks outside access by it's own firewall rule.If you don't have access to the device, you can workaround this by an outbound NAT rule to masquerade the source IP.
-
@viragomann said in Can't route between VLANs:
Don't you have access to the VLAN20 devices?
I don't, unfortunately. They are access control devices. Only one has a web interface from what I understand.
-
@stewart those rules are not going to allow access to some other networks.. your forcing all traffic out some gateway..
See here..
https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html#bypassing-policy-routing
-
@johnpoz But isn't that what is needed to do multi-wan? (Other than the descriptions being wrong). Don't I have to use those rules for multi-wan to route for that vlan? How would I change it such that I can access other VLANs and still do multi-wan?
EDIT: Nevermind, I didn't see the link. I'll look into that and reply back. Thanks.
-
