New user question
-
I recently purchased a Netgate 1100.
I've set up a couple of VLANs, one is my HOME VLAN, for the moment I'm using the firewall behind my ISPs router (WAN = 192.168.0.x).
On the WAN-interface, I've turned off "Block private networks and loopback addresses" and "Block bogon networks"
The DHCP server is configured, set DNS to 1.1.1.1 and 8.8.8.8
I've configured the firewall rules to allow everything (IPv4+6 *, source *, destination *, port *, gateway *).I get a proper IP address on the HOME network, I am able to reach the pfsense web interface, but when I ping the outside (e.g. 1.1.1.1), I get "PING: transmit failed. General failure." on a Windows client, simply "ping: connect: Network is unreachable" on a Linux client.
How do I proceed to find the root cause?
Thanks
-
@Johnny-2 None of your networks are 192.168.0.x except the WAN right? Each VLAN interface would need allow rules.
The 1100 is a 3 port switch with the ports isolated by VLANs. Did you happen to undo any of that?
-
@SteveITS
Indeed, non of my VLANs have 192.168.0.x and both the WAN & HOME VLAN have the allow everything rule (IPv4+6 *, source *, destination *, port *, gateway *).By default, the LAN port maps to VLAN 4091. I turned that off (see below). To make room for my HOME VLAN to be on that port untagged. But any problem with this configuration would also be reflected on the internal network, I assume?
I am now connected to the LAN port of the 1100.
-
-
@Johnny-2 so you're trying to change the LAN port from VLAN 4091 to VLAN 10? and have 10 be on both the LAN (tagged) and OPT (untagged) ports?
The 1100 essentially comes with this process (for the 2100) already done to isolate its three switch ports: https://docs.netgate.com/pfsense/en/latest/solutions/netgate-2100/configuring-the-switch-ports.html
Can you show the firewall rules for the new interface (VLAN 10)?
-
No extra options
I would like to narrow the rules, but first it should work without restrictions.
-
@Johnny-2 Some thoughts...
Is the gateway on the PC set to the pfSense HOME IP?
Is NAT Outbound set to Automatic?
Is the subnet mask on HOME a /24? (pfSense defaults to /32)
-
So, yes to all three
-
Can you ping anything other than the two configured DNS server IPs? 8.8.4.4 for example. Setting those adds static routes for them in pfSense which could potentially be wrong.
Can pfSense itself connect out? Install packages? Or ping out from Diag > Ping?
What you have configured looks OK. Do you actually see the auto outbound NAT rule created for 10.10.1.0/24?