Connecting two subnets with pfsense router
-
Hi, I have used virtualbox to create 3 virtual machines, 2 with debian OS which will act as host and client and 1 for pfsense. The IP addresses of my debian VMs are static, along with my IPs for em1, em2 and em3 interfaces on the router.
I am trying to send a ping from IOT (172.16.160.2) to debianuser (10.1.1.2) and vice versa, but I am getting a "ping: connect: Network is unreachable" on both machines.
My current understanding of what should have happened:
- Host 172.16.160.2 sends a ping to client 10.1.1.2
- ARP request sent to local gateway (172.16.160.1) on the router
- Router checks destination IP address against all reach-able interface (em0, em1, etc) till the final hop reaches a gateway who can locally reach the destination IP (gateway 10.1.1.1).
- Client 10.1.1.2 sends an ARP reply
- Router adds the MAC/IP information to its ARP cache
- Host is able to send a ping to client
This section will contain more information of the set up, accompanied by screenshots.
-
List of interfaces - em0, em1, em2 and em3.
-
PFsense Firewall rules for LAN - I added a rule to accept everything from IPv4
-
PFsense Firewall rules for OPT1 - I added a rule to accept everything from IPv4
-
OS Firewall rules of debianuser (10.1.1.2) - No firewall rules, I added the chains previously
-
OS Firewall rules for client (172.16.160.2) - No firewall rules
-
Gateways
Questions
- Why is the host unable to ping the client? I assume that the routing is done automatically when internal networks are connected directly to the router.
- It makes sense for there to be switches to redirect the traffic to the correct device on a LAN. However, I am not sure if it is set up by default. I am also unable to find the switch settings on the Pfsense web GUI under Interface > Switch. Do I have to set those up to route?
Thank you for reading! I will appreciate any input you'd have for me!
-
@calebnetworking it should “just work.”
The Switch menu in pfSense is for Netgate models with built in switches so not relevant. Instead check Diagnostics/Routes.
Is the netmask correct on all interfaces? Gateway correct(pfSense) on the two devices?
-
@SteveITS Thank you so much for your reply! I did not know that I had to set a default gateway for my devices. I am able to ping the two devices now after setting those up.
-
@calebnetworking Yep the gateway is for “not my network, send to something that knows better.” :)
-
You should not have gateways set on LAN or OPT1. (or possibly OPT2). Only the WAN should have a gateway set for pfSense and that is added automatically for DHCP.
When you add a gateway to an interface pfSense treats it as a WAN and that is not the case for LAN or OPT1.
Additionally whatever is at 10.0.2.2 is not responding to ping. That's probably because it's the VBox NAT host. You should set some the external IP address for pfSense to monitor on the WAN.
Steve
