Unable to connect between lan1 and lan2

sutha

@stephenw10 This is my Lan1 ipconfig/all.

Windows IP Configuration

Host Name . . . . . . . . . . . . : DESKTOP-QBMK4M9
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Ethernet:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) Ethernet Connection (5) I219-LM
Physical Address. . . . . . . . . : AC-E2-D3-10-DB-8C
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::3968:80d2:4d5:9bb0%2(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.50.100(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.50.1
DHCPv6 IAID . . . . . . . . . . . : 44884038
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-23-14-88-BC-5C-E2-D3-10-D8-8C
DNS Servers . . . . . . . . . . . : 9.9.9.9
8.8.8.8
NetBIOS over Tcpip. . . . . . . . : Enabled

Wireless LAN adapter Local Area Connection* 1:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter
Physical Address. . . . . . . . . : xx.xx.xx.xx.xx.10
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Local Area Connection* 10:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter #2
Physical Address. . . . . . . . . : xx.xx.xx.xx.xx.11
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Bluetooth Network Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network)
Physical Address. . . . . . . . . : xx.xx.xx.xx.xx.12
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter WiFi:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : communityfibre.co.uk
Description . . . . . . . . . . . : Intel(R) Dual Band Wireless-AC 8265
Physical Address. . . . . . . . . : xx.xx.xx.xx.xx.13
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

stephenw10

@sutha said in Unable to connect between lan1 and lan2:

FAILED:FROM 192.168.50.100 TO 192.168.60.50
19:27:39.002010 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 380, length 40
19:27:43.977069 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 381, length 40

OK, that all looks good. Was that capture run on the LAN1 interface?

Run the same ping test but capture on LAN2 and make sure you see the same traffic there so you know the pings are leaving LAN2 as expected.

If that is the case the problem is almost certainly that the host at 192.168.60.50 is blocking that ping because it's coming from outside it's subnet. What is that host?

johnpoz

where did you sniff this

FAILED:FROM 192.168.50.100 TO 192.168.60.50
19:27:39.002010 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 380, length 40
19:27:43.977069 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 381, length 40
19:27:48.961347 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 382, length 40
19:27:53.959670 IP 192.168.50.100 > 192.168.60.50: ICMP echo request, id 1, seq 383, length 40

On the 50 interface of pfsense or the 60? If on the 60.. That right there is PROOF! that your device at 60.50 is just not answering..

sutha

@johnpoz 60.50 went offline. This system is on lan2 and I can’t access now. I’ll try tomorrow.

stephenw10

Any host on the 192.168.60.X subnet would be the same except the pfSense interface at .1 itself.

johnpoz

Yeah doesn't have to be 60.50 - you got nothing else on this vlan you can ping?

How about just answering the question on what interface you took that sniff? Starting to think we are just being trolled to be honest.. Going on 3 days something, that is a 30 second test.

sutha

@johnpoz actually, I’m using this as a test system therefore I didn’t take others remote access details.

johnpoz

@sutha What freaking interface did you take the sniff on where you showed 50.100 sending traffic to 60.50?

What does that have to do with "test" system..

This is really simple

Device A ----> (a) pfsense (b) ----> Device B

You sniffed where interface a or b of pfsense.. If a we know your client is sending the traffic trying to get to device b to pfsense.

If you sniffed on b you know that pfsense sent the traffic on to device B IP address. If you do not get an answer, that has zero to do with pfsense.. And again SCREAMS firewall on device B.

This test takes all of 30 seconds at most..

sutha

@johnpoz I have a switch on lan 1 and a switch on lan 2, on these switches I have pc‘s connected. I have a pc on both side for my own use, you can call as personal use, administrative or test use. I need these pc to access each side when something goes wrong like now. Because this is a new environment, I don’t have all remote access details now.

If I’m wrong correct me, for sniffing the packages you need to access the pfsense open the packet capture and switch between lan1 and lan2. Only the ping should be done from the pc, which is on lan1 and lan2. Those complete sniffing which I have sent is from lan 1, I couldn’t send you the sniffing from lan 2 because the pc went offline. I’ll do it half an hour .

johnpoz

@sutha dude your sniffing on pfsense interfaces..

Its as simple as changing the interface on pfsense. You do not need to take the sniff on the device.. Its right therein pfsense - you can select any of the pfsense interfaces.. You can access pfsense from anywhere.. Could even be in from the internet.. Anything that can access the pfsense gui..

Its all of 3 seconds to change the interface your capturing the data that is flowing in or out of pfsense... Yes the device in network B needs to be up so pfsense knows what mac to send to but when you took that sniff it would of been 3 more seconds to look at the traffic that was leaving B..

stephenw10

Yes if any other hosts exist on the 192.168.60.X subnet then you can try pinging them. If they are using DHCP you can those hosts in Status > DHCP and try to ping those IPs.

Even if the hosts don't respond you will still see the ping traffic in a capture on the .60 interface proving that pfSense is routing it as expected.

sutha

@stephenw10
First of all, I would like to thank everyone who helped to succeed with my connection.
The problem was in two places: the firewall and an IP. I disabled the Windows firewall, but even if you disable the firewall, you have to enable the "Echo-request-ICMPv4" in the firewall inbound rule under advanced settings. The second problem resided with the IP, I had set up an additional IP and forgot to remove it.
While capturing the pings independently, I found as you guys said, that something is blocking on this machine. I tried to enable the echo request even though the firewall is off, and I'm still facing the same issue. Finally, I put the IP in auto setting and it suddenly started to working. Then I realized the additional IP was causing the problem.
I have enabled my tunnel and the rules one by one, it's working fine.

stephenw10

Ah, sounds like you hit the common issues there then.

sutha

@stephenw10
Thanks again !
I don't understand how pfSense is handling the traffic between two interfaces without a unique IP. I thought I needed a unique IP, which is why I added the second IP on my machine (192.168.60.50). Now I have removed the ip on all devices.

stephenw10

That's how IP routing works. Both hosts do not have a direct route to the other subnet so they send traffic via their default route/gateway which is the pfSense interface. pfSense has an interface in both subnets so it knows how to reach them, it has a route. So when traffic comes in with a destination of the other subnet it routes it correctly out of the other interface.

johnpoz

@sutha said in Unable to connect between lan1 and lan2:

handling the traffic between two interfaces without a unique IP.

You don't seem to grasp the basic concept of a router?? How do you think your soho router works - routes you to the internet? Does your client have an IP in every single network out on the internet?

sutha

@johnpoz Actually, I have seen many routers, but they are very complicated to set up. I have never set up a site-to-site VPN in a short period of time, but with pfSense, it was so easy, and many advanced and secure methods are available. That's why I like pfSense.
Anyway, Thanks again!