Egress traffic from LAN network not reaching WAN
-
Setting up PFsense for the first time and went through the initial setup via the command-line. Setup all the basics ie: (interfaces, ips for interfaces, DHCP for WAN and LAN networks). Even still, I can't get devices in the LAN network (192.168.10.x /24) to communicate with devices in the WAN network (192.168.1.x /24) much less the internet. I continued the configuration process in the web GUI and unchecked blocking bogons and rfc1918 addresses but I'm still having the same issue. Since I'm in a lab environment I also tried setting both LAN and WAN networks to 192.168.1.x /24 and was able to successfully access the internet from the LAN network. However this would inevitably cause issues for my use case so I returned the configuration to having two subnets. I think this could be a routing issue but I'm not sure, I didn't change anything else and I can ping internet IPs/hosts from the pfsense webui. Any ideas of what I should check or what is going on? Thanks
-
@FullMetalLarry
hey there,
is your pfsense behind another router (lab setting you mentioned)?
It helps if you could show- NAT settings on pfsense (if any)
- rules for interfaces
- at dhcp: static Arp active and device not on that list?
What machine are you running pfsense on?
Pfsense* WAN IF network (your 192.168.1.0/24) is (in case of a setup behind another router) the same as that router's LAN, I assume?
Any other devices running (switch, AP)?Can you ping successfully from pfsense's WAN and LAN IF? Ping by IP or name?
What are your DNS config settings?
To name just a few questions that might help solve your problem... :) -
You must have two different subnets for routing to work. If it was somehow working with both WAN and LAN set to the same subnet then there must be something else in play like a second router.
You are able to access the pfSense webgui though?
Is pfSense itself able to connect out? If you test from Diag > Ping does it succeed?
-
Thank you for your quick responses, I was stuck for 3 days on this issue and just now after re-installing pfsense I realized I had been using the wrong gateway information on the LAN side. This time I did not configure a gateway for the LAN and allowed the WAN to pull it's gateway via DHCP. Now everything is working properly with minimal additional configurations. I am new to this platform and am sure I will be back here with more posts as I go on and explore some of the more advanced features. Thanks again!
-
Nice! Yes pfSense itself should not normally have a gateway defined on the LAN. The only time you would use that is if you have some other router on LAN with subnets behind it that pfSense needs to route to.
-
@stephenw10 even then I wouldn't do that way, because once you put the gateway on the interface pfsense will create an outbound nat on it.. Sure that can work - but if routing to internal networks normally you wouldn't need to nat.
I would just create the gateway using the IP of the other end of the transit network, and not actually put the gateway on the interface itself.
-
Indeed! Even in that situation the gateway should not actually be on the LAN interface, just in the LAN subnet.
