a very simple ping question

baitinghollw

I have pfsense CE operation very successfully and stumbled upon something I don't understand. So I set up a second test router so as not to make the family mad when I blow things up.
The device is a 4 port mini-pc running the latest PF CE as of 2/1/2025
Set up the simplest configuration following video Brockwlell TV with a person from Quad9

OPT0 = WAN
all interfaces have DHCP enabled/configured
OPT1 = LAN 192.168.16.1 - pc attached 16.101
OPT2 = OPT2iot 192.168.17.1 - pc attached 17.101
OPT3 = OPT3LAN18 192.168.18.1 - linux running photo host 192.168.18.101:2342

Each subnet has the firewall rule that is installed on initial LAN setup; copy/pasted and changed the Source as needed to the other interfaces.

Verified that each interface can access the external internet.
Verified that both pc's can access the photo host which tells me all is working well

Problem: ping from any of the interfaces cannot ping any other interface. The error is 'Request Timed out"; Packets: Sent=4, Recieved-0

If the firewall rules for each interface allows everything and I can access the internal web of the photo hosting sight., what am I missing. I can live without 'ping', but it's driving me nuts.

Thanks

viragomann

@baitinghollw
If it's your first time setting up a router you're possibly not aware, that computer usually blocks access from outside of their own subnet by default.

So you have to allow access on the destination devices as well or turn off their firewalls.

baitinghollw

@viragomann Yup, you are right. I did not know that, so I googled about it and understand now. Thanks.

Gertjan

@baitinghollw said in a very simple ping question:

I did not know that

Actually, you probably did.
Remember seeing this (an old one, it still exists these days I guess) :

if you selected 'Public', your device can only connect to the gateway, your local router, and no one else, and won't accept any incoming connections, not from the router, neither any other local LAN device.
Home, or Work would add local LAN devices to the list, but user authentication is probably still needed.
Most OSs don't accept any connection from outside their own LAN, except if stated otherwise.

baitinghollw

Thanks All,

The other confusing part for me was that I couldn't ping the Windows machines as you have explained. However, I could ping the Debian12 machines. Boy is there a lot to learn.
Thanks again.