Cannot reach Vigor 2962 from vlans behind pfSense

Alanesi

Hello,

I have been using pfSense for a long time, but this issue confused me.

So I have a new Vigor 2962 router.

Vigor 2962 is connected as a WAN to my pfSense.
PfSense is connected to LAN port 6 on Vigor 2962; both ports are on the same subnet (20.1.10.X)

On pfSense, I have multiple VLANs.

WAN port, gateway, and firewall are configured correctly. (because I have 2 WAN connections on pfSense, one is working fine on a Huawei router from the ISP).

The issue:

PfSense can see Vigor 2962 and is showing online, but the VLANs behind PfSense cannot see Vigor 2962.
Vigor 2962 can see PfSense, but cannot see the VLANs behind PfSense (I added a static route on Vigor 2962, and it worked).
VLANs can ping 20.1.10.2 on pfSense, but cannot ping 20.1.10.1 on Vigor 2962.

I really appreciate any help you can provide.

stephenw10

@Alanesi said in Cannot reach Vigor 2962 from vlans behind pfSense:

VLANs can ping 20.1.10.2 on pfSense, but cannot ping 20.1.10.1 on Vigor 2962.

Sounds like a missing outbound NAT rule. The Vigor likely blocks connections from outside it's own subnet.

If the WAN is configured statically does it have a gateway defined on the interface itself? That should trigger an auto-outbound NAT rule.

Of course if outbound NAT is not set to automatic you would need to add a rule.

Alanesi

@stephenw10
Thank you for your response

Just one thing to add: there was a different WAN connection before, and it worked fine until we switched to this one. So on the same interface, I only changed the name, IP address, and added the new gateway.

Kindly check the pics below

stephenw10

Hmm, OK that looks good.

Are you using policy based routing? You could be forcing traffic via the other WAN from LAN side clients.

I assume pfSense itself can ping 20.1.10.1?

Alanesi

@stephenw10

Yes, pfSense can ping 20.1.10.1.

All vlans configurations are set default.

stephenw10

But do you have firewall rules with a gateway set to route traffic via a articular WAN?

Normally those would be bypassed for a locally connected subnet like this but that can also be disabled.

Alanesi

@stephenw10

stephenw10

Hmm, then I would start a continuous ping from client in the 'data' subnet to the Vigor then check the state table in pfSense. You should see a state on DATA and a state with NAT on WAN_5G.

If those look good try a pcap on WAN_5G for that traffic to be sure it's actually leaving there. The monitoring pings will also show but should be distinguishable.

Alanesi

@stephenw10 OK I'll check it.

Alanesi

@stephenw10 said in Cannot reach Vigor 2962 from vlans behind pfSense:

pcap

This is what I got this

Looks like it does not leave!

stephenw10

So that pcap was taken on WAN_5G? If so it looks like it leaves there without being NAT'd for some reason.

If you filter the states for all interfaces do you see the state for that on WAN_5G? Does it show NAT on the state?

The other curious thing there is that the monitoring pings, that you see are working, are coming from 20.1.10.5. Is that a new IP you're using on WAN_5G?

Those pings are probably leaving via the wrong interface. Potentially something defined in IPSec could be grabbing it.