Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Routing between interfaces

    Scheduled Pinned Locked Moved Routing and Multi WAN
    11 Posts 3 Posters 6.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • G
      GeorgeOnLine
      last edited by

      Hello,
      I'm new on pfSense, I read FAQ and tutorials but I still have many doubts.  The first of them is about the routing mechanism.

      When I add a new interface OPT1 running with a different subnet address, is the routing with other interfaces automatically enabled or just I need to setup a static route?

      Any help will be apreciated.

      gOl

      1 Reply Last reply Reply Quote 0
      • GertjanG
        Gertjan
        last edited by

        To be honoust : beats me….  ;)

        But: I have a LAN network card (192.168.1.1/24) and a OPT1 card (192.168.2.1/24) (Captive portal activated).

        I can ping and have acces (SSH, telnet and Web) to the devices (AP's) from LAN to OPT1 without any 'routing rules or other modifications'.

        No "help me" PM's please. Use the forum, the community will thank you.
        Edit : and where are the logs ??

        1 Reply Last reply Reply Quote 0
        • G
          GeorgeOnLine
          last edited by

          @Gertjan:

          I can ping and have acces (SSH, telnet and Web) to the devices (AP's) from LAN to OPT1 without any 'routing rules or other modifications'.

          This may help.  :)

          I come from M0n0wall and this was my main nightmare.
          I was able to ping the OPT1 address, but not the hosts on the same subnet  :-\    …but just a reboot is sufficent to change behaviour.  :o

          Thanks.

          gOl

          1 Reply Last reply Reply Quote 0
          • H
            hoba
            last edited by

            Routing between directly connected subnets works out of the box but you have to allow traffic by creating appropriate firewallrules. (firewallrules always validate incoming traffic at an interface).

            1 Reply Last reply Reply Quote 0
            • G
              GeorgeOnLine
              last edited by

              @hoba:

              Routing between directly connected subnets works out of the box but you have to allow traffic by creating appropriate firewallrules. (firewallrules always validate incoming traffic at an interface).

              Don't works for me  :(  , same as with M0n0wall.

              Just installed pfSense embedded on my WRAP. This is my configuration:

              LAN:  192.168.1.0/24
              OPT1: 192.168.2.0/24
              WAN:  192.168.3.0/24

              LAN to WAN is ok.

              LAN to OPT1 and OPT to LAN not.
              I have created a couple of firewall rules allowing all traffic from LAN subnet to OPT01 subnet (and vice versa).  No other rules.

              Using the Diagnostic Ping on webConfigurator i'm able to contact hosts on OPT1 subnet, but nothing to do if i try to ping them from some host on the LAN.

              I'm sure to be wrong in something, …but where?

              1 Reply Last reply Reply Quote 0
              • GertjanG
                Gertjan
                last edited by

                A long shot:
                Save your current config.
                Go to Default settings.
                Put your WAN device on the 10.0.0.0/8 range (i.e. 10.0.0.138), and make your pfSense WAN ip somthing like 10.0.0.1 - gateway 10.0.0.138 - dns 10.0.0.138.

                No "help me" PM's please. Use the forum, the community will thank you.
                Edit : and where are the logs ??

                1 Reply Last reply Reply Quote 0
                • H
                  hoba
                  last edited by

                  @GeorgeOnLine:

                  @hoba:

                  Routing between directly connected subnets works out of the box but you have to allow traffic by creating appropriate firewallrules. (firewallrules always validate incoming traffic at an interface).

                  Don't works for me  :(  , same as with M0n0wall.

                  …

                  Show us your rules at all involved interfaces, they are most likely wrong.

                  1 Reply Last reply Reply Quote 0
                  • G
                    GeorgeOnLine
                    last edited by

                    @hoba:

                    Show us your rules at all involved interfaces, they are most likely wrong.

                    Thats all my filters :

                    LAN (default)
                    Proto  Source  Port  Destination  Port  Gateway  Description
                    *      LAN net    *      *              *      *          Default LAN -> any

                    WAN (default)
                    Proto  Source  Port  Destination  Port  Gateway  Description
                    *      RFC 1918    *      *              *      *          Block private networks

                    OPT1 (custom)
                    Proto  Source  Port  Destination  Port  Gateway  Description
                    *      OPT1 net    *      *              *      *          Pass all from OPT1 to ANY

                    Interfaces are now:
                    LAN:  192.168.20.254/24
                    OPT1:  192.168.200.254/24
                    WAN:  DHCP

                    LAN > WAN is OK, but LAN <-> OPT1 ->not    >:(

                    Only using the Diagnostics/Ping packets from 192.168.20.254 (LAN if) to 192.168.200.254 (OPT1 if) pass, but not to other hosts on OPT1 subnet.

                    Configuration is all here, and sincerly seems to me very simple  :-[

                    1 Reply Last reply Reply Quote 0
                    • GertjanG
                      Gertjan
                      last edited by

                      @GeorgeOnLine:

                      @hoba:

                      Show us your rules at all involved interfaces, they are most likely wrong.

                      Thats all my filters :
                      …..

                      That seems rather classic, I agree.
                      One question before my advise : nothing special in Nat->Outbound ?

                      Save your config locally and reset to default (bether fresh ISOI install - it only takes a couple of minutes)
                      Set your 3 interfaces (IP's for internal network cards and Internet access for your WAN card) and you should be up.

                      If not : hardware trouble is all what's left…

                      No "help me" PM's please. Use the forum, the community will thank you.
                      Edit : and where are the logs ??

                      1 Reply Last reply Reply Quote 0
                      • G
                        GeorgeOnLine
                        last edited by

                        @Gertjan:

                        One question before my advise : nothing special in Nat->Outbound ?

                        Absolutely nothing!

                        @Gertjan:

                        Save your config locally and reset to default (bether fresh ISOI install - it only takes a couple of minutes)
                        Set your 3 interfaces (IP's for internal network cards and Internet access for your WAN card) and you should be up.

                        If not : hardware trouble is all what's left…

                        You will agree this is a very strange problem:  how can LAN if communicate with OPT1 if, but not with hosts on OPT1 subnet?
                        If there is an hardware trouble I should'nt see nothing also between these two interfaces!  ….or not?

                        And again:  hosts on OPT1 subnet may reach the internet through the WAN if, like hosts on LAN subnet, but they can't see the opposite other!    ::)

                        Really, really strange ...

                        1 Reply Last reply Reply Quote 0
                        • GertjanG
                          Gertjan
                          last edited by

                          Ok.
                          Let continue.
                          I presume you can ping the OPT1 interface from the SSH interface (option 7).
                          You should be able to ping other devices behind the OPT1 interface, also.
                          To be sure : give these devices a static IP (192.1968.2.x in your & my case) - check if they haven't any restrictive firewalls activated on them.
                          For instance, I use a couple of AP's (192.168.2.2,3,4,5,…), attachad to my OPT (Hotspot network) and they accept only (local administration) traffic comming from 192.168.2.1, my OPT1 IP.
                          I don't want my 'hotspot clients' to start administer my AP's  ;)

                          Btw: You're saying/using "OPT1 net" as an alias (see post below) - check it twice if your usage of aliases are correct. Use hardcoded adresses instead (192.168.2.0/24) to test.

                          No "help me" PM's please. Use the forum, the community will thank you.
                          Edit : and where are the logs ??

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.