Traffic from lan to lan not working …



  • Hello, i have some trouble setting my pfsense 2.0 to access another lan

    right now my setup is 2 wan 2 lan.

    secondary wan is only used when primary fail.
    both lan are on different physical interface.

    first lan is 192.168.5.0/28 and secondary is 192.168.7.0/28

    I am not able to access the 7.0 lan from the 5.0, but i can access it from wan with port forwarding.

    i don't know what i'm missing. I even tried to setup a gateway pointing this subnet.



  • you need create a rule on first interrface

    proto any source FIRST LAN Subnet  - Destination  SECOND LAN Subnet



  • Further check you Subnet bits. Is it really /28 ?
    192.168.5.0/28 would mean:
    Netadress: 192.168.5.0
    Host-Adresses: 192.168.5.1 - 192.168.5.6
    Broadcastadress: 192.168.5.7

    A possible subnetmask could be /24 which means
    Netadress: 192.168.5.0
    Host-Adresses: 192.168.5.1 - 192.168.5.254
    Broadcastadress: 192.168.5.255

    Fruther:
    If there is NO rule in the firewall rule TABs of your LAN1 and LAN2 then there is default "block all".
    So like Notanial said above, you need to enter a rule on the LAN TABs to allow access.
    But if you do a rule like Notanial said, there is ONLY access from one LAN to the other, but not to the internet.

    pass
    proto: any
    source: LAN-A Subnet
    destination: LAN-B Subnet
    To allow access from LAN-A to LAN-B

    And to allow access from LAN-A to the internet:
    pass
    proto: any
    source: LAN-A subnet
    destination: any
    (Gateway: WAN1 or WAN2 oder Gateway Group if you created one)

    If you like full access from LAN-A to LAN-B AND to the internet, then you could only use the second rule.



  • /28 is .0 for the subnet, and .16 for the broadcast :)

    i already done both example, i probably have something somewhere blocking the lan. i will try a fresh install and check if its working.
    i'm sure it' obvious :)

    Thanks



  • @singerie:

    /28 is .0 for the subnet, and .16 for the broadcast :)

    (…)

    Of course, you are right ;-)


Log in to reply