Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Multiple LAN Routing

    Scheduled Pinned Locked Moved Routing and Multi WAN
    4 Posts 3 Posters 6.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      Mr-Router
      last edited by

      Currently have a 1.2.3 pfsense setup - 2 LAN interfaces and 1 WAN, simple setup.

      WAN - Static public block
      LAN - 10.0.0.254/24
      OPT - 192.168.0.254/24

      LAN clients get to the internet just fine, OPT clients get to the internet just fine, have inbound port forwarding setup and works without issues.  We want to allow the 10.0.0.0/24 subnet to get access to the 192.168.0.0/24 subnet, but not allow the 192.168.0.0/24 to get access to the 10.0.0.0/24 subnet.  Is this possible?  I can ping the 192.168.0.254 OPT interface from the 10.0.0.0 subnet and vice versa, but not any of the other ip's.  Are there specific rules that need to be setup on each interface to allow this?

      1 Reply Last reply Reply Quote 0
      • C
        clarknova
        last edited by

        It is possible. You need a pass rule on the LAN interface that allows traffic to the OPT network, and ensure that there is no rule on the OPT interface that would allow traffic to the LAN network.

        db

        1 Reply Last reply Reply Quote 0
        • M
          Mr-Router
          last edited by

          Thanks clarknova!  I have my default rule for the LAN and the OPT networks to allow internet access, so I added a new rule for the LAN interface for:

          Protocol    Source      Port    Destination  Port    Gateway    Schedule
            TCP        LAN net      *          OPT net      *          *

          I appiled the rule and restarted the firewall, but still cannot ping any device on the OPT network.  I can ping the OPT interface from the LAN net still but no access to the OPT network.  Is there another piece of the puzzle that I am missing?  Under the WAN interface configuration, I have Block BOGON networks unchecked and Block PRIVATE networks checked.  I do appreciate the help!

          1 Reply Last reply Reply Quote 0
          • jimpJ
            jimp Rebel Alliance Developer Netgate
            last edited by

            Ping is ICMP, and your rule has a protocol of only TCP. Change the rule to allow any protocol, or add another rule for ICMP, and then you can ping.

            Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

            Need help fast? Netgate Global Support!

            Do not Chat/PM for help!

            1 Reply Last reply Reply Quote 0
            • First post
              Last post
            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.