No internet on VLAN interfaces



  • Hi,

    I have set up a PFSENSE bx with 3 NIC's
    2 X WAN configured load balance
    1 x LAN with 4 VLAN's

    and created ruls so that vlan1 can access vlan2 and not access vlan 3 and vlan 4

    my problem is that i don't have internet access on the vlan's because i took out the rule that redirected all trafic to the GW, if i add the rule from the second image i will be able to access other vlans.

    can you please help me with this problem.

    Thanks.






  • you shouldn't be able to access other vlan's if you add that allow rule with specified gateway.
    i have simalar rulesets on a couple of firewalls.  do you have some special nat or floating rules or overlapping subnets ?

    what you could do however is create an alias and insert all the subnets of the Vlans but not WORKLAN
    then adjust the bottom rule and specify the destination as "NOT" <alias>but as i said, this shouldn't be required, big chance something else is wrong somewhere</alias>



  • Hi Heper,

    I have attached my configuration from the vlan  200.
    in this case i can ping vlan 300 but if i take out the rule where the GW is LB i will not be able to ping VLAN300

    Thanks.




  • I don't know if this influence anything but i forgot to mention that i have a squid on the same pfsense box.

    Thanks.



  • whats the use of the the pass rule worklannet –> worklannet?



  • Hi heper,

    The rule allows clienta on the same VLAN to comunicate, if i take out that rule i will be able to access client on the same VLAN.

    so..my configuration is the folowing:

    VLAN200 WorkLAN
    VLAN210 WLAN
    VLAN220 ServerLAN
    VLAN230 Management VLAN

    VLAN 200 can access clients from  VLAN 200 and VLAN 210 but can't access VLAN 220 and VLAN 230
    VLAN 210 can access clients from VLAN 210 and VLAN 200 but can't access VLAN 220 and VLAN 230

    VLAN 220 can access clients from VLAN 220 and VLAN 230 but can't access VLAN 200 and VLAN 210
    VLAN 230 can access clients from VLAN 230 and VLAN 220 but can't access VLAN 200 and VLAN 210

    I need internet access only on VLAN 200 and VLAN 210, at this moment i have squid configured on VLAN 200 and VLAN210

    please let me know if it's clear now?

    Thanks.


Locked