Unblocking second LAN interface

goformickey · Nov 19, 2013, 7:33 AM

EDIT: I seem to be able to ping the pc on the WLAN interface now, but I still can't access anything from it.

I added a second LAN interface this morning for use with my WLAN. Originally I was using my wifi router in bridge mode for wireless clients as well as wired clients. I now want to use a separate NIC for wireless clients and move all wired clients to the old NIC.

The original LAN interface running on the 192.168.10.0/24 network is working perfectly, but the new WLAN interface running the 192.168.11.0/24 network is not. It gives out DHCP address but blocks all access to and past the pfSense box.

I read in a thread I was just supposed to add the following NAT rules to the WLAN interface and it would work, but I think I must have entered them wrong or missed something.

Rule #1:
Action: Pass
Protocol: ICMP (type=Echo)
Source: *
Destination: WLAN address
Description: Allow ping firewall OPT1 interface

Rule #2:
Action: Pass
Protocol: *
Source: *
Destination: *
Description: Allow clients on WLAN to access clients on LAN and WAN

Below are screen shots of my current NAT rules for reference:

Rule 1

Rule 2

All Rules

Thanks!

johnpoz · Nov 19, 2013, 2:25 PM

Not sure where you read anything about nats and second lan interface – I think you read it wrong. Yes if you were using manual nats you would need to add a nat for that segment to use the internet. Why would you be using manual nats? Just leave it on auto.

When you setup a new nic it has no default rules like when you first setup pfsense on the lan. So you need to create your firewall rules for that nic..

Example - I run my wlan on is own segment as well 192.168.2.0/24

So you see my .230 (ipad) can do anything wants internet, lan, dmz..

I allow wlan clients to talk to my printer on 192.168.1.50, could prob lock this rule down a bit more - but its a printer.. Who cares if they can talk to it on more than just the printer port.. Its not listening on them anyway ;)
I allow wlan clients to talk to my ntp server on 192.168.1.40

The the last rules says hey you can talk to anything you want as long as its not (!lan) the lan segment. So that means it can talk to dmz and internet on anything.

So what are you firewall rules you setup for your new wlan segment?