Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Multi Lan issue

    General pfSense Questions
    3
    17
    1741
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • E
      elgaup0 last edited by

      Hi,

      I have pfsense running with Multi Lan with independent Nic's & Multi Wan with failover

      Example

      Vr0  - Wan1
      vr1    -Wan 2

      re0  - Lan 1 - 192.168.2.1
      re1    -Lan 2 - 192.168.3.1
      ath0 - Wireless- 192.168.4.1

      My goal is to Lan1 computers communicate & access Lan2 computers and vice versa with wireless.

      I have tried bridging re0, re1, ath0. But no result

      Please guide me through procedure.

      1 Reply Last reply Reply Quote 0
      • johnpoz
        johnpoz LAYER 8 Global Moderator last edited by

        There is no need to bridge.  You just need to create the correct firewall rules on your lan interfaces.  Default the first lan will have a any any rule.  But the other interfaces will not have any rules and will have to be created to allow connectivity be it to wan, or other lans however you want to allow access.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.01

        1 Reply Last reply Reply Quote 0
        • E
          elgaup0 last edited by

          Hi,

          I have added following rule, for all interfaces(excluding wan) still i can't ping.

          ID Proto Source Port Destination Port Gateway Queue Schedule Description
          IPv4  *                  *              *              * * *     Failover         none

          ** My mistake i can't ping

          1 Reply Last reply Reply Quote 0
          • johnpoz
            johnpoz LAYER 8 Global Moderator last edited by

            And your pinging from where to where?

            And what is your route table look like in pfsense?

            example - I have multiple segments

            And what does a traceroute look like..  So my lan is 192.168.1.0/24 and my wlan is 192.168.2.0/24

            I can ping something on the wireless network. As you can see I go through pfsense on my network to get there.

            What is the network settings on your devices on your different segments?

            Can your devices on each segment ping pfsense interface IP in that segment?  Can they use the internet through pfsense?




            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.01

            1 Reply Last reply Reply Quote 0
            • E
              elgaup0 last edited by

              I am attaching route's and trace route image's i see problem, with trace route.

              Regards




              1 Reply Last reply Reply Quote 0
              • johnpoz
                johnpoz LAYER 8 Global Moderator last edited by

                So you have a wan with a 192.168.6.0/24 network?

                And you say your other wan is vr0 which is 192.168.3.0/24

                Vr0  - Wan1

                So yeah guess from the routing table it would try and go out vr0 which you say is your wan when trying to get to 192.168.3.0/24

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.01

                1 Reply Last reply Reply Quote 0
                • E
                  elgaup0 last edited by

                  i am sorry for the confusion

                  re0(192.168.1.1)  wan2 –
                                                              Failover Network   
                  re1 PPP0E              wan1 --

                  The networks below, are not communicating with each other.

                  ex:  my ip is 192.168.2.10 is not able to ping 192.168.3.24

                  ath0(Wifi) 192.168.2.0/24

                  vr0 (Lan) 192.168.3.0/24

                  vr1(Testlan) 192.168.6.0/24

                  1 Reply Last reply Reply Quote 0
                  • johnpoz
                    johnpoz LAYER 8 Global Moderator last edited by

                    Well if wan is 192.168.1.1 you would be natting I assume to any of the lan networks, and would have to port forward.  You can see from your traceroute something is not right.

                    Why do you have what looks like 2 items in hops 1 and 2?

                    Can you post up say screenshot of your interfaces.. 
                    Why do you have a 192.168.1.1 and 192.168.1.13, and why does gateway for 1.1 show a MAC address? Which seems to be 64:66:b3 owned by tp-link.

                    Can you post a drawing of this network.. Why do you have private IPs address on your WAN connections?

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.01

                    1 Reply Last reply Reply Quote 0
                    • P
                      phil.davis last edited by

                      @elgaup0:

                      Hi,

                      I have added following rule, for all interfaces(excluding wan) still i can't ping.

                      ID Proto Source Port Destination Port Gateway Queue Schedule Description
                      IPv4  *                  *              *              * * *     Failover         none

                      The traceroute indicates that the traffic is being directed to a gateway by a rule somewhere, not using the ordinary routing table. Is "Failover" a gateway group? (the "*" don't line up nicely on the screen - but after counting them, it seems that "Failover" is in the "Schedule" column?)
                      If you are directing general internet traffic into a gateway group, then you also have to do something to pass local traffic between subnets without it getting forced into a gateway group and out on the public internet. One way is to make an alias for all your local LAN subnets, then put a pass rule before the general rule, pass source any, destination LAN-subnet-alias.

                      As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                      If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                      1 Reply Last reply Reply Quote 0
                      • E
                        elgaup0 last edited by

                        I am posting all the details requested.

                        AIRTEL_INTERNET (wan) -> re0        -> v4/DHCP4: 192.168.1.13/24
                        RSN_PBX1 (lan)  -> vr1        -> v4: 192.168.6.1/24
                        BEAM_INTERNET (opt1) -> pppoe0    -> v4/PPPoE: 49.204.219.***/32
                        WIFI (opt2)    -> ath0_wlan0 -> v4: 192.168.2.1/24
                        LAN (opt4)      -> vr0        -> v4: 192.168.3.1/24










                        1 Reply Last reply Reply Quote 0
                        • E
                          elgaup0 last edited by

                          Gateways






                          1 Reply Last reply Reply Quote 0
                          • johnpoz
                            johnpoz LAYER 8 Global Moderator last edited by

                            Why do you have everything going out your internet??

                            You do understand setting up the gateways like that turns off the routing functions

                            "Leave as 'default' to use the system routing table. Or choose a gateway to utilize policy based routing."

                            There is no reason for those entries, the systems knows based upon its routing table how it can get to the internet.  And how it can get to the other networks its connected to.  What you are doing with that rule is saying – USE the internet.. Screw your other connections you have directly connected to specific networks.

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.01

                            1 Reply Last reply Reply Quote 0
                            • E
                              elgaup0 last edited by

                              The rules in Lan and Wifi are for the failover /load balancing  i read it some where

                              1 Reply Last reply Reply Quote 0
                              • johnpoz
                                johnpoz LAYER 8 Global Moderator last edited by

                                Yes you use groups and stuff on multiwan for lots of different things..  But you don't have any rules ABOVE those that allow access to your other lans, so guess what happens.  Everything tries to go out your wan.

                                Put rules above those that allow access to your lans.

                                https://doc.pfsense.org/index.php/Multi-WAN_2.0
                                Policy Route Negation

                                When a firewall rule directs traffic into the gateway, it bypasses the firewall's normal routing table. Policy route negation is just a rule that passes traffic to other local or VPN-connected networks that does not have a gateway set. By not setting a gateway on that rule it will bypass the gateway group and use the firewall's routing table. These rules should be at the top of the ruleset – or at least above any rules using gateways.

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.01

                                1 Reply Last reply Reply Quote 0
                                • P
                                  phil.davis last edited by

                                  Yes, as johnpoz says, above each rule that passes traffic to the Failover gateway put an ordinary Pass rule that matches destination "local LANs". I would make an Alias for all the local LAN subnets, then use that alias as the destination.

                                  As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                                  If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                                  1 Reply Last reply Reply Quote 0
                                  • E
                                    elgaup0 last edited by

                                    Thanks guy's problem solved. I have deleted the failover rule, added general pass rule, then failover rule. now i can ping hosts.

                                    1 Reply Last reply Reply Quote 0
                                    • P
                                      phil.davis last edited by

                                      @elgaup0:

                                      Thanks guy's problem solved. I have deleted the failover rule, added general pass rule, then failover rule. now i can ping hosts.

                                      Your "general pass rule" needs to not be too general - it should be like suggested by Johnpoz and myself - just for destination "local LAN subnets". If it is very general and matches destination any, then that rule will pass everything, and no packets will get processed by the next rule into the Failover gateway group. Just suggesting you check how "general" that rule is and that your Failover actually works when 1 WAN goes down.

                                      As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                                      If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                                      1 Reply Last reply Reply Quote 0
                                      • First post
                                        Last post