Multi Lan issue

elgaup0

Hi,

I have pfsense running with Multi Lan with independent Nic's & Multi Wan with failover

Example

Vr0 - Wan1
vr1 -Wan 2

re0 - Lan 1 - 192.168.2.1
re1 -Lan 2 - 192.168.3.1
ath0 - Wireless- 192.168.4.1

My goal is to Lan1 computers communicate & access Lan2 computers and vice versa with wireless.

I have tried bridging re0, re1, ath0. But no result

Please guide me through procedure.

johnpoz

There is no need to bridge. You just need to create the correct firewall rules on your lan interfaces. Default the first lan will have a any any rule. But the other interfaces will not have any rules and will have to be created to allow connectivity be it to wan, or other lans however you want to allow access.

elgaup0

Hi,

I have added following rule, for all interfaces(excluding wan) still i can't ping.

ID Proto Source Port Destination Port Gateway Queue Schedule Description
IPv4 * * * * * * Failover none

** My mistake i can't ping

johnpoz

And your pinging from where to where?

And what is your route table look like in pfsense?

example - I have multiple segments

And what does a traceroute look like.. So my lan is 192.168.1.0/24 and my wlan is 192.168.2.0/24

I can ping something on the wireless network. As you can see I go through pfsense on my network to get there.

What is the network settings on your devices on your different segments?

Can your devices on each segment ping pfsense interface IP in that segment? Can they use the internet through pfsense?

routes.png_thumb

trace.png_thumb

elgaup0

I am attaching route's and trace route image's i see problem, with trace route.

Regards

Routes.png_thumb

traceroute.png_thumb

johnpoz

So you have a wan with a 192.168.6.0/24 network?

And you say your other wan is vr0 which is 192.168.3.0/24

Vr0 - Wan1

So yeah guess from the routing table it would try and go out vr0 which you say is your wan when trying to get to 192.168.3.0/24

elgaup0

i am sorry for the confusion

re0(192.168.1.1) wan2 –
Failover Network
re1 PPP0E wan1 --

The networks below, are not communicating with each other.

ex: my ip is 192.168.2.10 is not able to ping 192.168.3.24

ath0(Wifi) 192.168.2.0/24

vr0 (Lan) 192.168.3.0/24

vr1(Testlan) 192.168.6.0/24

johnpoz

Well if wan is 192.168.1.1 you would be natting I assume to any of the lan networks, and would have to port forward. You can see from your traceroute something is not right.

Why do you have what looks like 2 items in hops 1 and 2?

Can you post up say screenshot of your interfaces..
Why do you have a 192.168.1.1 and 192.168.1.13, and why does gateway for 1.1 show a MAC address? Which seems to be 64:66:b3 owned by tp-link.

Can you post a drawing of this network.. Why do you have private IPs address on your WAN connections?

phil.davis

@elgaup0:

Hi,

I have added following rule, for all interfaces(excluding wan) still i can't ping.

ID Proto Source Port Destination Port Gateway Queue Schedule Description
IPv4 * * * * * * Failover none

The traceroute indicates that the traffic is being directed to a gateway by a rule somewhere, not using the ordinary routing table. Is "Failover" a gateway group? (the "*" don't line up nicely on the screen - but after counting them, it seems that "Failover" is in the "Schedule" column?)
If you are directing general internet traffic into a gateway group, then you also have to do something to pass local traffic between subnets without it getting forced into a gateway group and out on the public internet. One way is to make an alias for all your local LAN subnets, then put a pass rule before the general rule, pass source any, destination LAN-subnet-alias.

elgaup0

I am posting all the details requested.

AIRTEL_INTERNET (wan) -> re0 -> v4/DHCP4: 192.168.1.13/24
RSN_PBX1 (lan) -> vr1 -> v4: 192.168.6.1/24
BEAM_INTERNET (opt1) -> pppoe0 -> v4/PPPoE: 49.204.219.***/32
WIFI (opt2) -> ath0_wlan0 -> v4: 192.168.2.1/24
LAN (opt4) -> vr0 -> v4: 192.168.3.1/24

airtel_rules.png_thumb

beam_rules.png_thumb

lan.png_thumb

pbx_rules.png_thumb

wifi.png_thumb

elgaup0

Gateways

interfaces.png_thumb

gateways.png_thumb

Gateway-failover.png_thumb

johnpoz

Why do you have everything going out your internet??

You do understand setting up the gateways like that turns off the routing functions

"Leave as 'default' to use the system routing table. Or choose a gateway to utilize policy based routing."

There is no reason for those entries, the systems knows based upon its routing table how it can get to the internet. And how it can get to the other networks its connected to. What you are doing with that rule is saying – USE the internet.. Screw your other connections you have directly connected to specific networks.

elgaup0

The rules in Lan and Wifi are for the failover /load balancing i read it some where

johnpoz

Yes you use groups and stuff on multiwan for lots of different things.. But you don't have any rules ABOVE those that allow access to your other lans, so guess what happens. Everything tries to go out your wan.

Put rules above those that allow access to your lans.

https://doc.pfsense.org/index.php/Multi-WAN_2.0
Policy Route Negation

When a firewall rule directs traffic into the gateway, it bypasses the firewall's normal routing table. Policy route negation is just a rule that passes traffic to other local or VPN-connected networks that does not have a gateway set. By not setting a gateway on that rule it will bypass the gateway group and use the firewall's routing table. These rules should be at the top of the ruleset – or at least above any rules using gateways.

phil.davis

Yes, as johnpoz says, above each rule that passes traffic to the Failover gateway put an ordinary Pass rule that matches destination "local LANs". I would make an Alias for all the local LAN subnets, then use that alias as the destination.

elgaup0

Thanks guy's problem solved. I have deleted the failover rule, added general pass rule, then failover rule. now i can ping hosts.

phil.davis

@elgaup0:

Thanks guy's problem solved. I have deleted the failover rule, added general pass rule, then failover rule. now i can ping hosts.

Your "general pass rule" needs to not be too general - it should be like suggested by Johnpoz and myself - just for destination "local LAN subnets". If it is very general and matches destination any, then that rule will pass everything, and no packets will get processed by the next rule into the Failover gateway group. Just suggesting you check how "general" that rule is and that your Failover actually works when 1 WAN goes down.