Issue with lan to opt1



  • I setup a new pfsense 2.0 and its working well except one issue

    here is my setup
    –----------------------------------------------------------------------
    WAN - X.X.X.X  (public static ip over cable)

    LAN - 192.168.1.1/24

    OPT1 - 192.168.99.1/24

    WAN has allow rule for port 443 to 192.168.1.10 and NAT rule to match

    LAN has rule  ALLOW ANY from ANY to ANY (temp to see if it was a problem here)

    OPT1 has rule ALLOW ANY FROM ANY TO ANY (temp to see if it was a problem here)

    LAN clients has access to internet

    OPT1  clients has access to internet

    OPT1  clients can ping internet or LAN clients

    LAN  clients can ping internet clients

    LAN  clients CANNOT ping  OPT1 clients  but can ping 192.168.99.1

    When pinging from the pfsense shell  I can ping lan clients and opt1 clients

    Can someone please point me is where I may have gone wrong?

    Thanks :)


  • Rebel Alliance Global Moderator

    Check firewall on the device your trying to ping.. Out of the box for example window firewall does not allow icmp to devices on different segment.. So sure pfsense from 192.168.99.1 can ping, but 192.168.1.X would be blocked by local host software firewall.

    This comes up quite a bit!!  Should be on in faq of why can I not ping my devices ;)

    I personally have windows firewall off for my private profile - its my secure network, there are no hostile devices on it.  And my firewall (pfsense) between my segments and between my network segments and the wan.  But with no hostile machines, why the extra overhead of having to configure host firewalls? etc..




  • Thanks for rhe reply and I do think this would make a great wiki or faq.. as I have been searching for it for awhile now.

    I have made sure the firewall and scopes are good on the box I am doing my pings from.  I dont think this is the problem however as I can ping the gw for 192.168.99.1  and also ping other nets outside as well  like 70.69.100.x

    Just to be clear  this is what I am seeing now..

    I CAN ping  192.168.99.1  (which is on the pfsense and is assigned to opt1)

    I CANNOT ping 192.168.99.200  (which is a ip phone)  I get this error

    Reply from 192.168.99.200: Destination port unreachable.

    I CAN ping the device from the shell on the pfsense box just fine.

    Currently on firewall rules I have

    Under lan tab
        IPv4    LANnet *  *  *  * none

    Under opt1 tab
        IPv4    *  *  *  *  *  none

    lan  is setup for 192.168.1/24

    opt1 is setup for  192.168.99.1/24

    block private and bogon networks unchecked for both interfaces



  • Are you using gateway groups for load balancing?

    In recent versions the auto-added negate rules behavior was modified. Try adding a specific allow rule with source: LAN network, destination: OPT1 network, making sure the gateway option is left blank, and placing it above your defaut allow to any rule


  • Rebel Alliance Global Moderator

    "I have made sure the firewall and scopes are good on the box I am doing my pings from."

    Who said anything about the box your pinging from – on the device your PINGING!!!  It's firewall.

    "Reply from 192.168.99.200: Destination port unreachable."

    So that is the device saying hey, you can reach that port.. What sort of ping where you doing?  Not a simple icmp echo request if you got that sort of answer back normally.  What is the OS of the device your trying to ping at 192.168.99.200??