Issue with lan to opt1
-
I setup a new pfsense 2.0 and its working well except one issue
here is my setup
–----------------------------------------------------------------------
WAN - X.X.X.X (public static ip over cable)LAN - 192.168.1.1/24
OPT1 - 192.168.99.1/24
WAN has allow rule for port 443 to 192.168.1.10 and NAT rule to match
LAN has rule ALLOW ANY from ANY to ANY (temp to see if it was a problem here)
OPT1 has rule ALLOW ANY FROM ANY TO ANY (temp to see if it was a problem here)
LAN clients has access to internet
OPT1 clients has access to internet
OPT1 clients can ping internet or LAN clients
LAN clients can ping internet clients
LAN clients CANNOT ping OPT1 clients but can ping 192.168.99.1
When pinging from the pfsense shell I can ping lan clients and opt1 clients
Can someone please point me is where I may have gone wrong?
Thanks :)
-
Check firewall on the device your trying to ping.. Out of the box for example window firewall does not allow icmp to devices on different segment.. So sure pfsense from 192.168.99.1 can ping, but 192.168.1.X would be blocked by local host software firewall.
This comes up quite a bit!! Should be on in faq of why can I not ping my devices ;)
I personally have windows firewall off for my private profile - its my secure network, there are no hostile devices on it. And my firewall (pfsense) between my segments and between my network segments and the wan. But with no hostile machines, why the extra overhead of having to configure host firewalls? etc..
-
Thanks for rhe reply and I do think this would make a great wiki or faq.. as I have been searching for it for awhile now.
I have made sure the firewall and scopes are good on the box I am doing my pings from. I dont think this is the problem however as I can ping the gw for 192.168.99.1 and also ping other nets outside as well like 70.69.100.x
Just to be clear this is what I am seeing now..
I CAN ping 192.168.99.1 (which is on the pfsense and is assigned to opt1)
I CANNOT ping 192.168.99.200 (which is a ip phone) I get this error
Reply from 192.168.99.200: Destination port unreachable.
I CAN ping the device from the shell on the pfsense box just fine.
Currently on firewall rules I have
Under lan tab
IPv4 LANnet * * * * noneUnder opt1 tab
IPv4 * * * * * nonelan is setup for 192.168.1/24
opt1 is setup for 192.168.99.1/24
block private and bogon networks unchecked for both interfaces
-
Are you using gateway groups for load balancing?
In recent versions the auto-added negate rules behavior was modified. Try adding a specific allow rule with source: LAN network, destination: OPT1 network, making sure the gateway option is left blank, and placing it above your defaut allow to any rule
-
"I have made sure the firewall and scopes are good on the box I am doing my pings from."
Who said anything about the box your pinging from – on the device your PINGING!!! It's firewall.
"Reply from 192.168.99.200: Destination port unreachable."
So that is the device saying hey, you can reach that port.. What sort of ping where you doing? Not a simple icmp echo request if you got that sort of answer back normally. What is the OS of the device your trying to ping at 192.168.99.200??
