Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    LAN pings and External IP

    General pfSense Questions
    5
    11
    1154
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      tux100 last edited by

      I cannot ping pfsense LAN IPs.  When I ping external IPs, I do get ICMP replies.

      What part of pfsense do I need to enable to get ICMP replies on the LAN ips ?

      TIA

      1 Reply Last reply Reply Quote 0
      • KOM
        KOM last edited by

        You probably need to add the rules that allow ICMP on each LAN interface that you have.  By default, only the first LAN has such a rule called the Default allow LAN to any rule.  All other LANs will not have such a rule and no traffic will pass from that LAN to any other.  I'm guessing because you haven't really provided enough information to tell what you mean.  You can't ping which LAN IPs?  From where?  You can ping external IPs, from where?  How many LANs do you have?  Have you added or modified any default rules?

        1 Reply Last reply Reply Quote 0
        • T
          tux100 last edited by

          Proto  Source  Port      Destination        Port      Gateway  Queue Schedule Description
          –------------------------------------------------------------------------------------------------

          • *       * LAN Address 80 22 * *                   Rule1
            IPv4    *       * *                 *   * * none     Default allow LAN to any rule

          Here are the first 2 rules on LAN.
          I am guessing it is matches on the first rule, and since the first rule says port 80 and 22 only then ICMP is not allowed and it never gets to RULE2 ?

          1 Reply Last reply Reply Quote 0
          • K
            kejianshi last edited by

            It may not be a pfsense problem at all.  Perhaps your LAN clients are not allowing ICMP on their individual firewalls?

            1 Reply Last reply Reply Quote 0
            • Derelict
              Derelict LAYER 8 Netgate last edited by

              @tux100:

              I cannot ping pfsense LAN IPs.  When I ping external IPs, I do get ICMP replies.

              What part of pfsense do I need to enable to get ICMP replies on the LAN ips ?

              TIA

              Where are you trying to ping from?

              Chattanooga, Tennessee, USA
              The pfSense Book is free of charge!
              DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • K
                kejianshi last edited by

                Derelict

                What I often see is a guy with a couple of windows machines running on his LAN assuming that machine A  should automatically be able to ping machine B if pfsense is "allowing all" on the LAN.  But this isn't always the case since most of the time windows isn't allowing ICMP and even linux distros with firewall on default to block it usually.

                If this isn't the case, then maybe start tinkering with pfsense.

                1 Reply Last reply Reply Quote 0
                • Derelict
                  Derelict LAYER 8 Netgate last edited by

                  Yeah.  I get that.  I'm just wondering from the OP if he's not trying to ping LAN interface IPs from outside.  Chances are if the LAN rules allow pings to WAN IPs, pings to LAN address would also be allowed.

                  Chattanooga, Tennessee, USA
                  The pfSense Book is free of charge!
                  DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • stephenw10
                    stephenw10 Netgate Administrator last edited by

                    Assuming you are trying to ping the LAN address from a client in the LAN subnet.
                    The default configuration should allow that. However it looks like you've changed the protocol from 'any' to TCP. Try changing it back or adding a rule to allow ICMP.

                    Steve

                    1 Reply Last reply Reply Quote 0
                    • K
                      kejianshi last edited by

                      Really?  I'm not seeing TCP.  I just see IPV4.
                      Am I missing something simple?

                      1 Reply Last reply Reply Quote 0
                      • stephenw10
                        stephenw10 Netgate Administrator last edited by

                        Doh!  :-[

                        1 Reply Last reply Reply Quote 0
                        • K
                          kejianshi last edited by

                          haha - well take comfort in knowing that your simple mistakes are the only mistakes I could spot (-;

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post