Help me settle the routing problem

  • Guys;

    I have setup my pfsense with 4 interface.

    1. LAN -
    2. WAN - 219.93.x.x/29
    3. OPT1 - - DMZ
    4. OPT2 -

    I have created a routing in my pfsense so that any 10.122.17.x will be routed to as a gateway, and i managed to ping the 10.122.17.x ip's.

    My problem now, from my LAN, i can access 10.200.11.x ip to do ssh or telnet, but i cant do telnet or ssh to 10.122.17.x ip's from my LAN.

    I need some help on this.

    Please advise.


  • Please show us the firewallrules at LAN. Also make sure there are some reverse routes on the gateways behind OPT2 to find the way back to your LAN. Did you enter a gateway at interfaces>opt2?

  • Hi, Friend…
    Please checked....

    1. static route LAN Subnet ---- > Distrination subnet + mask ----- > gateway  is correct,
    2. firewall rule (LAN interface) permit LAN subnet to 10.122.17.x

  • guys,

    I've setup my OPT2 interface to have as a gateway.

    Apart from that, i have create a rule in LAN whereby the 10.122.17.x destination from LAN subnet is allowed and via the gateway

    Still, i can't ssh or telnet or ping from my LAN to 10.122.17.x ip's.

    I didnt put any static routing since i have allowed the rules in LAN as well as put the OPT2 gateway interface.

    Please advise.


  • are you move rule permit LAN sybnet to 10.122.17.x on the top or above rule loadbalancing and policy routing?.

    if you still can't access to 10.122.17.x please step by step…
    1. remove existing rule for acccess to 10.122.17.x
    2. add new rule on LAN interface easy protcol (telnet = 23, SSH = 22) and move to top

    if you still can't access try to add rule on OPT2 interface for LAN subnet can access to 10.122.17.x, i think you something wrong.

    if you not completed please post your summary network diagram (if can)...

  • Don't set a gateway at interfaces>opt2 unless this is an additional WAN type interface. Add a static route instead. Does it work now?

  • guys;

    I've done as advised.

    I can see the logs in my pfsense.

    Apr 7 09:37:04 pf: 2. 981875 rule 625.qlandef.112/0(match): pass in on rl0: (tos 0x0, ttl 128, id 63102, offset 0, flags [none], proto: ICMP (1), length: 60) > ICMP echo request, id 512, seq 2816, length 40

    Unfortunately, the ping from LAN to still failed.

    C:\Documents and Settings\Kryz>ping

    Pinging with 32 bytes of data:

    Request timed out.
    Request timed out.
    Request timed out.
    Request timed out.

    I've added this;

    1. Remove gateway from OPT2 interface.
    2. Added static routing gw in pfsense.
    3. Added LAN rule that ICMP from LAN subnet to network is allowed.
    4. Added OPT2 rule that ICMP from LAN subnet to network is allowed.

    Please advise.


  • @mrlonely78:

    1. Added static routing gw in pfsense.

    You don't need any routes for local subnets on your pfSense interfaces. Drop the route. You only need firewallrules.

  • Hoba,

    If i remove my statis routing, the pfsense can't even ping to 10.122.17.x network forget about LAN then.

    I think the static routing must be there, otherwise, the pfsense doesn't know where it should forward the packet to.

    Please take note that i didnt set any gateway to my OPT2 interface.

    Please advise.


  • Never mind, I was wrong here and had a different setup in mind.

  • needs some steps to understand the situation:

    1. remove any gateways on any interface except WAN
    2. create alias "OPT2WAY" and include 10.122.17.x subnet 10.200.11.x subnet
    3. create rule at top on LAN interface for ICMP (Lan subnet)-> (OPT2WAY) alias
    4. add rule at top on OPT2 interface for ICMP (OPT2WAY)->(Lan subnet)

    then ping from any Lan station:

    1. pfsense Lan interface IP(
    2. pfsense OPT2 interface IP(
    3. gateway's IP from your side(
    4. other IP of gateway, that looks to 10.122.17.x subnet(i don't know this one)
    5. then your station (

    must be an answer only 1 to 4 steps
    then add static route ( gw
    repeat last 5 numbered steps.
    must be all right!
    if no answer on step 5 - you have no routing on that redirects packets for your LAN subnet

    I'm waiting for results…

  • guys;

    I've done this;

    1. Add rule on LAN to allow LAN subnet to ICMP to OPT2 subnet
    2. Add rule on OPT2 to allow OPT2 subnet to ICMP to LAN subnet
    3. All rule created above put at the top of each interface rule

    This is what i get when i Ping from my PC (

    1. Ping to or - reply success
    2. Ping to - reply success
    3. Ping to (gateway to 10.122.17.x subnet) - no reply is a Cisco router that connected to a leased line modem that go to 10.122.17.x private network.

    Attached the pfsense firewall log.

    pf: 2. 216031 rule 627.qlandef.143/0(match): pass in on rl0: (tos 0x0, ttl 128, id 60068, offset 0, flags [none], proto: ICMP (1), length: 60) > ICMP echo request, id 512, seq 4608, length 40

    Log shown that the ICMP packet is allowed by pfsense. However, i still failed to ping to - no reply.

    Please advise.

    Hope it helps.


  • The cisco router is missing routes.

  • guys;

    Help me configure my Cisco then.

    This is the current config;

    interface FastEthernet0
    ip address
    speed auto
    interface Serial0
    ip address
    no fair-queue
    ip classless
    ip route
    ip route
    ip route
    no ip http server

    from there, if you look, all is directed to as a default gateway which i understand that the router should handle the 10.122 traffics.

    but, if my pfsense OPT2 interface, it should not directed to, otherwise, confirm no packet can be send back to pfsense.

    So, which gateway should i use in my Cisco router for my pfsense packet?

    Please advise.


  • i think you need 1 more route:

    ip route

  • Guys;

    I've done that;


    1. Can ping from pfsense and

    2. Can ping from my pc ( to

    3. But failed to ping from my pc ( to

    Added Cisco router config ip route

    Please advise.


  • & 10.122.17.x - external to your network?

Log in to reply