Subnet config question

[Joschide]

Hello.  New to pfSense and I'm trying to set up a lab on an existing network to evaluate.  I can ping all the way to WAN gateway including other boxes just outside of the pfSense firewall, but no further like the commonly used IP 8.8.8.8.

Here's the set up:
1.)  Internet
2.)  Firewall 1 (192.168.0.1/24) (pfSense gateway)
3.)  vmWare vm pfSense (3 Interfaces)
      WAN - (192.168.0.222/24)
      LAN - (Not used in this example)
      LANSandbox - (192.168.12.1/24)

I've tried everything on this link:
https://doc.pfsense.org/index.php/Connectivity_Troubleshooting

I can't get further than trying to ping 8.8.8.8.

Any help will be appreciated.

Thanks,
Joschi

[KOM]

How are you pinging, from some LANSandbox client or from pfSense's Diagnostics - Ping?  If you can ping past the pfSense box then the problem is likely upstream with your other firewall.

[Joschide]

@KOM:

How are you pinging, from some LANSandbox client or from pfSense's Diagnostics - Ping?  If you can ping past the pfSense box then the problem is likely upstream with your other firewall.

From Diagnostics.  I've also tried from the client.

I monitored the ping requests from Firewall 1 and they were allowed.

[KOM]

OK, so are the responses being received by your pfSense WAN interface?

[Joschide]

I have a question on that.  I don't see the diagnostic pings in the firewall logs.  I do however, see the ping requests from client.  Is that by design?

The ping requests from the client are allowed or passed.  If I filter for WAN interface and ICMP protocol, I do not see any log entries.  Is there a better way to see if WAN is receiving the ICMP responses?

Thanks,
Joschi

[johnpoz]

If you ping from pfsense diag, and your saying its allowed on firewall in front of pfsense.  Simple sniff tells you if pings actually left pfsense, and if you see a response.  If you see them leave, and you don't get a response then your problem is in front of pfsense.

[KOM]

I have a question on that.  I don't see the diagnostic pings in the firewall logs.

You will only see a block msg if the rule that does the blocking is set to log.  Also, if the ping is successful then there is no blocking and therefore no logging.

I do however, see the ping requests from client.

Unless you have added a firewall rule to allow traffic on your LANSandbox interface (OPT1?) out, all traffic from that network should be blocked and logged.

Just do a Diagnostics - Packet Capture on the WAN and see if you ping replies are even hitting pfSense.

[Joschide]

It turns out I was missing a static route on Firewall 1.  I checked this yesterday, but must have made a mistake somewhere.  Anyways, problem solved.

Thank you for your responses,
Joschi