Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    [SOLVED]Always need to ping to establish a connection

    Scheduled Pinned Locked Moved Routing and Multi WAN
    10 Posts 4 Posters 2.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      cesjr
      last edited by

      Always need to ping to establish a connection

      I have two subnet
      192.168.1.0/24  GW:192.168.1.1
      10.1.2.0/24    GW:10.1.2.254
      The pfsense LAN interface IP is 192.168.1.1 , below is pfsense routing table

      | Network | Gateway | Interface | Description |
      | 10.0.0.0/24 | 192.168.1.244 | LAN | LAN2 |

      The 10.1.2.254 is a Freebsd Router ,has two interface below

      192.168.1.244 /24
      10.1.2.254 /24
      default router is 192.168.1.1

      When I using vnc viewer from 10.1.2.0 to 192.168.1.0 , I always need to ping clinet's IP
      , but if I change the clients default gateway to 192.168.1.244 , it is working fine .

      How should I fix this problem , any suggestion will be arrpeciated ,thanks

      1 Reply Last reply Reply Quote 0
      • V
        viragomann
        last edited by

        @cesjr:

        The pfsense LAN interface IP is 192.168.1.1 , below is pfsense routing table

        | Network | Gateway | Interface | Description |
        | 10.0.0.0/24 | 192.168.1.244 | LAN | LAN2 |

        A typo at the network?

        1 Reply Last reply Reply Quote 0
        • C
          cesjr
          last edited by

          sorry , It should be this , I was paste wrong info :'(

          Network         Gateway             Interface Description
          10.1.2.0/24 192.168.1.244     LAN         LAN2

          1 Reply Last reply Reply Quote 0
          • V
            viragomann
            last edited by

            In System > Advanced > Firewall and NAT try to check "Bypass firewall rules for traffic on the same interface".

            1 Reply Last reply Reply Quote 0
            • C
              cesjr
              last edited by

              Thanks your suggestion ,after I applies this option , it is working fine , do not need to ping anymore.
              By the way ,why this option is not enable by default ,and why I have to ping ,if I do not enable it.

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                Because you are trying to hairpin in and back out the same interface which is an unsound network design.

                No idea about the ping. Something tells me you're not really seeing what you think you're seeing.

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • C
                  cesjr
                  last edited by

                  LOL, I think I have to study hard , and watch careful
                  What is the best network  design of multiple subnet , In my case ,should I change the 10.1.2.0/24 default gateway to pfsense ,  or let router do routing , gathering  all subnet  gateway on router .

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    You should talk to the downstream router on a dedicated transit network, not an address on LAN. In the configuration you have you would need to put a route for 10.1.2.0/24 on every LAN client pointing at 192.168.1.244. Otherwise they will send traffic for that network to the default gateway which, in turn, has to hairpin it back out the same interface it came in on.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • C
                      cesjr
                      last edited by

                      OK , I will think more carefully and adjusting my network design ,thanks :)

                      1 Reply Last reply Reply Quote 0
                      • C
                        cmb
                        last edited by

                        It's not a good design. But the reason a ping first works is almost certainly because it makes the host pick up the ICMP redirect, then when you try the TCP connection, it routes it directly accordingly.

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.