Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    2 network cards - can access WebGUI but not ping pfSense

    General pfSense Questions
    4
    10
    1520
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • L
      lemon last edited by

      Hi guys,

      I've got 2 network cards in my Win7 computer:

      • LAN1 10.0.0.10 with gateway 10.0.0.1 (internal network)
      • LAN2 192.168.2.100 with gateway 192.168.2.1 (this is pfSense, connected to WAN)

      with no specific routes set the traffic goes through LAN1, but obviously I need internet connection for some applications.
      So I set the following routes:

      destination    mask        gateway      interface      metric
      0.0.0.0        0.0.0.0    192.168.2.1  192.168.2.100  10
      10.0.0.0      255.0.0.0  10.0.0.1      10.0.0.10      20

      The idea behind should be to direct every traffic to pfSense except the one directed to our internal servers.

      Now every traffic seems to end in the nowhere, also pings are loss 100%. I even can't ping pfSense (192.168.2.1) though I can access without problem its webGUI. Pinging one of our internal servers works fine…
      Squid is also installed on pfSense, and surfing through proxy works fine.

      Any idea what I did wrong here?

      Thank you very much!!!

      1 Reply Last reply Reply Quote 0
      • chpalmer
        chpalmer last edited by

        Does the 10. network see the internet in anyway?  If not get rid of the gateway IP.  Leave it blank.

        Triggering snowflakes one by one..

        1 Reply Last reply Reply Quote 0
        • L
          lemon last edited by

          Hi chpalmer,

          didn't change anything, I still can ping 10.0.0.1 but not 192.168.2.1.
          By the way, the windows firewall is off.

          What I tried now: i deactivated the 10.x network card on my computer, and even that didn't change anything. What the hell…?!?

          Thank you again

          1 Reply Last reply Reply Quote 0
          • V
            viragomann last edited by

            @lemon:

            destination    mask        gateway      interface      metric
            0.0.0.0        0.0.0.0    192.168.2.1  192.168.2.100  10
            10.0.0.0      255.0.0.0  10.0.0.1      10.0.0.10      20

            The idea behind should be to direct every traffic to pfSense except the one directed to our internal servers.

            Do you really need the gateway 10.0.0.1 to reach the servers?
            If not, delete these routes again, go to the interface configuration of LAN1 and delete the gateway (leave it blank), in LAN2 add the gateway 192.168.2.1 if it isn't already set and Windows will do the rest.

            1 Reply Last reply Reply Quote 0
            • L
              lemon last edited by

              I already deactivated LAN1 and LAN2's gateway is automatically 192.168.2.1. But that doesn't solve my problem  :(
              Maybe my settings are ok and there's something wrong with my windows installation?

              1 Reply Last reply Reply Quote 0
              • V
                viragomann last edited by

                Check the Windows routing table. In cmd run "route print".

                1 Reply Last reply Reply Quote 0
                • L
                  lemon last edited by

                  Ok, now LAN1 and LAN2 are active again, I've deleted the persistent routes I've added before and made a "IPCONFIG /RENEW", so that the interfaces are as they come "out of the box".

                  These are the active routes "route print" gives out:

                  ===========================================================================
                  Interface List
                  22…90 1b 0e 3e 4d 56 ......Intel(R) Ethernet Connection I217-V
                  17...00 50 b6 0a a3 a0 ......ASIX AX88178 USB2.0 to Gigabit Ethernet Adapter
                    1...........................Software Loopback Interface 1
                  12...00 00 00 00 00 00 00 e0 Microsoft-ISATAP-Adapter
                  10...00 00 00 00 00 00 00 e0 Microsoft-Teredo-Tunneling-Adapter
                  21...00 00 00 00 00 00 00 e0 Microsoft-6zu4-Adapter
                  18...00 00 00 00 00 00 00 e0 Microsoft-ISATAP-Adapter #5

                  ===========================================================================
                  Active Routes:
                  Network Destination          Netmask          Gateway        Interface Metric
                            0.0.0.0            0.0.0.0      100.1.18.10      100.1.18.102    10
                            0.0.0.0            0.0.0.0      192.168.2.1    192.168.2.100    20
                        100.1.18.0      255.255.255.0          On-Link      100.1.18.102    266
                      100.1.18.102    255.255.255.255          On-Link      100.1.18.102    266
                      100.1.18.255    255.255.255.255          On-Link      100.1.18.102    266
                          127.0.0.0          255.0.0.0          On-Link        127.0.0.1    306
                          127.0.0.1    255.255.255.255          On-Link        127.0.0.1    306
                    127.255.255.255    255.255.255.255          On-Link        127.0.0.1    306
                        192.168.2.0      255.255.255.0          On-Link    192.168.2.100    276
                      192.168.2.100    255.255.255.255          On-Link    192.168.2.100    276
                      192.168.2.255    255.255.255.255          On-Link    192.168.2.100    276
                          224.0.0.0          240.0.0.0          On-Link        127.0.0.1    306
                          224.0.0.0          240.0.0.0          On-Link    192.168.2.100    276
                          224.0.0.0          240.0.0.0          On-Link      100.1.18.102    266
                    255.255.255.255    255.255.255.255          On-Link        127.0.0.1    306
                    255.255.255.255    255.255.255.255          On-Link    192.168.2.100    276
                    255.255.255.255    255.255.255.255          On-Link      100.1.18.102    266

                  Persistent routes:
                    None

                  What do you want me to do now?

                  1 Reply Last reply Reply Quote 0
                  • V
                    viragomann last edited by

                    As shown, you've 2 default routes. One to 100.1.18.10 with metric 10 and one to 192.168.2.1 with 20. The lower metric value is the preferred route. Shure, you've deleted the routes you set first?

                    What shows "ipconfig /all"?

                    1 Reply Last reply Reply Quote 0
                    • L
                      lemon last edited by

                      Hi,

                      sorry, was absent for a few days. I've connected now a notebook with a single network card to pfSense and it gets an IP address from it. Ok. But the notebook can't ping pfSense neither. What's the problem here? Seems to be a pfSense problem at this time, don't you think?

                      Thank you very much

                      EDIT: when activating the original firewall rule "default allow LAN to any rule" I can ping pfSense again and routes are working:

                      1 Reply Last reply Reply Quote 0
                      • johnpoz
                        johnpoz LAYER 8 Global Moderator last edited by

                        Well yeah the default any any rule allows icmp, if your not going to use a any any rule and you want to ping you would have to have a rule that allows icmp.

                        So my wireless guest segment is pretty locked down, but you can see I allow them to ping pfsense interface so they can validate connectivity.  Then any other IP of the firewall at all on any port is blocked.  I then allow them out to anything they want as long as not rfc1918 (local networks) - this allows them internet access.  Notice they can not even use pfsense for dns, I hand them public via dhcp for that.


                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.01

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post