1

I'm having issues with connectivity on my home lab network after trying a different setup. Can't connect to the pfsense box from LAN, though pfsense can reach all the way to the LAN network. homenet

From the viewpoint of my laptop:

ping 192.168.1.1 From laptop to fa 1/0/1 interface
PING 192.168.1.1 (192.168.1.1): 56 data bytes
64 bytes from 192.168.1.1: icmp_seq=0 ttl=255 time=1.290 ms
64 bytes from 192.168.1.1: icmp_seq=1 ttl=255 time=1.281 ms
64 bytes from 192.168.1.1: icmp_seq=2 ttl=255 time=1.865 ms
64 bytes from 192.168.1.1: icmp_seq=3 ttl=255 time=3.229 ms

ping 192.168.1.43 From laptop to fa 1/0/2 interface
PING 192.168.1.43 (192.168.1.43): 56 data bytes
64 bytes from 192.168.1.43: icmp_seq=0 ttl=255 time=1.256 ms
64 bytes from 192.168.1.43: icmp_seq=1 ttl=255 time=1.606 ms
64 bytes from 192.168.1.43: icmp_seq=2 ttl=255 time=1.299 ms
64 bytes from 192.168.1.43: icmp_seq=3 ttl=255 time=1.877 ms

ping 192.168.1.41 From laptop to Pfsense
PING 192.168.1.41 (192.168.1.41): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3
Request timeout for icmp_seq 4

Laptop has connectivity to L3 switch but not pfsense box


From the viewpoint of the L3 switch:

ping 192.168.1.1 - From SW to host in LAN

    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
    !!!!!
    Success rate is 100 percent (5/5), round-trip min/avg/max = 1/7/17 ms

 ping 192.168.1.41 - From SW to Pfsense em1 interface

    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 192.168.1.41, timeout is 2 seconds:
    !!!!!
    Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/8 ms

 ping 8.8.8.8 - L3 SW to internet

 Type escape sequence to abort.
 Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
 .....
 Success rate is 0 percent (0/5)

Routing table

show ip route
Gateway of last resort is 0.0.0.0 to network 0.0.0.0

     192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks
C       192.168.1.40/29 is directly connected, FastEthernet1/0/2
C       192.168.1.0/28 is directly connected, FastEthernet1/0/1
S*   0.0.0.0/0 is directly connected, FastEthernet1/0/2

running config

Router-L3(config)#do show run
Building configuration...

Current configuration : 3239 bytes
!
version 12.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname Router-L3
!
boot-start-marker
boot-end-marker
!
enable secret 
!
!
!
no aaa new-model
switch 1 provision ws-c3750-48ts
system mtu routing 1500
ip routing
ip name-server 50.116.40.226
ip name-server 104.245.39.112
ip name-server 74.207.232.103
ip name-server 107.170.95.180
ip name-server 8.8.8.8
ip dhcp excluded-address 192.168.1.1 192.168.1.2
!
ip dhcp pool LAN
   network 192.168.1.0 255.255.255.240
   dns-server 50.116.40.226 104.245.39.112
   default-router 192.168.1.1
!
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
!
!
!
interface FastEthernet1/0/1
 description LAN
 no switchport
 ip address 192.168.1.1 255.255.255.240
!
interface FastEthernet1/0/2
 description TO FW
 no switchport
 ip address 192.168.1.43 255.255.255.248
!
interface FastEthernet1/0/3
!
[...]
interface FastEthernet1/0/48
 shutdown
!
interface GigabitEthernet1/0/1
!
interface GigabitEthernet1/0/2
!
interface GigabitEthernet1/0/3
!
interface GigabitEthernet1/0/4
!
interface Vlan1
 no ip address
 shutdown
!
interface Vlan2
 no ip address
 shutdown
!
ip default-gateway 192.168.1.41
ip classless
ip route 0.0.0.0 0.0.0.0 FastEthernet1/0/2
!
!
line con 0
line vty 5 15
!
end

L3 SW has connectivity to LAN and pfsense box, but not the internet


Viewpoint from PFsense

PING 192.168.1.43 (192.168.1.43): 56 data bytes  - PFsense to L3 fa 1/0/2
64 bytes from 192.168.1.43: icmp_seq=0 ttl=255 time=2.502 ms
64 bytes from 192.168.1.43: icmp_seq=1 ttl=255 time=2.281 ms
64 bytes from 192.168.1.43: icmp_seq=2 ttl=255 time=2.405 ms
64 bytes from 192.168.1.43: icmp_seq=3 ttl=255 time=1.730 ms

--- 192.168.1.43 ping statistics ---
4 packets transmitted, 4 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 1.730/2.229/2.502/0.299 ms

PING 192.168.1.1 (192.168.1.1): 56 data bytes - PFsense to L3 fa 1/0/1
64 bytes from 192.168.1.1: icmp_seq=0 ttl=255 time=0.571 ms
64 bytes from 192.168.1.1: icmp_seq=1 ttl=255 time=0.537 ms
64 bytes from 192.168.1.1: icmp_seq=2 ttl=255 time=0.548 ms
64 bytes from 192.168.1.1: icmp_seq=3 ttl=255 time=0.519 ms

--- 192.168.1.1 ping statistics ---
4 packets transmitted, 4 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 0.519/0.544/0.571/0.019 ms

PING 192.168.1.13 (192.168.1.13): 56 data bytes - From PFSense to a host in Lan
64 bytes from 192.168.1.13: icmp_seq=0 ttl=63 time=53.374 ms
64 bytes from 192.168.1.13: icmp_seq=1 ttl=63 time=69.013 ms
64 bytes from 192.168.1.13: icmp_seq=2 ttl=63 time=79.912 ms
64 bytes from 192.168.1.13: icmp_seq=3 ttl=63 time=114.207 ms

--- 192.168.1.13 ping statistics ---
4 packets transmitted, 4 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 53.374/79.126/114.207/22.342 ms

Firewall config Firewall config

Routing table enter image description here

Pf sense has connectivity to internet, and all the way to LAN


I believe it's an issue with the L3 switch, but there's something obvious I'm missing but I can't see it at the moment. Any help would be appreciated.

  • Home networking is off-topic for this forum. You can try on Super User. – Ron Maupin Sep 17 '15 at 22:59
  • so the result of your tracert from your pc stopped at 192.168.1.43 – Gadeliow Sep 17 '15 at 23:16
  • @Gadeliow I can ping up to 192.168.1.43, which is the fa 1/0/2 interface of the L3 switch. But when I ping 192.168.1.41 (pfsense box) it fails. Which is strange to me since I have a default route on it. – John Doe Sep 17 '15 at 23:23
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 6 '17 at 18:38
1

Beside the Problem, your default route is set in the wrong manner:

...
ip routing
ip classless
...

is on on your switch, ok.

So

ip default-gateway 192.168.1.41

has no meaning.

But

ip route 0.0.0.0 0.0.0.0 FastEthernet1/0/2

is not good, it should read

ip route 0.0.0.0 0.0.0.0 192.168.1.41

.

And (my opinion) the switch should not wait for DNS resolution, so i almost allways configure "no ip domain-lookup" (some IOS versions dont like the "-" ) Ok, so you must know the IP-adresses, but logging etc. of events on the device does not depend on external service "DNS" .

BTW, hat NAT been enabled on your PFSense box ?

| improve this answer | |
1

I didn't get the IP of your laptop, but I am guessing your pfsense box is missing a route to it.

traceroute from the pfsense should help you.

Otherwise, it smells like pfsense is dropping icmp echo requests (which makes network debugging harder).

| improve this answer | |
0

It looks like you have misconfigured the firewall.

The problem is most likely with the pfsense box since the laptop can ping the other network through the layer-3 switch. Do you allow the pfsense box to receive ICMP from a different network on that interface?

Can the layer-3 switch ping the local public address on the pfsense box? It can't ping Google. Something in the pfsense box is blocking you.

In fact, looking at your firewall rules, it looks like you only allow HTTP and HTTPS from anything other than the attached network. The pfsense box rjects any other traffic from the network the laptop is on. Try adding a rule just like the 2nd one, but using 192.168.1.0/28 as the source.

| improve this answer | |
  • I did. It's displayed as the 7th entry on the routing table picture I attached to the post. – John Doe Sep 17 '15 at 23:15
  • To my knowledge the top rule is a default rule to make sure you don't get locked out of the web configurator. I tried what you mentioned, but I still have the same problem, LAN network hosts can't reach the .41 interface. I even tried a rule that basically says any src from any port to to any dst with any port. – John Doe Sep 17 '15 at 23:50
  • One rookie mistake I see on the layer-3 switch is that, while it is layer-3 and routing, you have configured a default gateway for it which is on the pfsense box. The default gateway is the router address, and the router is on the layer-3 switch. As a layer-3 switch you shouldn't have the default gateway set; the static route in the router part will take care of that. – Ron Maupin Sep 18 '15 at 0:03
  • The issue persists with or without it. I put it on as a last effort to see if it changed anything, which it did not. – John Doe Sep 18 '15 at 0:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.