2

I could really use some help getting the devices (Including the routers) which sit behind Router2 eth0/0 to access the web.

The following is a brief overview of the my network topology:

enter image description here

The current configuration is as such:

  • All routers (including pfSense) are participating in OSPF
  • pFsense is connected directly to the WAN
  • pFsense is configured with 3 VLANs (VLAN 11, 12, 13)
  • Router 2, Router 2 are sitting on VLAN13 (192.168.13.x)

At present:

  • Router 2 is capable of contacting pfSense WAN, and capable of pining outside addresses
  • pfSense and Router 2 are capable of pinging any and all devices behind Router 1

Now, here is the issue:

  • Router 1 can ping the WAN port on pfSense
  • Router 1 CANNOT ping anything beyond the WAN port.

The following briefly shows the configuration of Router2 and Router1

Router2:

interface GigabitEthernet0/0
 description PrimaryWANDesc_
 ip address 192.168.200.5 255.255.255.252
 ip virtual-reassembly in
 duplex auto
 speed auto
!
interface GigabitEthernet0/1
 ip address 192.168.30.150 255.255.255.0
 duplex auto
 speed auto
!         
router ospf 10
 network 150.10.90.0 0.0.0.255 area 0
 network 192.168.13.0 0.0.0.255 area 0
 network 192.168.200.4 0.0.0.3 area 0
!         
ip forward-protocol nd
!         
ip http server
no ip http secure-server
!         
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1 192.168.13.1 110

Router 1:

interface GigabitEthernet0/0
 ip address 192.168.200.6 255.255.255.252
 ip virtual-reassembly in
 duplex auto
 speed auto
!         
interface GigabitEthernet0/1
 ip address 192.168.24.254 255.255.255.0
 ip virtual-reassembly in
 duplex auto
 speed auto
!         
router ospf 10
 network 192.168.200.4 0.0.0.3 area 0
 network 192.168.24.0 0.0.0.255 area 0
!         
ip forward-protocol nd
!         
no ip http server
no ip http secure-server

Packet Captures from pinging the outside (beyond the WAN connection on pfSense)

Router 2 ping:

16:07:33.194621 IP 192.168.13.150 > 150.10.90.1: ICMP echo request, id 20, seq 0, length 80
16:07:33.195461 IP 150.10.90.1 > 192.168.13.150: ICMP echo reply, id 20, seq 0, length 80
16:07:33.195888 IP 192.168.13.150 > 150.10.90.1: ICMP echo request, id 20, seq 1, length 80
16:07:33.196636 IP 150.10.90.1 > 192.168.13.150: ICMP echo reply, id 20, seq 1, length 80
16:07:33.196964 IP 192.168.13.150 > 150.10.90.1: ICMP echo request, id 20, seq 2, length 80
16:07:33.197753 IP 150.10.90.1 > 192.168.13.150: ICMP echo reply, id 20, seq 2, length 80
16:07:33.198081 IP 192.168.13.150 > 150.10.90.1: ICMP echo request, id 20, seq 3, length 80
16:07:33.199293 IP 150.10.90.1 > 192.168.13.150: ICMP echo reply, id 20, seq 3, length 80
16:07:33.199622 IP 192.168.13.150 > 150.10.90.1: ICMP echo request, id 20, seq 4, length 80
16:07:33.200359 IP 150.10.90.1 > 192.168.13.150: ICMP echo reply, id 20, seq 4, length 80

Router 1 ping:

16:07:37.586067 IP 192.168.200.6 > 150.10.90.1: ICMP echo request, id 190, seq 0, length 80
16:07:39.584913 IP 192.168.200.6 > 150.10.90.1: ICMP echo request, id 190, seq 1, length 80
16:07:41.584978 IP 192.168.200.6 > 150.10.90.1: ICMP echo request, id 190, seq 2, length 80
16:07:43.584984 IP 192.168.200.6 > 150.10.90.1: ICMP echo request, id 190, seq 3, length 80
16:07:45.584962 IP 192.168.200.6 > 150.10.90.1: ICMP echo request, id 190, seq 4, length 80

Please let me know if I can provide any more information if it will aid in helping address this issue.
Thank you again!

Update:

I have gone back and placed the following configuration into the firewall:

- zebra.conf

 !
    password password
    log syslog
    !

- ospfd.conf

!
password password
log syslog
interface bce0
interface em0


router ospf
  ospf router-id 150.10.90.1
  log-adjacency-changes detail
  network 150.10.90.0/23 area 0.0.0.0
  network 192.168.50.0/24 area 0.0.0.0
  default-information originate always
!

The OSPF Database of the routers are as follows:

  • Router 2:

    OSPF Router with ID (192.168.31.254) (Process ID 10)

                    Router Link States (Area 0)
    
    Link ID         ADV Router      Age         Seq#       Checksum Link count
    150.10.90.1     150.10.90.1     459         0x80000020 0x007FB6 2
    192.168.31.254  192.168.31.254  852         0x8000001E 0x0027FB 2
    192.168.225.254 192.168.225.254 344         0x800001BC 0x00E92C 2
    
                    Net Link States (Area 0)
    
    Link ID         ADV Router      Age         Seq#       Checksum
    192.168.13.115  192.168.31.254  852         0x80000001 0x009262
    192.168.200.6   192.168.225.254 607         0x8000000E 0x00D902
    
                    Type-5 AS External Link States
    
    Link ID         ADV Router      Age         Seq#       Checksum Tag
    0.0.0.0         150.10.90.1     494         0x80000002 0x008642 0
    

Router 1:

OSPF Router with ID (192.168.225.254) (Process ID 10)

                Router Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum Link count
150.10.90.1     150.10.90.1     577         0x80000020 0x007FB6 2
192.168.31.254  192.168.31.254  970         0x8000001E 0x0027FB 2
192.168.225.254 192.168.225.254 461         0x800001BC 0x00E92C 2

                Net Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum
192.168.13.115  192.168.31.254  970         0x80000001 0x009262
192.168.200.6   192.168.225.254 724         0x8000000E 0x00D902

                Type-5 AS External Link States

Link ID         ADV Router      Age         Seq#       Checksum Tag
0.0.0.0         150.10.90.1     612         0x80000002 0x008642 0 
2
  • It looks like it is working, now.
    – Ron Maupin
    Feb 25, 2016 at 0:46
  • Ron, figured it out. As it turns out, if pfSense NAT mode is set to "automatic," NATing will only take place on those devices that are directly attached to the firewall itself. The minute you switch over to Manual mode, then everything worked perfectly!!!! :) The downside to this is scaling, since one has to manually add in each route. Thank you again for all your help over these past few days, it was much appreciated. Feb 25, 2016 at 3:36

1 Answer 1

1

You are creating a default route on Router 2, but you are not originating it in OSPF, so it doesn't get sent to Router 1. You can originate it on Router 2, set a default route on Router 1, or, better yet, originate it on the firewall so that it gets into OSPF from there (you can then eliminate it on Router 2). Originating it in Router 2 could be problematic because your firewall is now participating in OSPF.

Since Router 1 doesn't have a default route (either specifically configured, or from a routing protocol), it has no route to anything on the Internet, so the router will drop traffic to routes it doesn't have in its routing table.

FYI:

You seem to want all your interfaces on each router to participate in OSPF. You can do this with a single network statement:

network 0.0.0.0 255.255.255.255 area 0

Doing it that way will put the networks from every interface into OSPF, and it will try to connect neighbors on all the interfaces. This will save you from needing to add network statement every time you bring up a new interface. If you have any interfaces on which you don't want to try to form neighbors, you can use the passive-interface <interface> command to still use the interface's network, but not send hellos on the interface. You probably want to do this with the WAN interface since you don't want the ISP to neighbor with your network.

5
  • Thank you Ron! Just to clarify, if I were to set the default route and originate it on the firewall, I would 'not need' the default route configured on R2? Feb 24, 2016 at 21:57
  • Correct. You already have a default route in the firewall since it needs that to get to addresses on the Internet without the entire Internet routing table in its routing table. You just need to advertise that default route in OSPF so that all the other routers know to send traffic for unknown destinations to it.
    – Ron Maupin
    Feb 24, 2016 at 22:00
  • Thank you again Ron for help with this issue. However, it looks like another thread will be required to resolve the issue of "correctly advertising the default route in OSPF" in pfSense. :) Feb 24, 2016 at 22:59
  • I think Quagga can use Cisco-like commands, and that would be the default-information originate command, which injects the default route if it exists in the firewall's routing table. You could also use the default-information originate always command to inject the default route even if it doesn't exit in the firewall's routing table. See: nongnu.org/quagga/docs/docs-info.html#OSPFv2
    – Ron Maupin
    Feb 24, 2016 at 23:18
  • I updated the code to include the routers OSPF databases and the code from Quagga. Feb 25, 2016 at 0:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.