0

I have 2 networks, the current one and the new one. The current one is not configured by me and one big mess and contains heavily out dated hardware (especially servers). I want to be able to access the complete current network from the new one so i can migrate server for server and device for device.

Some network details:

  • Current network:
    • IP: 192.168.1.1
    • IP range: 192.168.104.0/24
    • Router/firewall: Zyxel USG200
    • Contain all devices
    • Gives DHCP address to Pfsense (192.168.104.4/24)
  • New network:
    • IP: 10.128.10.1
    • IP range: 10.128.10.0/24.
    • Router/firewall: Pfsense
    • Currently it contains only 1 device, my desktop but this network will replace the current one in future
    • All devices will be "moved" from the old to the new network by time (one for one)
    • Connected with old network by port with alias "WAN 2"

I added a route in each firewall to the other network.

  • Zyxel: 10.128.10.0/24 via 192.168.104.4
  • Pfsense: 192.168.104.0/24 via "WAN2"

I also added a firewall rule to each firewall to allow all traffic from all sources to all destinations (for testing)

When i ping 192.168.104.1 with pfsense diagnostics, i got a response. I cannot find a way to do a ping from the Zyxel to Pfsense but as the route bellow is in the routing table i assume the (at least) routing configuration must be okay.

When i try to ping 192.168.104.1 (or any other device in the 104.x network) from my desktop in the 10.128.10.x network, i got a "request timed out" response. I also cannot SSH or browse to any IP in the 104.x network.

When i connect my desktop to the 104.x network and try to ping 10.128.10.1 or try to visit that IP in my browser (Pfsense web interface) i got "request timed out"

A print screen of my firewall rule on Pfsense (on the desktop interface): enter image description here

And one from my firewall rule in the Zyxel: enter image description here

Probably i miss some configuration/settings but i have no idea what. Would be great when someone can help me out with this as i'm already struggling almost 2 days with this. When extra details are required, let me know and i will update my question.


UPDATE

My config. I also obfuscated certs and private keys.

<?xml version="1.0"?>
<pfsense>
    <version>19.1</version>
    <lastchange></lastchange>
    <system>
        <optimization>normal</optimization>
        <hostname>axx-psen-wal01</hostname>
        <domain>localdomain</domain>
        <group>
            <name>all</name>
            <description><![CDATA[All Users]]></description>
            <scope>system</scope>
            <gid>1998</gid>
            <member>0</member>
        </group>
        <group>
            <name>admins</name>
            <description><![CDATA[System Administrators]]></description>
            <scope>system</scope>
            <gid>1999</gid>
            <member>0</member>
            <priv>page-all</priv>
        </group>
        <user>
            <name>admin</name>
            <descr><![CDATA[System Administrator]]></descr>
            <scope>system</scope>
            <groupname>admins</groupname>
            <bcrypt-hash>***************************</bcrypt-hash>
            <uid>0</uid>
            <priv>user-shell-access</priv>
        </user>
        <nextuid>2000</nextuid>
        <nextgid>2000</nextgid>>
        <disablenatreflection>yes</disablenatreflection>
        <disablesegmentationoffloading></disablesegmentationoffloading>
        <disablelargereceiveoffloading></disablelargereceiveoffloading>
        <ipv6allow></ipv6allow>
        <maximumtableentries>400000</maximumtableentries>
        <powerd_ac_mode>hadp</powerd_ac_mode>
        <powerd_battery_mode>hadp</powerd_battery_mode>
        <powerd_normal_mode>hadp</powerd_normal_mode>
        <bogons>
            <interval>monthly</interval>
        </bogons>
        <already_run_config_upgrade></already_run_config_upgrade>
        <timezone>Europe/Amsterdam</timezone>
        <language>en_US</language>
        <dnsserver>8.8.8.8</dnsserver>
        <dnsallowoverride></dnsallowoverride>
        <dns1gw>none</dns1gw>
    </system>
    <interfaces>
        <wan>
            <enable></enable>
            <if>igb0</if>
            <blockpriv></blockpriv>
            <blockbogons></blockbogons>
            <descr><![CDATA[WAN1]]></descr>
            <ipaddr>dhcp</ipaddr>
            <dhcphostname></dhcphostname>
            <alias-address></alias-address>
            <alias-subnet>32</alias-subnet>
            <dhcprejectfrom></dhcprejectfrom>
            <adv_dhcp_pt_timeout></adv_dhcp_pt_timeout>
            <adv_dhcp_pt_retry></adv_dhcp_pt_retry>
            <adv_dhcp_pt_select_timeout></adv_dhcp_pt_select_timeout>
            <adv_dhcp_pt_reboot></adv_dhcp_pt_reboot>
            <adv_dhcp_pt_backoff_cutoff></adv_dhcp_pt_backoff_cutoff>
            <adv_dhcp_pt_initial_interval></adv_dhcp_pt_initial_interval>
            <adv_dhcp_pt_values>SavedCfg</adv_dhcp_pt_values>
            <adv_dhcp_send_options></adv_dhcp_send_options>
            <adv_dhcp_request_options></adv_dhcp_request_options>
            <adv_dhcp_required_options></adv_dhcp_required_options>
            <adv_dhcp_option_modifiers></adv_dhcp_option_modifiers>
            <adv_dhcp_config_advanced></adv_dhcp_config_advanced>
            <adv_dhcp_config_file_override></adv_dhcp_config_file_override>
            <adv_dhcp_config_file_override_path></adv_dhcp_config_file_override_path>
            <ipaddrv6>dhcp6</ipaddrv6>
            <dhcp6-duid></dhcp6-duid>
            <dhcp6-ia-pd-len>0</dhcp6-ia-pd-len>
            <adv_dhcp6_prefix_selected_interface>wan</adv_dhcp6_prefix_selected_interface>
            <spoofmac></spoofmac>
        </wan>
        <lan>
            <enable></enable>
            <if>igb1</if>
            <descr><![CDATA[WAN2]]></descr>
            <spoofmac>c1:9b:43:75:5a:65</spoofmac>
            <ipaddr>dhcp</ipaddr>
            <dhcphostname></dhcphostname>
            <alias-address></alias-address>
            <alias-subnet>32</alias-subnet>
            <dhcprejectfrom></dhcprejectfrom>
            <adv_dhcp_pt_timeout></adv_dhcp_pt_timeout>
            <adv_dhcp_pt_retry></adv_dhcp_pt_retry>
            <adv_dhcp_pt_select_timeout></adv_dhcp_pt_select_timeout>
            <adv_dhcp_pt_reboot></adv_dhcp_pt_reboot>
            <adv_dhcp_pt_backoff_cutoff></adv_dhcp_pt_backoff_cutoff>
            <adv_dhcp_pt_initial_interval></adv_dhcp_pt_initial_interval>
            <adv_dhcp_pt_values>SavedCfg</adv_dhcp_pt_values>
            <adv_dhcp_send_options></adv_dhcp_send_options>
            <adv_dhcp_request_options></adv_dhcp_request_options>
            <adv_dhcp_required_options></adv_dhcp_required_options>
            <adv_dhcp_option_modifiers></adv_dhcp_option_modifiers>
            <adv_dhcp_config_advanced></adv_dhcp_config_advanced>
            <adv_dhcp_config_file_override></adv_dhcp_config_file_override>
            <adv_dhcp_config_file_override_path></adv_dhcp_config_file_override_path>
            <ipaddrv6>track6</ipaddrv6>
            <track6-interface>wan</track6-interface>
            <track6-prefix-id>0</track6-prefix-id>
        </lan>
        <opt1>
            <descr><![CDATA[LAN1]]></descr>
            <if>igb2</if>
            <enable></enable>
            <spoofmac></spoofmac>
        </opt1>
        <opt2>
            <descr><![CDATA[LAN2]]></descr>
            <if>igb3</if>
            <enable></enable>
            <ipaddr>192.168.200.1</ipaddr>
            <subnet>24</subnet>
            <spoofmac></spoofmac>
        </opt2>
        <opt3>
            <descr><![CDATA[axn_mgmt]]></descr>
            <if>igb2.5</if>
            <enable></enable>
            <spoofmac></spoofmac>
        </opt3>
        <opt4>
            <descr><![CDATA[axn_intra]]></descr>
            <if>igb2.10</if>
            <enable></enable>
            <ipaddr>10.128.10.1</ipaddr>
            <subnet>24</subnet>
            <spoofmac></spoofmac>
        </opt4>
    </interfaces>
    <staticroutes>
        <route>
            <network>192.168.104.0/24</network>
            <gateway>WAN2_DHCP</gateway>
            <descr><![CDATA[Zyxel compatibility rule]]></descr>
        </route>
    </staticroutes>
    <dhcpd>
        <lan>
            <range>
                <from>192.168.1.10</from>
                <to>192.168.1.245</to>
            </range>
            <dhcpleaseinlocaltime></dhcpleaseinlocaltime>
            <failover_peerip></failover_peerip>
            <defaultleasetime></defaultleasetime>
            <maxleasetime></maxleasetime>
            <netmask></netmask>
            <gateway></gateway>
            <domain></domain>
            <domainsearchlist></domainsearchlist>
            <ddnsdomain></ddnsdomain>
            <ddnsdomainprimary></ddnsdomainprimary>
            <ddnsdomainkeyname></ddnsdomainkeyname>
            <ddnsdomainkeyalgorithm>hmac-md5</ddnsdomainkeyalgorithm>
            <ddnsdomainkey></ddnsdomainkey>
            <mac_allow></mac_allow>
            <mac_deny></mac_deny>
            <ddnsclientupdates>allow</ddnsclientupdates>
            <tftp></tftp>
            <ldap></ldap>
            <nextserver></nextserver>
            <filename></filename>
            <filename32></filename32>
            <filename64></filename64>
            <rootpath></rootpath>
            <numberoptions></numberoptions>
        </lan>
        <opt2>
            <range>
                <from>192.168.200.30</from>
                <to>192.168.200.199</to>
            </range>
            <failover_peerip></failover_peerip>
            <defaultleasetime></defaultleasetime>
            <maxleasetime></maxleasetime>
            <netmask></netmask>
            <gateway></gateway>
            <domain></domain>
            <domainsearchlist></domainsearchlist>
            <ddnsdomain></ddnsdomain>
            <ddnsdomainprimary></ddnsdomainprimary>
            <ddnsdomainkeyname></ddnsdomainkeyname>
            <ddnsdomainkeyalgorithm>hmac-md5</ddnsdomainkeyalgorithm>
            <ddnsdomainkey></ddnsdomainkey>
            <mac_allow></mac_allow>
            <mac_deny></mac_deny>
            <ddnsclientupdates>allow</ddnsclientupdates>
            <tftp></tftp>
            <ldap></ldap>
            <nextserver></nextserver>
            <filename></filename>
            <filename32></filename32>
            <filename64></filename64>
            <rootpath></rootpath>
            <numberoptions></numberoptions>
            <enable></enable>
            <dhcpleaseinlocaltime></dhcpleaseinlocaltime>
        </opt2>
        <opt4>
            <range>
                <from>10.128.10.30</from>
                <to>10.128.10.199</to>
            </range>
            <enable></enable>
            <failover_peerip></failover_peerip>
            <defaultleasetime></defaultleasetime>
            <maxleasetime></maxleasetime>
            <netmask></netmask>
            <gateway></gateway>
            <domain></domain>
            <domainsearchlist></domainsearchlist>
            <ddnsdomain></ddnsdomain>
            <ddnsdomainprimary></ddnsdomainprimary>
            <ddnsdomainkeyname></ddnsdomainkeyname>
            <ddnsdomainkeyalgorithm>hmac-md5</ddnsdomainkeyalgorithm>
            <ddnsdomainkey></ddnsdomainkey>
            <mac_allow></mac_allow>
            <mac_deny></mac_deny>
            <ddnsclientupdates>allow</ddnsclientupdates>
            <tftp></tftp>
            <ldap></ldap>
            <nextserver></nextserver>
            <filename></filename>
            <filename32></filename32>
            <filename64></filename64>
            <rootpath></rootpath>
            <numberoptions></numberoptions>
            <dhcpleaseinlocaltime></dhcpleaseinlocaltime>
            <dnsserver>8.8.8.8</dnsserver>
        </opt4>
    </dhcpd>
    <dhcpdv6>
        <lan>
            <enable></enable>
            <range>
                <from>::1000</from>
                <to>::2000</to>
            </range>
            <ramode>assist</ramode>
            <rapriority>medium</rapriority>
        </lan>
    </dhcpdv6>
    <snmpd>
        <syslocation></syslocation>
        <syscontact></syscontact>
        <rocommunity>public</rocommunity>
    </snmpd>
    <diag>
        <ipv6nat>
            <ipaddr></ipaddr>
        </ipv6nat>
    </diag>
    <syslog>
        <filterdescriptions>1</filterdescriptions>
    </syslog>
    <nat>
        <outbound>
            <mode>automatic</mode>
        </outbound>
    </nat>
    <filter>
        <rule>
            <id></id>
            <tracker>1589535222</tracker>
            <type>pass</type>
            <interface>lan</interface>
            <ipprotocol>inet</ipprotocol>
            <tag></tag>
            <tagged></tagged>
            <max></max>
            <max-src-nodes></max-src-nodes>
            <max-src-conn></max-src-conn>
            <max-src-states></max-src-states>
            <statetimeout></statetimeout>
            <statetype><![CDATA[keep state]]></statetype>
            <os></os>
            <source>
                <any></any>
            </source>
            <destination>
                <any></any>
            </destination>
            <disabled></disabled>
            <descr><![CDATA[test rule]]></descr>
            <created>
                <time>1589535222</time>
                <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
            </created>
            <updated>
                <time>1589537043</time>
                <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
            </updated>
        </rule>
        <rule>
            <id></id>
            <tracker>1589534465</tracker>
            <type>pass</type>
            <interface>opt2</interface>
            <ipprotocol>inet</ipprotocol>
            <tag></tag>
            <tagged></tagged>
            <max></max>
            <max-src-nodes></max-src-nodes>
            <max-src-conn></max-src-conn>
            <max-src-states></max-src-states>
            <statetimeout></statetimeout>
            <statetype><![CDATA[keep state]]></statetype>
            <os></os>
            <source>
                <any></any>
            </source>
            <destination>
                <any></any>
            </destination>
            <descr></descr>
            <updated>
                <time>1589534465</time>
                <username><![CDATA[admin@192.168.1.100 (Local Database)]]></username>
            </updated>
            <created>
                <time>1589534465</time>
                <username><![CDATA[admin@192.168.1.100 (Local Database)]]></username>
            </created>
        </rule>
        <rule>
            <id></id>
            <tracker>1589536898</tracker>
            <type>pass</type>
            <interface>opt4</interface>
            <ipprotocol>inet</ipprotocol>
            <tag></tag>
            <tagged></tagged>
            <max></max>
            <max-src-nodes></max-src-nodes>
            <max-src-conn></max-src-conn>
            <max-src-states></max-src-states>
            <statetimeout></statetimeout>
            <statetype><![CDATA[keep state]]></statetype>
            <os></os>
            <protocol>icmp</protocol>
            <icmptype>any</icmptype>
            <source>
                <any></any>
            </source>
            <destination>
                <any></any>
            </destination>
            <descr><![CDATA[test rule]]></descr>
            <created>
                <time>1589536898</time>
                <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
            </created>
            <updated>
                <time>1589537026</time>
                <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
            </updated>
        </rule>
        <rule>
            <id></id>
            <tracker>1589535642</tracker>
            <type>pass</type>
            <interface>opt4</interface>
            <ipprotocol>inet</ipprotocol>
            <tag></tag>
            <tagged></tagged>
            <max></max>
            <max-src-nodes></max-src-nodes>
            <max-src-conn></max-src-conn>
            <max-src-states></max-src-states>
            <statetimeout></statetimeout>
            <statetype><![CDATA[keep state]]></statetype>
            <os></os>
            <source>
                <any></any>
            </source>
            <destination>
                <any></any>
            </destination>
            <descr><![CDATA[test rule]]></descr>
            <created>
                <time>1589535642</time>
                <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
            </created>
            <updated>
                <time>1589537018</time>
                <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
            </updated>
        </rule>
        <rule>
            <id></id>
            <tracker>1589535105</tracker>
            <type>pass</type>
            <interface>opt4</interface>
            <ipprotocol>inet</ipprotocol>
            <tag></tag>
            <tagged></tagged>
            <max></max>
            <max-src-nodes></max-src-nodes>
            <max-src-conn></max-src-conn>
            <max-src-states></max-src-states>
            <statetimeout></statetimeout>
            <statetype><![CDATA[keep state]]></statetype>
            <os></os>
            <source>
                <network>opt4</network>
            </source>
            <destination>
                <address>192.168.104.0/24</address>
            </destination>
            <descr><![CDATA[Zyxel compatibility rule]]></descr>
            <created>
                <time>1589535105</time>
                <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
            </created>
            <updated>
                <time>1589536984</time>
                <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
            </updated>
        </rule>
        <rule>
            <id></id>
            <tracker>1589535574</tracker>
            <type>pass</type>
            <interface>opt4</interface>
            <ipprotocol>inet</ipprotocol>
            <tag></tag>
            <tagged></tagged>
            <max></max>
            <max-src-nodes></max-src-nodes>
            <max-src-conn></max-src-conn>
            <max-src-states></max-src-states>
            <statetimeout></statetimeout>
            <statetype><![CDATA[keep state]]></statetype>
            <os></os>
            <source>
                <network>opt4</network>
            </source>
            <destination>
                <any></any>
            </destination>
            <descr><![CDATA[axn_mgmt to all rule]]></descr>
            <created>
                <time>1589535574</time>
                <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
            </created>
            <updated>
                <time>1589537000</time>
                <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
            </updated>
        </rule>
        <rule>
            <id></id>
            <tracker>1589534846</tracker>
            <type>pass</type>
            <interface>opt4</interface>
            <ipprotocol>inet</ipprotocol>
            <tag></tag>
            <tagged></tagged>
            <max></max>
            <max-src-nodes></max-src-nodes>
            <max-src-conn></max-src-conn>
            <max-src-states></max-src-states>
            <statetimeout></statetimeout>
            <statetype><![CDATA[keep state]]></statetype>
            <os></os>
            <source>
                <network>opt4</network>
            </source>
            <destination>
                <network>opt4ip</network>
            </destination>
            <descr><![CDATA[axn_intra to axn_intra]]></descr>
            <created>
                <time>1589534846</time>
                <username><![CDATA[admin@192.168.200.30 (Local Database)]]></username>
            </created>
            <updated>
                <time>1589536973</time>
                <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
            </updated>
        </rule>
        <separator>
            <opt2></opt2>
            <opt4></opt4>
            <lan></lan>
            <wan></wan>
        </separator>
    </filter>
    <shaper></shaper>
    <ipsec></ipsec>
    <aliases></aliases>
    <proxyarp></proxyarp>
    <cron>
        <item>
            <minute>1,31</minute>
            <hour>0-5</hour>
            <mday>*</mday>
            <month>*</month>
            <wday>*</wday>
            <who>root</who>
            <command>/usr/bin/nice -n20 adjkerntz -a</command>
        </item>
        <item>
            <minute>1</minute>
            <hour>3</hour>
            <mday>1</mday>
            <month>*</month>
            <wday>*</wday>
            <who>root</who>
            <command>/usr/bin/nice -n20 /etc/rc.update_bogons.sh</command>
        </item>
        <item>
            <minute>1</minute>
            <hour>1</hour>
            <mday>*</mday>
            <month>*</month>
            <wday>*</wday>
            <who>root</who>
            <command>/usr/bin/nice -n20 /etc/rc.dyndns.update</command>
        </item>
        <item>
            <minute>*/60</minute>
            <hour>*</hour>
            <mday>*</mday>
            <month>*</month>
            <wday>*</wday>
            <who>root</who>
            <command>/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 virusprot</command>
        </item>
        <item>
            <minute>30</minute>
            <hour>12</hour>
            <mday>*</mday>
            <month>*</month>
            <wday>*</wday>
            <who>root</who>
            <command>/usr/bin/nice -n20 /etc/rc.update_urltables</command>
        </item>
        <item>
            <minute>1</minute>
            <hour>0</hour>
            <mday>*</mday>
            <month>*</month>
            <wday>*</wday>
            <who>root</who>
            <command>/usr/bin/nice -n20 /etc/rc.update_pkg_metadata</command>
        </item>
    </cron>
    <wol></wol>
    <rrd>
        <enable></enable>
    </rrd>
    <load_balancer>
        <monitor_type>
            <name>ICMP</name>
            <type>icmp</type>
            <descr><![CDATA[ICMP]]></descr>
            <options></options>
        </monitor_type>
        <monitor_type>
            <name>TCP</name>
            <type>tcp</type>
            <descr><![CDATA[Generic TCP]]></descr>
            <options></options>
        </monitor_type>
        <monitor_type>
            <name>HTTP</name>
            <type>http</type>
            <descr><![CDATA[Generic HTTP]]></descr>
            <options>
                <path>/</path>
                <host></host>
                <code>200</code>
            </options>
        </monitor_type>
        <monitor_type>
            <name>HTTPS</name>
            <type>https</type>
            <descr><![CDATA[Generic HTTPS]]></descr>
            <options>
                <path>/</path>
                <host></host>
                <code>200</code>
            </options>
        </monitor_type>
        <monitor_type>
            <name>SMTP</name>
            <type>send</type>
            <descr><![CDATA[Generic SMTP]]></descr>
            <options>
                <send></send>
                <expect>220 *</expect>
            </options>
        </monitor_type>
    </load_balancer>
    <widgets>
        <sequence>system_information:col1:open:0,interfaces:col2:open:0,netgate_services_and_support:col2:open:0</sequence>
        <period>10</period>
    </widgets>
    <openvpn></openvpn>
    <dnshaper></dnshaper>
    <unbound>
        <enable></enable>
        <dnssec></dnssec>
        <active_interface></active_interface>
        <outgoing_interface></outgoing_interface>
        <custom_options></custom_options>
        <hideidentity></hideidentity>
        <hideversion></hideversion>
        <dnssecstripped></dnssecstripped>
    </unbound>
    <revision>
        <time>1589537382</time>
        <description><![CDATA[admin@10.128.10.30 (Local Database): Firewall: Rules - deleted a firewall rule.]]></description>
        <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
    </revision>
    <cert>
        <refid>5ebe5df4744c4</refid>
        <descr><![CDATA[webConfigurator default (5ebe5df4744c4)]]></descr>
        <type>server</type>
        <crt>********************==</crt>
        <prv>********************==</prv>
    </cert>
    <ppps></ppps>
    <gateways>
        <defaultgw4>WAN1_DHCP</defaultgw4>
        <defaultgw6></defaultgw6>
    </gateways>
    <vlans>
        <vlan>
            <if>igb2</if>
            <tag>5</tag>
            <pcp></pcp>
            <descr><![CDATA[axn_mgmt]]></descr>
            <vlanif>igb2.5</vlanif>
        </vlan>
        <vlan>
            <if>igb2</if>
            <tag>10</tag>
            <pcp></pcp>
            <descr><![CDATA[axn_intra]]></descr>
            <vlanif>igb2.10</vlanif>
        </vlan>
    </vlans>
</pfsense>


UPDATE 2

The diagram bellow should help to understand my situation. enter image description here

  • tracert is a thing... – Zac67 May 14 at 11:35
  • When i tracert 192.168.104.1 from my desktop (connected to 10.128.10.x) i cannot come further than 1 step 10.128.10.1 --- When i tracert 10.128.10.1 from my desktop (when connected to 192.168.104.x) i cannot come further than 1 step 192.168.104.1 --- in both cases i expected 2 steps? – CodeNinja May 14 at 11:39
  • pfsense will log dropped packets. Look there first. – Ron Trunk May 14 at 12:06
  • The only relevant things i can find is: 14:55:34.888604 IP 192.168.104.4 > 192.168.104.1: ICMP echo request, id 9474, seq 15844, length 8 -- 14:55:34.889239 IP 192.168.104.1 > 192.168.104.4: ICMP echo reply, id 9474, seq 15844, length 8 – CodeNinja May 14 at 13:06
  • 1
    Please include the text version of your configuration. Simply list it out and paste it into the question using the Preformatted-text feaute ({}). You should obfuscate any passwords and public addresses. – Ron Maupin May 14 at 13:57
0

All IP Sub-nets connected with a specific Interface should be able able to reach there Next-Hop or Firewall Interface or Gateway First.

Can you confirm whether while connecting your system in New Series, you are able to reach your next hop IP that is the IP Of Firewall Interface in this case ?

| improve this answer | |
  • @K K Satapathy I updated my question so you can see what i can ping and what not. --- I can only hop 1 step. Means from pc1 to its gateway, from pc2 to its gateway, from Pfsense to Zyxel --- cannot ping directly from pc2 to Zyxel – CodeNinja May 15 at 7:47
0

Configuration Looks fine as per Diagram shared. However you can check whether you have enabled nating in Firewall Routes for the Local Policy. If so disable Nating in the Firewall Policy.

Check Firewall Setting in your Computer & Turn it Off.

You May Try with Specific Policies containing Source & Destination IP Series .

| improve this answer | |
  • I have no NAT rules configured at Pfsense except for the outbound rules. (see my config export added to the question) -- At the Zyxel i did not change any NAT rules after i started with this implementation. There are no "automatic" NAT rules active there.-- temp disable all NAT rules at Pfsense does also not work, i can't do this on the Zyxel as this network is operational. – CodeNinja May 15 at 8:15
  • I already had my local (computer) firewall disabled which didn't help. Hope you have any other suggestions i can try? -- i started configuring pfsense from scratch to be sure i didn't mess up a setting accidentally. -- a complete most recent config can be found in my question – CodeNinja May 15 at 10:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.