0

I have 2 networks, the current one and the new one. The current one is not configured by me and one big mess and contains heavily out dated hardware (especially servers). I want to be able to access the complete current network from the new one so i can migrate server for server and device for device.

Some network details:

  • Current network:
    • IP: 192.168.1.1
    • IP range: 192.168.104.0/24
    • Router/firewall: Zyxel USG200
    • Contain all devices
    • Gives DHCP address to Pfsense (192.168.104.4/24)
  • New network:
    • IP: 10.128.10.1
    • IP range: 10.128.10.0/24.
    • Router/firewall: Pfsense
    • Currently it contains only 1 device, my desktop but this network will replace the current one in future
    • All devices will be "moved" from the old to the new network by time (one for one)
    • Connected with old network by port with alias "WAN 2"

I added a route in each firewall to the other network.

  • Zyxel: 10.128.10.0/24 via 192.168.104.4
  • Pfsense: 192.168.104.0/24 via "WAN2"

I also added a firewall rule to each firewall to allow all traffic from all sources to all destinations (for testing)

When i ping 192.168.104.1 with pfsense diagnostics, i got a response. I cannot find a way to do a ping from the Zyxel to Pfsense but as the route bellow is in the routing table i assume the (at least) routing configuration must be okay.

When i try to ping 192.168.104.1 (or any other device in the 104.x network) from my desktop in the 10.128.10.x network, i got a "request timed out" response. I also cannot SSH or browse to any IP in the 104.x network.

When i connect my desktop to the 104.x network and try to ping 10.128.10.1 or try to visit that IP in my browser (Pfsense web interface) i got "request timed out"

A print screen of my firewall rule on Pfsense (on the desktop interface): enter image description here

And one from my firewall rule in the Zyxel: enter image description here

Probably i miss some configuration/settings but i have no idea what. Would be great when someone can help me out with this as i'm already struggling almost 2 days with this. When extra details are required, let me know and i will update my question.


UPDATE

My config. I also obfuscated certs and private keys.

<?xml version="1.0"?>
<pfsense>
    <version>19.1</version>
    <lastchange></lastchange>
    <system>
        <optimization>normal</optimization>
        <hostname>axx-psen-wal01</hostname>
        <domain>localdomain</domain>
        <group>
            <name>all</name>
            <description><![CDATA[All Users]]></description>
            <scope>system</scope>
            <gid>1998</gid>
            <member>0</member>
        </group>
        <group>
            <name>admins</name>
            <description><![CDATA[System Administrators]]></description>
            <scope>system</scope>
            <gid>1999</gid>
            <member>0</member>
            <priv>page-all</priv>
        </group>
        <user>
            <name>admin</name>
            <descr><![CDATA[System Administrator]]></descr>
            <scope>system</scope>
            <groupname>admins</groupname>
            <bcrypt-hash>***************************</bcrypt-hash>
            <uid>0</uid>
            <priv>user-shell-access</priv>
        </user>
        <nextuid>2000</nextuid>
        <nextgid>2000</nextgid>>
        <disablenatreflection>yes</disablenatreflection>
        <disablesegmentationoffloading></disablesegmentationoffloading>
        <disablelargereceiveoffloading></disablelargereceiveoffloading>
        <ipv6allow></ipv6allow>
        <maximumtableentries>400000</maximumtableentries>
        <powerd_ac_mode>hadp</powerd_ac_mode>
        <powerd_battery_mode>hadp</powerd_battery_mode>
        <powerd_normal_mode>hadp</powerd_normal_mode>
        <bogons>
            <interval>monthly</interval>
        </bogons>
        <already_run_config_upgrade></already_run_config_upgrade>
        <timezone>Europe/Amsterdam</timezone>
        <language>en_US</language>
        <dnsserver>8.8.8.8</dnsserver>
        <dnsallowoverride></dnsallowoverride>
        <dns1gw>none</dns1gw>
    </system>
    <interfaces>
        <wan>
            <enable></enable>
            <if>igb0</if>
            <blockpriv></blockpriv>
            <blockbogons></blockbogons>
            <descr><![CDATA[WAN1]]></descr>
            <ipaddr>dhcp</ipaddr>
            <dhcphostname></dhcphostname>
            <alias-address></alias-address>
            <alias-subnet>32</alias-subnet>
            <dhcprejectfrom></dhcprejectfrom>
            <adv_dhcp_pt_timeout></adv_dhcp_pt_timeout>
            <adv_dhcp_pt_retry></adv_dhcp_pt_retry>
            <adv_dhcp_pt_select_timeout></adv_dhcp_pt_select_timeout>
            <adv_dhcp_pt_reboot></adv_dhcp_pt_reboot>
            <adv_dhcp_pt_backoff_cutoff></adv_dhcp_pt_backoff_cutoff>
            <adv_dhcp_pt_initial_interval></adv_dhcp_pt_initial_interval>
            <adv_dhcp_pt_values>SavedCfg</adv_dhcp_pt_values>
            <adv_dhcp_send_options></adv_dhcp_send_options>
            <adv_dhcp_request_options></adv_dhcp_request_options>
            <adv_dhcp_required_options></adv_dhcp_required_options>
            <adv_dhcp_option_modifiers></adv_dhcp_option_modifiers>
            <adv_dhcp_config_advanced></adv_dhcp_config_advanced>
            <adv_dhcp_config_file_override></adv_dhcp_config_file_override>
            <adv_dhcp_config_file_override_path></adv_dhcp_config_file_override_path>
            <ipaddrv6>dhcp6</ipaddrv6>
            <dhcp6-duid></dhcp6-duid>
            <dhcp6-ia-pd-len>0</dhcp6-ia-pd-len>
            <adv_dhcp6_prefix_selected_interface>wan</adv_dhcp6_prefix_selected_interface>
            <spoofmac></spoofmac>
        </wan>
        <lan>
            <enable></enable>
            <if>igb1</if>
            <descr><![CDATA[WAN2]]></descr>
            <spoofmac>c1:9b:43:75:5a:65</spoofmac>
            <ipaddr>dhcp</ipaddr>
            <dhcphostname></dhcphostname>
            <alias-address></alias-address>
            <alias-subnet>32</alias-subnet>
            <dhcprejectfrom></dhcprejectfrom>
            <adv_dhcp_pt_timeout></adv_dhcp_pt_timeout>
            <adv_dhcp_pt_retry></adv_dhcp_pt_retry>
            <adv_dhcp_pt_select_timeout></adv_dhcp_pt_select_timeout>
            <adv_dhcp_pt_reboot></adv_dhcp_pt_reboot>
            <adv_dhcp_pt_backoff_cutoff></adv_dhcp_pt_backoff_cutoff>
            <adv_dhcp_pt_initial_interval></adv_dhcp_pt_initial_interval>
            <adv_dhcp_pt_values>SavedCfg</adv_dhcp_pt_values>
            <adv_dhcp_send_options></adv_dhcp_send_options>
            <adv_dhcp_request_options></adv_dhcp_request_options>
            <adv_dhcp_required_options></adv_dhcp_required_options>
            <adv_dhcp_option_modifiers></adv_dhcp_option_modifiers>
            <adv_dhcp_config_advanced></adv_dhcp_config_advanced>
            <adv_dhcp_config_file_override></adv_dhcp_config_file_override>
            <adv_dhcp_config_file_override_path></adv_dhcp_config_file_override_path>
            <ipaddrv6>track6</ipaddrv6>
            <track6-interface>wan</track6-interface>
            <track6-prefix-id>0</track6-prefix-id>
        </lan>
        <opt1>
            <descr><![CDATA[LAN1]]></descr>
            <if>igb2</if>
            <enable></enable>
            <spoofmac></spoofmac>
        </opt1>
        <opt2>
            <descr><![CDATA[LAN2]]></descr>
            <if>igb3</if>
            <enable></enable>
            <ipaddr>192.168.200.1</ipaddr>
            <subnet>24</subnet>
            <spoofmac></spoofmac>
        </opt2>
        <opt3>
            <descr><![CDATA[axn_mgmt]]></descr>
            <if>igb2.5</if>
            <enable></enable>
            <spoofmac></spoofmac>
        </opt3>
        <opt4>
            <descr><![CDATA[axn_intra]]></descr>
            <if>igb2.10</if>
            <enable></enable>
            <ipaddr>10.128.10.1</ipaddr>
            <subnet>24</subnet>
            <spoofmac></spoofmac>
        </opt4>
    </interfaces>
    <staticroutes>
        <route>
            <network>192.168.104.0/24</network>
            <gateway>WAN2_DHCP</gateway>
            <descr><![CDATA[Zyxel compatibility rule]]></descr>
        </route>
    </staticroutes>
    <dhcpd>
        <lan>
            <range>
                <from>192.168.1.10</from>
                <to>192.168.1.245</to>
            </range>
            <dhcpleaseinlocaltime></dhcpleaseinlocaltime>
            <failover_peerip></failover_peerip>
            <defaultleasetime></defaultleasetime>
            <maxleasetime></maxleasetime>
            <netmask></netmask>
            <gateway></gateway>
            <domain></domain>
            <domainsearchlist></domainsearchlist>
            <ddnsdomain></ddnsdomain>
            <ddnsdomainprimary></ddnsdomainprimary>
            <ddnsdomainkeyname></ddnsdomainkeyname>
            <ddnsdomainkeyalgorithm>hmac-md5</ddnsdomainkeyalgorithm>
            <ddnsdomainkey></ddnsdomainkey>
            <mac_allow></mac_allow>
            <mac_deny></mac_deny>
            <ddnsclientupdates>allow</ddnsclientupdates>
            <tftp></tftp>
            <ldap></ldap>
            <nextserver></nextserver>
            <filename></filename>
            <filename32></filename32>
            <filename64></filename64>
            <rootpath></rootpath>
            <numberoptions></numberoptions>
        </lan>
        <opt2>
            <range>
                <from>192.168.200.30</from>
                <to>192.168.200.199</to>
            </range>
            <failover_peerip></failover_peerip>
            <defaultleasetime></defaultleasetime>
            <maxleasetime></maxleasetime>
            <netmask></netmask>
            <gateway></gateway>
            <domain></domain>
            <domainsearchlist></domainsearchlist>
            <ddnsdomain></ddnsdomain>
            <ddnsdomainprimary></ddnsdomainprimary>
            <ddnsdomainkeyname></ddnsdomainkeyname>
            <ddnsdomainkeyalgorithm>hmac-md5</ddnsdomainkeyalgorithm>
            <ddnsdomainkey></ddnsdomainkey>
            <mac_allow></mac_allow>
            <mac_deny></mac_deny>
            <ddnsclientupdates>allow</ddnsclientupdates>
            <tftp></tftp>
            <ldap></ldap>
            <nextserver></nextserver>
            <filename></filename>
            <filename32></filename32>
            <filename64></filename64>
            <rootpath></rootpath>
            <numberoptions></numberoptions>
            <enable></enable>
            <dhcpleaseinlocaltime></dhcpleaseinlocaltime>
        </opt2>
        <opt4>
            <range>
                <from>10.128.10.30</from>
                <to>10.128.10.199</to>
            </range>
            <enable></enable>
            <failover_peerip></failover_peerip>
            <defaultleasetime></defaultleasetime>
            <maxleasetime></maxleasetime>
            <netmask></netmask>
            <gateway></gateway>
            <domain></domain>
            <domainsearchlist></domainsearchlist>
            <ddnsdomain></ddnsdomain>
            <ddnsdomainprimary></ddnsdomainprimary>
            <ddnsdomainkeyname></ddnsdomainkeyname>
            <ddnsdomainkeyalgorithm>hmac-md5</ddnsdomainkeyalgorithm>
            <ddnsdomainkey></ddnsdomainkey>
            <mac_allow></mac_allow>
            <mac_deny></mac_deny>
            <ddnsclientupdates>allow</ddnsclientupdates>
            <tftp></tftp>
            <ldap></ldap>
            <nextserver></nextserver>
            <filename></filename>
            <filename32></filename32>
            <filename64></filename64>
            <rootpath></rootpath>
            <numberoptions></numberoptions>
            <dhcpleaseinlocaltime></dhcpleaseinlocaltime>
            <dnsserver>8.8.8.8</dnsserver>
        </opt4>
    </dhcpd>
    <dhcpdv6>
        <lan>
            <enable></enable>
            <range>
                <from>::1000</from>
                <to>::2000</to>
            </range>
            <ramode>assist</ramode>
            <rapriority>medium</rapriority>
        </lan>
    </dhcpdv6>
    <snmpd>
        <syslocation></syslocation>
        <syscontact></syscontact>
        <rocommunity>public</rocommunity>
    </snmpd>
    <diag>
        <ipv6nat>
            <ipaddr></ipaddr>
        </ipv6nat>
    </diag>
    <syslog>
        <filterdescriptions>1</filterdescriptions>
    </syslog>
    <nat>
        <outbound>
            <mode>automatic</mode>
        </outbound>
    </nat>
    <filter>
        <rule>
            <id></id>
            <tracker>1589535222</tracker>
            <type>pass</type>
            <interface>lan</interface>
            <ipprotocol>inet</ipprotocol>
            <tag></tag>
            <tagged></tagged>
            <max></max>
            <max-src-nodes></max-src-nodes>
            <max-src-conn></max-src-conn>
            <max-src-states></max-src-states>
            <statetimeout></statetimeout>
            <statetype><![CDATA[keep state]]></statetype>
            <os></os>
            <source>
                <any></any>
            </source>
            <destination>
                <any></any>
            </destination>
            <disabled></disabled>
            <descr><![CDATA[test rule]]></descr>
            <created>
                <time>1589535222</time>
                <username><![CDATA[[email protected] (Local Database)]]></username>
            </created>
            <updated>
                <time>1589537043</time>
                <username><![CDATA[[email protected] (Local Database)]]></username>
            </updated>
        </rule>
        <rule>
            <id></id>
            <tracker>1589534465</tracker>
            <type>pass</type>
            <interface>opt2</interface>
            <ipprotocol>inet</ipprotocol>
            <tag></tag>
            <tagged></tagged>
            <max></max>
            <max-src-nodes></max-src-nodes>
            <max-src-conn></max-src-conn>
            <max-src-states></max-src-states>
            <statetimeout></statetimeout>
            <statetype><![CDATA[keep state]]></statetype>
            <os></os>
            <source>
                <any></any>
            </source>
            <destination>
                <any></any>
            </destination>
            <descr></descr>
            <updated>
                <time>1589534465</time>
                <username><![CDATA[[email protected] (Local Database)]]></username>
            </updated>
            <created>
                <time>1589534465</time>
                <username><![CDATA[[email protected] (Local Database)]]></username>
            </created>
        </rule>
        <rule>
            <id></id>
            <tracker>1589536898</tracker>
            <type>pass</type>
            <interface>opt4</interface>
            <ipprotocol>inet</ipprotocol>
            <tag></tag>
            <tagged></tagged>
            <max></max>
            <max-src-nodes></max-src-nodes>
            <max-src-conn></max-src-conn>
            <max-src-states></max-src-states>
            <statetimeout></statetimeout>
            <statetype><![CDATA[keep state]]></statetype>
            <os></os>
            <protocol>icmp</protocol>
            <icmptype>any</icmptype>
            <source>
                <any></any>
            </source>
            <destination>
                <any></any>
            </destination>
            <descr><![CDATA[test rule]]></descr>
            <created>
                <time>1589536898</time>
                <username><![CDATA[[email protected] (Local Database)]]></username>
            </created>
            <updated>
                <time>1589537026</time>
                <username><![CDATA[[email protected] (Local Database)]]></username>
            </updated>
        </rule>
        <rule>
            <id></id>
            <tracker>1589535642</tracker>
            <type>pass</type>
            <interface>opt4</interface>
            <ipprotocol>inet</ipprotocol>
            <tag></tag>
            <tagged></tagged>
            <max></max>
            <max-src-nodes></max-src-nodes>
            <max-src-conn></max-src-conn>
            <max-src-states></max-src-states>
            <statetimeout></statetimeout>
            <statetype><![CDATA[keep state]]></statetype>
            <os></os>
            <source>
                <any></any>
            </source>
            <destination>
                <any></any>
            </destination>
            <descr><![CDATA[test rule]]></descr>
            <created>
                <time>1589535642</time>
                <username><![CDATA[[email protected] (Local Database)]]></username>
            </created>
            <updated>
                <time>1589537018</time>
                <username><![CDATA[[email protected] (Local Database)]]></username>
            </updated>
        </rule>
        <rule>
            <id></id>
            <tracker>1589535105</tracker>
            <type>pass</type>
            <interface>opt4</interface>
            <ipprotocol>inet</ipprotocol>
            <tag></tag>
            <tagged></tagged>
            <max></max>
            <max-src-nodes></max-src-nodes>
            <max-src-conn></max-src-conn>
            <max-src-states></max-src-states>
            <statetimeout></statetimeout>
            <statetype><![CDATA[keep state]]></statetype>
            <os></os>
            <source>
                <network>opt4</network>
            </source>
            <destination>
                <address>192.168.104.0/24</address>
            </destination>
            <descr><![CDATA[Zyxel compatibility rule]]></descr>
            <created>
                <time>1589535105</time>
                <username><![CDATA[[email protected] (Local Database)]]></username>
            </created>
            <updated>
                <time>1589536984</time>
                <username><![CDATA[[email protected] (Local Database)]]></username>
            </updated>
        </rule>
        <rule>
            <id></id>
            <tracker>1589535574</tracker>
            <type>pass</type>
            <interface>opt4</interface>
            <ipprotocol>inet</ipprotocol>
            <tag></tag>
            <tagged></tagged>
            <max></max>
            <max-src-nodes></max-src-nodes>
            <max-src-conn></max-src-conn>
            <max-src-states></max-src-states>
            <statetimeout></statetimeout>
            <statetype><![CDATA[keep state]]></statetype>
            <os></os>
            <source>
                <network>opt4</network>
            </source>
            <destination>
                <any></any>
            </destination>
            <descr><![CDATA[axn_mgmt to all rule]]></descr>
            <created>
                <time>1589535574</time>
                <username><![CDATA[[email protected] (Local Database)]]></username>
            </created>
            <updated>
                <time>1589537000</time>
                <username><![CDATA[[email protected] (Local Database)]]></username>
            </updated>
        </rule>
        <rule>
            <id></id>
            <tracker>1589534846</tracker>
            <type>pass</type>
            <interface>opt4</interface>
            <ipprotocol>inet</ipprotocol>
            <tag></tag>
            <tagged></tagged>
            <max></max>
            <max-src-nodes></max-src-nodes>
            <max-src-conn></max-src-conn>
            <max-src-states></max-src-states>
            <statetimeout></statetimeout>
            <statetype><![CDATA[keep state]]></statetype>
            <os></os>
            <source>
                <network>opt4</network>
            </source>
            <destination>
                <network>opt4ip</network>
            </destination>
            <descr><![CDATA[axn_intra to axn_intra]]></descr>
            <created>
                <time>1589534846</time>
                <username><![CDATA[[email protected] (Local Database)]]></username>
            </created>
            <updated>
                <time>1589536973</time>
                <username><![CDATA[[email protected] (Local Database)]]></username>
            </updated>
        </rule>
        <separator>
            <opt2></opt2>
            <opt4></opt4>
            <lan></lan>
            <wan></wan>
        </separator>
    </filter>
    <shaper></shaper>
    <ipsec></ipsec>
    <aliases></aliases>
    <proxyarp></proxyarp>
    <cron>
        <item>
            <minute>1,31</minute>
            <hour>0-5</hour>
            <mday>*</mday>
            <month>*</month>
            <wday>*</wday>
            <who>root</who>
            <command>/usr/bin/nice -n20 adjkerntz -a</command>
        </item>
        <item>
            <minute>1</minute>
            <hour>3</hour>
            <mday>1</mday>
            <month>*</month>
            <wday>*</wday>
            <who>root</who>
            <command>/usr/bin/nice -n20 /etc/rc.update_bogons.sh</command>
        </item>
        <item>
            <minute>1</minute>
            <hour>1</hour>
            <mday>*</mday>
            <month>*</month>
            <wday>*</wday>
            <who>root</who>
            <command>/usr/bin/nice -n20 /etc/rc.dyndns.update</command>
        </item>
        <item>
            <minute>*/60</minute>
            <hour>*</hour>
            <mday>*</mday>
            <month>*</month>
            <wday>*</wday>
            <who>root</who>
            <command>/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 virusprot</command>
        </item>
        <item>
            <minute>30</minute>
            <hour>12</hour>
            <mday>*</mday>
            <month>*</month>
            <wday>*</wday>
            <who>root</who>
            <command>/usr/bin/nice -n20 /etc/rc.update_urltables</command>
        </item>
        <item>
            <minute>1</minute>
            <hour>0</hour>
            <mday>*</mday>
            <month>*</month>
            <wday>*</wday>
            <who>root</who>
            <command>/usr/bin/nice -n20 /etc/rc.update_pkg_metadata</command>
        </item>
    </cron>
    <wol></wol>
    <rrd>
        <enable></enable>
    </rrd>
    <load_balancer>
        <monitor_type>
            <name>ICMP</name>
            <type>icmp</type>
            <descr><![CDATA[ICMP]]></descr>
            <options></options>
        </monitor_type>
        <monitor_type>
            <name>TCP</name>
            <type>tcp</type>
            <descr><![CDATA[Generic TCP]]></descr>
            <options></options>
        </monitor_type>
        <monitor_type>
            <name>HTTP</name>
            <type>http</type>
            <descr><![CDATA[Generic HTTP]]></descr>
            <options>
                <path>/</path>
                <host></host>
                <code>200</code>
            </options>
        </monitor_type>
        <monitor_type>
            <name>HTTPS</name>
            <type>https</type>
            <descr><![CDATA[Generic HTTPS]]></descr>
            <options>
                <path>/</path>
                <host></host>
                <code>200</code>
            </options>
        </monitor_type>
        <monitor_type>
            <name>SMTP</name>
            <type>send</type>
            <descr><![CDATA[Generic SMTP]]></descr>
            <options>
                <send></send>
                <expect>220 *</expect>
            </options>
        </monitor_type>
    </load_balancer>
    <widgets>
        <sequence>system_information:col1:open:0,interfaces:col2:open:0,netgate_services_and_support:col2:open:0</sequence>
        <period>10</period>
    </widgets>
    <openvpn></openvpn>
    <dnshaper></dnshaper>
    <unbound>
        <enable></enable>
        <dnssec></dnssec>
        <active_interface></active_interface>
        <outgoing_interface></outgoing_interface>
        <custom_options></custom_options>
        <hideidentity></hideidentity>
        <hideversion></hideversion>
        <dnssecstripped></dnssecstripped>
    </unbound>
    <revision>
        <time>1589537382</time>
        <description><![CDATA[[email protected] (Local Database): Firewall: Rules - deleted a firewall rule.]]></description>
        <username><![CDATA[[email protected] (Local Database)]]></username>
    </revision>
    <cert>
        <refid>5ebe5df4744c4</refid>
        <descr><![CDATA[webConfigurator default (5ebe5df4744c4)]]></descr>
        <type>server</type>
        <crt>********************==</crt>
        <prv>********************==</prv>
    </cert>
    <ppps></ppps>
    <gateways>
        <defaultgw4>WAN1_DHCP</defaultgw4>
        <defaultgw6></defaultgw6>
    </gateways>
    <vlans>
        <vlan>
            <if>igb2</if>
            <tag>5</tag>
            <pcp></pcp>
            <descr><![CDATA[axn_mgmt]]></descr>
            <vlanif>igb2.5</vlanif>
        </vlan>
        <vlan>
            <if>igb2</if>
            <tag>10</tag>
            <pcp></pcp>
            <descr><![CDATA[axn_intra]]></descr>
            <vlanif>igb2.10</vlanif>
        </vlan>
    </vlans>
</pfsense>


UPDATE 2

The diagram bellow should help to understand my situation. enter image description here

9
  • tracert is a thing...
    – Zac67
    May 14, 2020 at 11:35
  • When i tracert 192.168.104.1 from my desktop (connected to 10.128.10.x) i cannot come further than 1 step 10.128.10.1 --- When i tracert 10.128.10.1 from my desktop (when connected to 192.168.104.x) i cannot come further than 1 step 192.168.104.1 --- in both cases i expected 2 steps?
    – CodeNinja
    May 14, 2020 at 11:39
  • pfsense will log dropped packets. Look there first.
    – Ron Trunk
    May 14, 2020 at 12:06
  • The only relevant things i can find is: 14:55:34.888604 IP 192.168.104.4 > 192.168.104.1: ICMP echo request, id 9474, seq 15844, length 8 -- 14:55:34.889239 IP 192.168.104.1 > 192.168.104.4: ICMP echo reply, id 9474, seq 15844, length 8
    – CodeNinja
    May 14, 2020 at 13:06
  • 1
    Please include the text version of your configuration. Simply list it out and paste it into the question using the Preformatted-text feaute ({}). You should obfuscate any passwords and public addresses.
    – Ron Maupin
    May 14, 2020 at 13:57

4 Answers 4

1

Your config has <blockpriv/> which (I believe) will NOT allow requests OUT to 192.168.104.0 via WAN... and will NOT allow requests IN to 10.128.10.0.

I would also check for a similar setting in the other router... as ALL brands (in theory) BLOCK local addresses on WAN by default.

Otherwise, a nefarious party could externally advertise 192.168.0.1 as being on their network... some sloppy AT&T routers somewhere would likely pick that up and suddenly the hacker is getting inbound traffic from unsuspecting hard-coded ioT devices etc.

1

As we where not able to solve the issue, we decided to do a "big bang". We connected all devices from the old network one by one to the new network as we could not get it done to run both (the old and the new) networks parallel.

This made the transition not as smooth as we hoped we could do but we saw no other option.

1
  • Please accept your answer so that the question does not keep popping up forever, looking for an answer.
    – Ron Maupin
    Nov 24, 2022 at 14:25
0

All IP Sub-nets connected with a specific Interface should be able able to reach there Next-Hop or Firewall Interface or Gateway First.

Can you confirm whether while connecting your system in New Series, you are able to reach your next hop IP that is the IP Of Firewall Interface in this case ?

1
  • @K K Satapathy I updated my question so you can see what i can ping and what not. --- I can only hop 1 step. Means from pc1 to its gateway, from pc2 to its gateway, from Pfsense to Zyxel --- cannot ping directly from pc2 to Zyxel
    – CodeNinja
    May 15, 2020 at 7:47
0

Configuration Looks fine as per Diagram shared. However you can check whether you have enabled nating in Firewall Routes for the Local Policy. If so disable Nating in the Firewall Policy.

Check Firewall Setting in your Computer & Turn it Off.

You May Try with Specific Policies containing Source & Destination IP Series .

2
  • I have no NAT rules configured at Pfsense except for the outbound rules. (see my config export added to the question) -- At the Zyxel i did not change any NAT rules after i started with this implementation. There are no "automatic" NAT rules active there.-- temp disable all NAT rules at Pfsense does also not work, i can't do this on the Zyxel as this network is operational.
    – CodeNinja
    May 15, 2020 at 8:15
  • I already had my local (computer) firewall disabled which didn't help. Hope you have any other suggestions i can try? -- i started configuring pfsense from scratch to be sure i didn't mess up a setting accidentally. -- a complete most recent config can be found in my question
    – CodeNinja
    May 15, 2020 at 10:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.