I have 2 networks, the current one and the new one. The current one is not configured by me and one big mess and contains heavily out dated hardware (especially servers). I want to be able to access the complete current network from the new one so i can migrate server for server and device for device.
Some network details:
- Current network:
- IP:
192.168.1.1
- IP range:
192.168.104.0/24
- Router/firewall: Zyxel USG200
- Contain all devices
- Gives DHCP address to Pfsense (
192.168.104.4/24
)
- IP:
- New network:
- IP:
10.128.10.1
- IP range:
10.128.10.0/24
. - Router/firewall: Pfsense
- Currently it contains only 1 device, my desktop but this network will replace the current one in future
- All devices will be "moved" from the old to the new network by time (one for one)
- Connected with old network by port with alias
"WAN 2"
- IP:
I added a route in each firewall to the other network.
- Zyxel:
10.128.10.0/24
via192.168.104.4
- Pfsense:
192.168.104.0/24
via"WAN2"
I also added a firewall rule to each firewall to allow all traffic
from all sources
to all destinations
(for testing)
When i ping 192.168.104.1
with pfsense diagnostics, i got a response. I cannot find a way to do a ping from the Zyxel to Pfsense but as the route bellow is in the routing table i assume the (at least) routing configuration must be okay.
When i try to ping 192.168.104.1
(or any other device in the 104.x
network) from my desktop in the 10.128.10.x
network, i got a "request timed out" response. I also cannot SSH or browse to any IP in the 104.x
network.
When i connect my desktop to the 104.x
network and try to ping 10.128.10.1
or try to visit that IP in my browser (Pfsense web interface) i got "request timed out"
A print screen of my firewall rule on Pfsense (on the desktop interface):
And one from my firewall rule in the Zyxel:
Probably i miss some configuration/settings but i have no idea what. Would be great when someone can help me out with this as i'm already struggling almost 2 days with this. When extra details are required, let me know and i will update my question.
UPDATE
My config. I also obfuscated certs and private keys.
<?xml version="1.0"?>
<pfsense>
<version>19.1</version>
<lastchange></lastchange>
<system>
<optimization>normal</optimization>
<hostname>axx-psen-wal01</hostname>
<domain>localdomain</domain>
<group>
<name>all</name>
<description><![CDATA[All Users]]></description>
<scope>system</scope>
<gid>1998</gid>
<member>0</member>
</group>
<group>
<name>admins</name>
<description><![CDATA[System Administrators]]></description>
<scope>system</scope>
<gid>1999</gid>
<member>0</member>
<priv>page-all</priv>
</group>
<user>
<name>admin</name>
<descr><![CDATA[System Administrator]]></descr>
<scope>system</scope>
<groupname>admins</groupname>
<bcrypt-hash>***************************</bcrypt-hash>
<uid>0</uid>
<priv>user-shell-access</priv>
</user>
<nextuid>2000</nextuid>
<nextgid>2000</nextgid>>
<disablenatreflection>yes</disablenatreflection>
<disablesegmentationoffloading></disablesegmentationoffloading>
<disablelargereceiveoffloading></disablelargereceiveoffloading>
<ipv6allow></ipv6allow>
<maximumtableentries>400000</maximumtableentries>
<powerd_ac_mode>hadp</powerd_ac_mode>
<powerd_battery_mode>hadp</powerd_battery_mode>
<powerd_normal_mode>hadp</powerd_normal_mode>
<bogons>
<interval>monthly</interval>
</bogons>
<already_run_config_upgrade></already_run_config_upgrade>
<timezone>Europe/Amsterdam</timezone>
<language>en_US</language>
<dnsserver>8.8.8.8</dnsserver>
<dnsallowoverride></dnsallowoverride>
<dns1gw>none</dns1gw>
</system>
<interfaces>
<wan>
<enable></enable>
<if>igb0</if>
<blockpriv></blockpriv>
<blockbogons></blockbogons>
<descr><![CDATA[WAN1]]></descr>
<ipaddr>dhcp</ipaddr>
<dhcphostname></dhcphostname>
<alias-address></alias-address>
<alias-subnet>32</alias-subnet>
<dhcprejectfrom></dhcprejectfrom>
<adv_dhcp_pt_timeout></adv_dhcp_pt_timeout>
<adv_dhcp_pt_retry></adv_dhcp_pt_retry>
<adv_dhcp_pt_select_timeout></adv_dhcp_pt_select_timeout>
<adv_dhcp_pt_reboot></adv_dhcp_pt_reboot>
<adv_dhcp_pt_backoff_cutoff></adv_dhcp_pt_backoff_cutoff>
<adv_dhcp_pt_initial_interval></adv_dhcp_pt_initial_interval>
<adv_dhcp_pt_values>SavedCfg</adv_dhcp_pt_values>
<adv_dhcp_send_options></adv_dhcp_send_options>
<adv_dhcp_request_options></adv_dhcp_request_options>
<adv_dhcp_required_options></adv_dhcp_required_options>
<adv_dhcp_option_modifiers></adv_dhcp_option_modifiers>
<adv_dhcp_config_advanced></adv_dhcp_config_advanced>
<adv_dhcp_config_file_override></adv_dhcp_config_file_override>
<adv_dhcp_config_file_override_path></adv_dhcp_config_file_override_path>
<ipaddrv6>dhcp6</ipaddrv6>
<dhcp6-duid></dhcp6-duid>
<dhcp6-ia-pd-len>0</dhcp6-ia-pd-len>
<adv_dhcp6_prefix_selected_interface>wan</adv_dhcp6_prefix_selected_interface>
<spoofmac></spoofmac>
</wan>
<lan>
<enable></enable>
<if>igb1</if>
<descr><![CDATA[WAN2]]></descr>
<spoofmac>c1:9b:43:75:5a:65</spoofmac>
<ipaddr>dhcp</ipaddr>
<dhcphostname></dhcphostname>
<alias-address></alias-address>
<alias-subnet>32</alias-subnet>
<dhcprejectfrom></dhcprejectfrom>
<adv_dhcp_pt_timeout></adv_dhcp_pt_timeout>
<adv_dhcp_pt_retry></adv_dhcp_pt_retry>
<adv_dhcp_pt_select_timeout></adv_dhcp_pt_select_timeout>
<adv_dhcp_pt_reboot></adv_dhcp_pt_reboot>
<adv_dhcp_pt_backoff_cutoff></adv_dhcp_pt_backoff_cutoff>
<adv_dhcp_pt_initial_interval></adv_dhcp_pt_initial_interval>
<adv_dhcp_pt_values>SavedCfg</adv_dhcp_pt_values>
<adv_dhcp_send_options></adv_dhcp_send_options>
<adv_dhcp_request_options></adv_dhcp_request_options>
<adv_dhcp_required_options></adv_dhcp_required_options>
<adv_dhcp_option_modifiers></adv_dhcp_option_modifiers>
<adv_dhcp_config_advanced></adv_dhcp_config_advanced>
<adv_dhcp_config_file_override></adv_dhcp_config_file_override>
<adv_dhcp_config_file_override_path></adv_dhcp_config_file_override_path>
<ipaddrv6>track6</ipaddrv6>
<track6-interface>wan</track6-interface>
<track6-prefix-id>0</track6-prefix-id>
</lan>
<opt1>
<descr><![CDATA[LAN1]]></descr>
<if>igb2</if>
<enable></enable>
<spoofmac></spoofmac>
</opt1>
<opt2>
<descr><![CDATA[LAN2]]></descr>
<if>igb3</if>
<enable></enable>
<ipaddr>192.168.200.1</ipaddr>
<subnet>24</subnet>
<spoofmac></spoofmac>
</opt2>
<opt3>
<descr><![CDATA[axn_mgmt]]></descr>
<if>igb2.5</if>
<enable></enable>
<spoofmac></spoofmac>
</opt3>
<opt4>
<descr><![CDATA[axn_intra]]></descr>
<if>igb2.10</if>
<enable></enable>
<ipaddr>10.128.10.1</ipaddr>
<subnet>24</subnet>
<spoofmac></spoofmac>
</opt4>
</interfaces>
<staticroutes>
<route>
<network>192.168.104.0/24</network>
<gateway>WAN2_DHCP</gateway>
<descr><![CDATA[Zyxel compatibility rule]]></descr>
</route>
</staticroutes>
<dhcpd>
<lan>
<range>
<from>192.168.1.10</from>
<to>192.168.1.245</to>
</range>
<dhcpleaseinlocaltime></dhcpleaseinlocaltime>
<failover_peerip></failover_peerip>
<defaultleasetime></defaultleasetime>
<maxleasetime></maxleasetime>
<netmask></netmask>
<gateway></gateway>
<domain></domain>
<domainsearchlist></domainsearchlist>
<ddnsdomain></ddnsdomain>
<ddnsdomainprimary></ddnsdomainprimary>
<ddnsdomainkeyname></ddnsdomainkeyname>
<ddnsdomainkeyalgorithm>hmac-md5</ddnsdomainkeyalgorithm>
<ddnsdomainkey></ddnsdomainkey>
<mac_allow></mac_allow>
<mac_deny></mac_deny>
<ddnsclientupdates>allow</ddnsclientupdates>
<tftp></tftp>
<ldap></ldap>
<nextserver></nextserver>
<filename></filename>
<filename32></filename32>
<filename64></filename64>
<rootpath></rootpath>
<numberoptions></numberoptions>
</lan>
<opt2>
<range>
<from>192.168.200.30</from>
<to>192.168.200.199</to>
</range>
<failover_peerip></failover_peerip>
<defaultleasetime></defaultleasetime>
<maxleasetime></maxleasetime>
<netmask></netmask>
<gateway></gateway>
<domain></domain>
<domainsearchlist></domainsearchlist>
<ddnsdomain></ddnsdomain>
<ddnsdomainprimary></ddnsdomainprimary>
<ddnsdomainkeyname></ddnsdomainkeyname>
<ddnsdomainkeyalgorithm>hmac-md5</ddnsdomainkeyalgorithm>
<ddnsdomainkey></ddnsdomainkey>
<mac_allow></mac_allow>
<mac_deny></mac_deny>
<ddnsclientupdates>allow</ddnsclientupdates>
<tftp></tftp>
<ldap></ldap>
<nextserver></nextserver>
<filename></filename>
<filename32></filename32>
<filename64></filename64>
<rootpath></rootpath>
<numberoptions></numberoptions>
<enable></enable>
<dhcpleaseinlocaltime></dhcpleaseinlocaltime>
</opt2>
<opt4>
<range>
<from>10.128.10.30</from>
<to>10.128.10.199</to>
</range>
<enable></enable>
<failover_peerip></failover_peerip>
<defaultleasetime></defaultleasetime>
<maxleasetime></maxleasetime>
<netmask></netmask>
<gateway></gateway>
<domain></domain>
<domainsearchlist></domainsearchlist>
<ddnsdomain></ddnsdomain>
<ddnsdomainprimary></ddnsdomainprimary>
<ddnsdomainkeyname></ddnsdomainkeyname>
<ddnsdomainkeyalgorithm>hmac-md5</ddnsdomainkeyalgorithm>
<ddnsdomainkey></ddnsdomainkey>
<mac_allow></mac_allow>
<mac_deny></mac_deny>
<ddnsclientupdates>allow</ddnsclientupdates>
<tftp></tftp>
<ldap></ldap>
<nextserver></nextserver>
<filename></filename>
<filename32></filename32>
<filename64></filename64>
<rootpath></rootpath>
<numberoptions></numberoptions>
<dhcpleaseinlocaltime></dhcpleaseinlocaltime>
<dnsserver>8.8.8.8</dnsserver>
</opt4>
</dhcpd>
<dhcpdv6>
<lan>
<enable></enable>
<range>
<from>::1000</from>
<to>::2000</to>
</range>
<ramode>assist</ramode>
<rapriority>medium</rapriority>
</lan>
</dhcpdv6>
<snmpd>
<syslocation></syslocation>
<syscontact></syscontact>
<rocommunity>public</rocommunity>
</snmpd>
<diag>
<ipv6nat>
<ipaddr></ipaddr>
</ipv6nat>
</diag>
<syslog>
<filterdescriptions>1</filterdescriptions>
</syslog>
<nat>
<outbound>
<mode>automatic</mode>
</outbound>
</nat>
<filter>
<rule>
<id></id>
<tracker>1589535222</tracker>
<type>pass</type>
<interface>lan</interface>
<ipprotocol>inet</ipprotocol>
<tag></tag>
<tagged></tagged>
<max></max>
<max-src-nodes></max-src-nodes>
<max-src-conn></max-src-conn>
<max-src-states></max-src-states>
<statetimeout></statetimeout>
<statetype><![CDATA[keep state]]></statetype>
<os></os>
<source>
<any></any>
</source>
<destination>
<any></any>
</destination>
<disabled></disabled>
<descr><![CDATA[test rule]]></descr>
<created>
<time>1589535222</time>
<username><![CDATA[[email protected] (Local Database)]]></username>
</created>
<updated>
<time>1589537043</time>
<username><![CDATA[[email protected] (Local Database)]]></username>
</updated>
</rule>
<rule>
<id></id>
<tracker>1589534465</tracker>
<type>pass</type>
<interface>opt2</interface>
<ipprotocol>inet</ipprotocol>
<tag></tag>
<tagged></tagged>
<max></max>
<max-src-nodes></max-src-nodes>
<max-src-conn></max-src-conn>
<max-src-states></max-src-states>
<statetimeout></statetimeout>
<statetype><![CDATA[keep state]]></statetype>
<os></os>
<source>
<any></any>
</source>
<destination>
<any></any>
</destination>
<descr></descr>
<updated>
<time>1589534465</time>
<username><![CDATA[[email protected] (Local Database)]]></username>
</updated>
<created>
<time>1589534465</time>
<username><![CDATA[[email protected] (Local Database)]]></username>
</created>
</rule>
<rule>
<id></id>
<tracker>1589536898</tracker>
<type>pass</type>
<interface>opt4</interface>
<ipprotocol>inet</ipprotocol>
<tag></tag>
<tagged></tagged>
<max></max>
<max-src-nodes></max-src-nodes>
<max-src-conn></max-src-conn>
<max-src-states></max-src-states>
<statetimeout></statetimeout>
<statetype><![CDATA[keep state]]></statetype>
<os></os>
<protocol>icmp</protocol>
<icmptype>any</icmptype>
<source>
<any></any>
</source>
<destination>
<any></any>
</destination>
<descr><![CDATA[test rule]]></descr>
<created>
<time>1589536898</time>
<username><![CDATA[[email protected] (Local Database)]]></username>
</created>
<updated>
<time>1589537026</time>
<username><![CDATA[[email protected] (Local Database)]]></username>
</updated>
</rule>
<rule>
<id></id>
<tracker>1589535642</tracker>
<type>pass</type>
<interface>opt4</interface>
<ipprotocol>inet</ipprotocol>
<tag></tag>
<tagged></tagged>
<max></max>
<max-src-nodes></max-src-nodes>
<max-src-conn></max-src-conn>
<max-src-states></max-src-states>
<statetimeout></statetimeout>
<statetype><![CDATA[keep state]]></statetype>
<os></os>
<source>
<any></any>
</source>
<destination>
<any></any>
</destination>
<descr><![CDATA[test rule]]></descr>
<created>
<time>1589535642</time>
<username><![CDATA[[email protected] (Local Database)]]></username>
</created>
<updated>
<time>1589537018</time>
<username><![CDATA[[email protected] (Local Database)]]></username>
</updated>
</rule>
<rule>
<id></id>
<tracker>1589535105</tracker>
<type>pass</type>
<interface>opt4</interface>
<ipprotocol>inet</ipprotocol>
<tag></tag>
<tagged></tagged>
<max></max>
<max-src-nodes></max-src-nodes>
<max-src-conn></max-src-conn>
<max-src-states></max-src-states>
<statetimeout></statetimeout>
<statetype><![CDATA[keep state]]></statetype>
<os></os>
<source>
<network>opt4</network>
</source>
<destination>
<address>192.168.104.0/24</address>
</destination>
<descr><![CDATA[Zyxel compatibility rule]]></descr>
<created>
<time>1589535105</time>
<username><![CDATA[[email protected] (Local Database)]]></username>
</created>
<updated>
<time>1589536984</time>
<username><![CDATA[[email protected] (Local Database)]]></username>
</updated>
</rule>
<rule>
<id></id>
<tracker>1589535574</tracker>
<type>pass</type>
<interface>opt4</interface>
<ipprotocol>inet</ipprotocol>
<tag></tag>
<tagged></tagged>
<max></max>
<max-src-nodes></max-src-nodes>
<max-src-conn></max-src-conn>
<max-src-states></max-src-states>
<statetimeout></statetimeout>
<statetype><![CDATA[keep state]]></statetype>
<os></os>
<source>
<network>opt4</network>
</source>
<destination>
<any></any>
</destination>
<descr><![CDATA[axn_mgmt to all rule]]></descr>
<created>
<time>1589535574</time>
<username><![CDATA[[email protected] (Local Database)]]></username>
</created>
<updated>
<time>1589537000</time>
<username><![CDATA[[email protected] (Local Database)]]></username>
</updated>
</rule>
<rule>
<id></id>
<tracker>1589534846</tracker>
<type>pass</type>
<interface>opt4</interface>
<ipprotocol>inet</ipprotocol>
<tag></tag>
<tagged></tagged>
<max></max>
<max-src-nodes></max-src-nodes>
<max-src-conn></max-src-conn>
<max-src-states></max-src-states>
<statetimeout></statetimeout>
<statetype><![CDATA[keep state]]></statetype>
<os></os>
<source>
<network>opt4</network>
</source>
<destination>
<network>opt4ip</network>
</destination>
<descr><![CDATA[axn_intra to axn_intra]]></descr>
<created>
<time>1589534846</time>
<username><![CDATA[[email protected] (Local Database)]]></username>
</created>
<updated>
<time>1589536973</time>
<username><![CDATA[[email protected] (Local Database)]]></username>
</updated>
</rule>
<separator>
<opt2></opt2>
<opt4></opt4>
<lan></lan>
<wan></wan>
</separator>
</filter>
<shaper></shaper>
<ipsec></ipsec>
<aliases></aliases>
<proxyarp></proxyarp>
<cron>
<item>
<minute>1,31</minute>
<hour>0-5</hour>
<mday>*</mday>
<month>*</month>
<wday>*</wday>
<who>root</who>
<command>/usr/bin/nice -n20 adjkerntz -a</command>
</item>
<item>
<minute>1</minute>
<hour>3</hour>
<mday>1</mday>
<month>*</month>
<wday>*</wday>
<who>root</who>
<command>/usr/bin/nice -n20 /etc/rc.update_bogons.sh</command>
</item>
<item>
<minute>1</minute>
<hour>1</hour>
<mday>*</mday>
<month>*</month>
<wday>*</wday>
<who>root</who>
<command>/usr/bin/nice -n20 /etc/rc.dyndns.update</command>
</item>
<item>
<minute>*/60</minute>
<hour>*</hour>
<mday>*</mday>
<month>*</month>
<wday>*</wday>
<who>root</who>
<command>/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 virusprot</command>
</item>
<item>
<minute>30</minute>
<hour>12</hour>
<mday>*</mday>
<month>*</month>
<wday>*</wday>
<who>root</who>
<command>/usr/bin/nice -n20 /etc/rc.update_urltables</command>
</item>
<item>
<minute>1</minute>
<hour>0</hour>
<mday>*</mday>
<month>*</month>
<wday>*</wday>
<who>root</who>
<command>/usr/bin/nice -n20 /etc/rc.update_pkg_metadata</command>
</item>
</cron>
<wol></wol>
<rrd>
<enable></enable>
</rrd>
<load_balancer>
<monitor_type>
<name>ICMP</name>
<type>icmp</type>
<descr><![CDATA[ICMP]]></descr>
<options></options>
</monitor_type>
<monitor_type>
<name>TCP</name>
<type>tcp</type>
<descr><![CDATA[Generic TCP]]></descr>
<options></options>
</monitor_type>
<monitor_type>
<name>HTTP</name>
<type>http</type>
<descr><![CDATA[Generic HTTP]]></descr>
<options>
<path>/</path>
<host></host>
<code>200</code>
</options>
</monitor_type>
<monitor_type>
<name>HTTPS</name>
<type>https</type>
<descr><![CDATA[Generic HTTPS]]></descr>
<options>
<path>/</path>
<host></host>
<code>200</code>
</options>
</monitor_type>
<monitor_type>
<name>SMTP</name>
<type>send</type>
<descr><![CDATA[Generic SMTP]]></descr>
<options>
<send></send>
<expect>220 *</expect>
</options>
</monitor_type>
</load_balancer>
<widgets>
<sequence>system_information:col1:open:0,interfaces:col2:open:0,netgate_services_and_support:col2:open:0</sequence>
<period>10</period>
</widgets>
<openvpn></openvpn>
<dnshaper></dnshaper>
<unbound>
<enable></enable>
<dnssec></dnssec>
<active_interface></active_interface>
<outgoing_interface></outgoing_interface>
<custom_options></custom_options>
<hideidentity></hideidentity>
<hideversion></hideversion>
<dnssecstripped></dnssecstripped>
</unbound>
<revision>
<time>1589537382</time>
<description><![CDATA[[email protected] (Local Database): Firewall: Rules - deleted a firewall rule.]]></description>
<username><![CDATA[[email protected] (Local Database)]]></username>
</revision>
<cert>
<refid>5ebe5df4744c4</refid>
<descr><![CDATA[webConfigurator default (5ebe5df4744c4)]]></descr>
<type>server</type>
<crt>********************==</crt>
<prv>********************==</prv>
</cert>
<ppps></ppps>
<gateways>
<defaultgw4>WAN1_DHCP</defaultgw4>
<defaultgw6></defaultgw6>
</gateways>
<vlans>
<vlan>
<if>igb2</if>
<tag>5</tag>
<pcp></pcp>
<descr><![CDATA[axn_mgmt]]></descr>
<vlanif>igb2.5</vlanif>
</vlan>
<vlan>
<if>igb2</if>
<tag>10</tag>
<pcp></pcp>
<descr><![CDATA[axn_intra]]></descr>
<vlanif>igb2.10</vlanif>
</vlan>
</vlans>
</pfsense>
UPDATE 2
tracert
is a thing...tracert 192.168.104.1
from my desktop (connected to10.128.10.x
) i cannot come further than 1 step10.128.10.1
--- When itracert 10.128.10.1
from my desktop (when connected to192.168.104.x
) i cannot come further than 1 step192.168.104.1
--- in both cases i expected 2 steps?14:55:34.888604 IP 192.168.104.4 > 192.168.104.1: ICMP echo request, id 9474, seq 15844, length 8 -- 14:55:34.889239 IP 192.168.104.1 > 192.168.104.4: ICMP echo reply, id 9474, seq 15844, length 8
{}
). You should obfuscate any passwords and public addresses.