1

I have 2 networks and want to connect them with each other. It should be possible that all devices in network A can communicate with devices on network B and other way round. 1 network is "managed" by a USG200 and the other by a Pfsense machine. Each router/firewall uses:

  • 1 interface to provide DHCP and connect a switch with all network devices to
  • 1 to connect to the other router/firewall

What i know

  • I'm able to ping each device in the same network, including the interface on the concerning router/firewall.
  • I'm able to ping the network behind the Zyxel from Pfsense CLI but not from the network behind (10.128.10.x).
  • I'm not able to ping Pfsense of the network behind from the Zyxel of the network behind (192.168.104.x)

Why can't i ping, ssh or browse to a device in the other network?

I made a diagram which sketches what i described above:

enter image description here

The export of pfSense:

<?xml version="1.0"?>
<pfsense>
    <version>19.1</version>
    <lastchange></lastchange>
    <system>
        <optimization>normal</optimization>
        <hostname>axx-psen-wal01</hostname>
        <domain>localdomain</domain>
        <group>
            <name>all</name>
            <description><![CDATA[All Users]]></description>
            <scope>system</scope>
            <gid>1998</gid>
            <member>0</member>
        </group>
        <group>
            <name>admins</name>
            <description><![CDATA[System Administrators]]></description>
            <scope>system</scope>
            <gid>1999</gid>
            <member>0</member>
            <priv>page-all</priv>
        </group>
        <user>
            <name>admin</name>
            <descr><![CDATA[System Administrator]]></descr>
            <scope>system</scope>
            <groupname>admins</groupname>
            <bcrypt-hash>***********OBFUSCATED**********</bcrypt-hash>
            <uid>0</uid>
            <priv>user-shell-access</priv>
        </user>
        <nextuid>2000</nextuid>
        <nextgid>2000</nextgid>
        <timeservers>2.pfsense.pool.ntp.org</timeservers>
        <disablenatreflection>yes</disablenatreflection>
        <disablesegmentationoffloading></disablesegmentationoffloading>
        <disablelargereceiveoffloading></disablelargereceiveoffloading>
        <ipv6allow></ipv6allow>
        <maximumtableentries>400000</maximumtableentries>
        <powerd_ac_mode>hadp</powerd_ac_mode>
        <powerd_battery_mode>hadp</powerd_battery_mode>
        <powerd_normal_mode>hadp</powerd_normal_mode>
        <bogons>
            <interval>monthly</interval>
        </bogons>
        <already_run_config_upgrade></already_run_config_upgrade>
        <timezone>Europe/Amsterdam</timezone>
        <language>en_US</language>
        <dnsserver>8.8.8.8</dnsserver>
        <dnsallowoverride></dnsallowoverride>
        <dns1gw>none</dns1gw>
        <maximumstates></maximumstates>
        <aliasesresolveinterval></aliasesresolveinterval>
        <maximumfrags></maximumfrags>
        <reflectiontimeout></reflectiontimeout>
    </system>
    <interfaces>
        <wan>
            <if>igb0</if>
            <blockpriv></blockpriv>
            <blockbogons></blockbogons>
            <descr><![CDATA[WAN1]]></descr>
            <alias-address></alias-address>
            <alias-subnet>32</alias-subnet>
            <spoofmac></spoofmac>
            <enable></enable>
            <ipaddr>dhcp</ipaddr>
            <dhcphostname></dhcphostname>
            <dhcprejectfrom></dhcprejectfrom>
            <adv_dhcp_pt_timeout></adv_dhcp_pt_timeout>
            <adv_dhcp_pt_retry></adv_dhcp_pt_retry>
            <adv_dhcp_pt_select_timeout></adv_dhcp_pt_select_timeout>
            <adv_dhcp_pt_reboot></adv_dhcp_pt_reboot>
            <adv_dhcp_pt_backoff_cutoff></adv_dhcp_pt_backoff_cutoff>
            <adv_dhcp_pt_initial_interval></adv_dhcp_pt_initial_interval>
            <adv_dhcp_pt_values>SavedCfg</adv_dhcp_pt_values>
            <adv_dhcp_send_options></adv_dhcp_send_options>
            <adv_dhcp_request_options></adv_dhcp_request_options>
            <adv_dhcp_required_options></adv_dhcp_required_options>
            <adv_dhcp_option_modifiers></adv_dhcp_option_modifiers>
            <adv_dhcp_config_advanced></adv_dhcp_config_advanced>
            <adv_dhcp_config_file_override></adv_dhcp_config_file_override>
            <adv_dhcp_config_file_override_path></adv_dhcp_config_file_override_path>
            <ipaddrv6>dhcp6</ipaddrv6>
            <dhcp6-duid></dhcp6-duid>
            <dhcp6-ia-pd-len>0</dhcp6-ia-pd-len>
            <adv_dhcp6_prefix_selected_interface>lan</adv_dhcp6_prefix_selected_interface>
        </wan>
        <lan>
            <if>igb1</if>
            <descr><![CDATA[WAN2]]></descr>
            <spoofmac>c1:9b:43:75:5a:65</spoofmac>
            <alias-address></alias-address>
            <alias-subnet>32</alias-subnet>
            <enable></enable>
            <ipaddr>192.168.222.2</ipaddr>
            <subnet>24</subnet>
            <ipaddrv6>track6</ipaddrv6>
            <track6-interface>wan</track6-interface>
            <track6-prefix-id>0</track6-prefix-id>
        </lan>
        <opt1>
            <descr><![CDATA[LAN1]]></descr>
            <if>igb2</if>
            <enable></enable>
            <spoofmac></spoofmac>
        </opt1>
        <opt2>
            <descr><![CDATA[LAN2]]></descr>
            <if>igb3</if>
            <enable></enable>
            <ipaddr>192.168.200.1</ipaddr>
            <subnet>24</subnet>
            <spoofmac></spoofmac>
        </opt2>
        <opt3>
            <descr><![CDATA[axn_mgmt]]></descr>
            <if>igb2.5</if>
            <enable></enable>
            <spoofmac></spoofmac>
        </opt3>
        <opt4>
            <descr><![CDATA[axn_intra]]></descr>
            <if>igb2.10</if>
            <enable></enable>
            <ipaddr>10.128.10.1</ipaddr>
            <subnet>24</subnet>
            <spoofmac></spoofmac>
        </opt4>
    </interfaces>
    <staticroutes>
        <route>
            <network>192.168.104.0/24</network>
            <gateway>gw_to_old_network</gateway>
            <descr><![CDATA[Zyxel compatibility rule]]></descr>
        </route>
    </staticroutes>
    <dhcpd>
        <lan>
            <range>
                <from>192.168.1.10</from>
                <to>192.168.1.245</to>
            </range>
            <dhcpleaseinlocaltime></dhcpleaseinlocaltime>
            <failover_peerip></failover_peerip>
            <defaultleasetime></defaultleasetime>
            <maxleasetime></maxleasetime>
            <netmask></netmask>
            <gateway></gateway>
            <domain></domain>
            <domainsearchlist></domainsearchlist>
            <ddnsdomain></ddnsdomain>
            <ddnsdomainprimary></ddnsdomainprimary>
            <ddnsdomainkeyname></ddnsdomainkeyname>
            <ddnsdomainkeyalgorithm>hmac-md5</ddnsdomainkeyalgorithm>
            <ddnsdomainkey></ddnsdomainkey>
            <mac_allow></mac_allow>
            <mac_deny></mac_deny>
            <ddnsclientupdates>allow</ddnsclientupdates>
            <tftp></tftp>
            <ldap></ldap>
            <nextserver></nextserver>
            <filename></filename>
            <filename32></filename32>
            <filename64></filename64>
            <rootpath></rootpath>
            <numberoptions></numberoptions>
        </lan>
        <opt2>
            <range>
                <from>192.168.200.30</from>
                <to>192.168.200.199</to>
            </range>
            <failover_peerip></failover_peerip>
            <defaultleasetime></defaultleasetime>
            <maxleasetime></maxleasetime>
            <netmask></netmask>
            <gateway></gateway>
            <domain></domain>
            <domainsearchlist></domainsearchlist>
            <ddnsdomain></ddnsdomain>
            <ddnsdomainprimary></ddnsdomainprimary>
            <ddnsdomainkeyname></ddnsdomainkeyname>
            <ddnsdomainkeyalgorithm>hmac-md5</ddnsdomainkeyalgorithm>
            <ddnsdomainkey></ddnsdomainkey>
            <mac_allow></mac_allow>
            <mac_deny></mac_deny>
            <ddnsclientupdates>allow</ddnsclientupdates>
            <tftp></tftp>
            <ldap></ldap>
            <nextserver></nextserver>
            <filename></filename>
            <filename32></filename32>
            <filename64></filename64>
            <rootpath></rootpath>
            <numberoptions></numberoptions>
            <enable></enable>
            <dhcpleaseinlocaltime></dhcpleaseinlocaltime>
        </opt2>
        <opt4>
            <range>
                <from>10.128.10.30</from>
                <to>10.128.10.199</to>
            </range>
            <enable></enable>
            <failover_peerip></failover_peerip>
            <defaultleasetime></defaultleasetime>
            <maxleasetime></maxleasetime>
            <netmask></netmask>
            <gateway></gateway>
            <domain></domain>
            <domainsearchlist></domainsearchlist>
            <ddnsdomain></ddnsdomain>
            <ddnsdomainprimary></ddnsdomainprimary>
            <ddnsdomainkeyname></ddnsdomainkeyname>
            <ddnsdomainkeyalgorithm>hmac-md5</ddnsdomainkeyalgorithm>
            <ddnsdomainkey></ddnsdomainkey>
            <mac_allow></mac_allow>
            <mac_deny></mac_deny>
            <ddnsclientupdates>allow</ddnsclientupdates>
            <tftp></tftp>
            <ldap></ldap>
            <nextserver></nextserver>
            <filename></filename>
            <filename32></filename32>
            <filename64></filename64>
            <rootpath></rootpath>
            <numberoptions></numberoptions>
            <dhcpleaseinlocaltime></dhcpleaseinlocaltime>
            <dnsserver>8.8.8.8</dnsserver>
        </opt4>
    </dhcpd>
    <dhcpdv6>
        <lan>
            <enable></enable>
            <range>
                <from>::1000</from>
                <to>::2000</to>
            </range>
            <ramode>assist</ramode>
            <rapriority>medium</rapriority>
        </lan>
    </dhcpdv6>
    <snmpd>
        <syslocation></syslocation>
        <syscontact></syscontact>
        <rocommunity>public</rocommunity>
    </snmpd>
    <diag>
        <ipv6nat>
            <ipaddr></ipaddr>
        </ipv6nat>
    </diag>
    <syslog>
        <filterdescriptions>1</filterdescriptions>
    </syslog>
    <nat>
        <outbound>
            <mode>advanced</mode>
            <rule>
                <interface>wan</interface>
                <source>
                    <network>10.128.10.0/24</network>
                </source>
                <dstport>500</dstport>
                <target></target>
                <destination>
                    <any></any>
                </destination>
                <staticnatport></staticnatport>
                <descr><![CDATA[Auto created rule for ISAKMP - AXN_INTRA to WAN1]]></descr>
                <created>
                    <time>1589543460</time>
                    <username><![CDATA[Manual Outbound NAT Switch]]></username>
                </created>
            </rule>
            <rule>
                <interface>wan</interface>
                <source>
                    <network>10.128.10.0/24</network>
                </source>
                <sourceport></sourceport>
                <target></target>
                <destination>
                    <any></any>
                </destination>
                <natport></natport>
                <descr><![CDATA[Auto created rule - AXN_INTRA to WAN1]]></descr>
                <created>
                    <time>1589543460</time>
                    <username><![CDATA[Manual Outbound NAT Switch]]></username>
                </created>
            </rule>
            <rule>
                <interface>lan</interface>
                <source>
                    <network>192.168.104.0/24</network>
                </source>
                <dstport>500</dstport>
                <target></target>
                <destination>
                    <any></any>
                </destination>
                <staticnatport></staticnatport>
                <descr><![CDATA[Auto created rule for ISAKMP - static route to WAN2]]></descr>
                <created>
                    <time>1589792091</time>
                    <username><![CDATA[Manual Outbound NAT Switch]]></username>
                </created>
            </rule>
            <rule>
                <interface>lan</interface>
                <source>
                    <network>192.168.104.0/24</network>
                </source>
                <sourceport></sourceport>
                <target></target>
                <destination>
                    <any></any>
                </destination>
                <natport></natport>
                <descr><![CDATA[Auto created rule - static route to WAN2]]></descr>
                <created>
                    <time>1589792091</time>
                    <username><![CDATA[Manual Outbound NAT Switch]]></username>
                </created>
            </rule>
            <rule>
                <interface>lan</interface>
                <source>
                    <network>10.128.10.0/24</network>
                </source>
                <dstport>500</dstport>
                <target></target>
                <destination>
                    <any></any>
                </destination>
                <staticnatport></staticnatport>
                <descr><![CDATA[Auto created rule for ISAKMP - AXN_INTRA to WAN2]]></descr>
                <created>
                    <time>1589792091</time>
                    <username><![CDATA[Manual Outbound NAT Switch]]></username>
                </created>
            </rule>
            <rule>
                <interface>lan</interface>
                <source>
                    <network>10.128.10.0/24</network>
                </source>
                <sourceport></sourceport>
                <target></target>
                <destination>
                    <any></any>
                </destination>
                <natport></natport>
                <descr><![CDATA[Auto created rule - AXN_INTRA to WAN2]]></descr>
                <created>
                    <time>1589792091</time>
                    <username><![CDATA[Manual Outbound NAT Switch]]></username>
                </created>
            </rule>
        </outbound>
    </nat>
    <filter>
        <rule>
            <id></id>
            <tracker>1589535222</tracker>
            <type>pass</type>
            <interface>lan</interface>
            <ipprotocol>inet</ipprotocol>
            <tag></tag>
            <tagged></tagged>
            <max></max>
            <max-src-nodes></max-src-nodes>
            <max-src-conn></max-src-conn>
            <max-src-states></max-src-states>
            <statetimeout></statetimeout>
            <statetype><![CDATA[keep state]]></statetype>
            <os></os>
            <source>
                <any></any>
            </source>
            <destination>
                <any></any>
            </destination>
            <descr><![CDATA[test rule]]></descr>
            <created>
                <time>1589535222</time>
                <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
            </created>
            <updated>
                <time>1589537043</time>
                <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
            </updated>
        </rule>
        <rule>
            <id></id>
            <tracker>1589534465</tracker>
            <type>pass</type>
            <interface>opt2</interface>
            <ipprotocol>inet</ipprotocol>
            <tag></tag>
            <tagged></tagged>
            <max></max>
            <max-src-nodes></max-src-nodes>
            <max-src-conn></max-src-conn>
            <max-src-states></max-src-states>
            <statetimeout></statetimeout>
            <statetype><![CDATA[keep state]]></statetype>
            <os></os>
            <source>
                <any></any>
            </source>
            <destination>
                <any></any>
            </destination>
            <descr></descr>
            <updated>
                <time>1589534465</time>
                <username><![CDATA[admin@192.168.1.100 (Local Database)]]></username>
            </updated>
            <created>
                <time>1589534465</time>
                <username><![CDATA[admin@192.168.1.100 (Local Database)]]></username>
            </created>
        </rule>
        <rule>
            <id></id>
            <tracker>1589536898</tracker>
            <type>pass</type>
            <interface>opt4</interface>
            <ipprotocol>inet</ipprotocol>
            <tag></tag>
            <tagged></tagged>
            <max></max>
            <max-src-nodes></max-src-nodes>
            <max-src-conn></max-src-conn>
            <max-src-states></max-src-states>
            <statetimeout></statetimeout>
            <statetype><![CDATA[keep state]]></statetype>
            <os></os>
            <protocol>icmp</protocol>
            <icmptype>any</icmptype>
            <source>
                <any></any>
            </source>
            <destination>
                <any></any>
            </destination>
            <descr><![CDATA[test rule]]></descr>
            <created>
                <time>1589536898</time>
                <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
            </created>
            <updated>
                <time>1589537026</time>
                <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
            </updated>
        </rule>
        <rule>
            <id></id>
            <tracker>1589535642</tracker>
            <type>pass</type>
            <interface>opt4</interface>
            <ipprotocol>inet</ipprotocol>
            <tag></tag>
            <tagged></tagged>
            <max></max>
            <max-src-nodes></max-src-nodes>
            <max-src-conn></max-src-conn>
            <max-src-states></max-src-states>
            <statetimeout></statetimeout>
            <statetype><![CDATA[keep state]]></statetype>
            <os></os>
            <source>
                <any></any>
            </source>
            <destination>
                <any></any>
            </destination>
            <descr><![CDATA[test rule]]></descr>
            <created>
                <time>1589535642</time>
                <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
            </created>
            <updated>
                <time>1589537018</time>
                <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
            </updated>
        </rule>
        <rule>
            <id></id>
            <tracker>1589535105</tracker>
            <type>pass</type>
            <interface>opt4</interface>
            <ipprotocol>inet</ipprotocol>
            <tag></tag>
            <tagged></tagged>
            <max></max>
            <max-src-nodes></max-src-nodes>
            <max-src-conn></max-src-conn>
            <max-src-states></max-src-states>
            <statetimeout></statetimeout>
            <statetype><![CDATA[keep state]]></statetype>
            <os></os>
            <source>
                <network>opt4</network>
            </source>
            <destination>
                <address>192.168.104.0/24</address>
            </destination>
            <descr><![CDATA[Zyxel compatibility rule]]></descr>
            <created>
                <time>1589535105</time>
                <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
            </created>
            <updated>
                <time>1589536984</time>
                <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
            </updated>
        </rule>
        <rule>
            <id></id>
            <tracker>1589535574</tracker>
            <type>pass</type>
            <interface>opt4</interface>
            <ipprotocol>inet</ipprotocol>
            <tag></tag>
            <tagged></tagged>
            <max></max>
            <max-src-nodes></max-src-nodes>
            <max-src-conn></max-src-conn>
            <max-src-states></max-src-states>
            <statetimeout></statetimeout>
            <statetype><![CDATA[keep state]]></statetype>
            <os></os>
            <source>
                <network>opt4</network>
            </source>
            <destination>
                <any></any>
            </destination>
            <descr><![CDATA[axn_mgmt to all rule]]></descr>
            <created>
                <time>1589535574</time>
                <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
            </created>
            <updated>
                <time>1589537000</time>
                <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
            </updated>
        </rule>
        <rule>
            <id></id>
            <tracker>1589534846</tracker>
            <type>pass</type>
            <interface>opt4</interface>
            <ipprotocol>inet</ipprotocol>
            <tag></tag>
            <tagged></tagged>
            <max></max>
            <max-src-nodes></max-src-nodes>
            <max-src-conn></max-src-conn>
            <max-src-states></max-src-states>
            <statetimeout></statetimeout>
            <statetype><![CDATA[keep state]]></statetype>
            <os></os>
            <source>
                <network>opt4</network>
            </source>
            <destination>
                <network>opt4ip</network>
            </destination>
            <descr><![CDATA[axn_intra to axn_intra]]></descr>
            <created>
                <time>1589534846</time>
                <username><![CDATA[admin@192.168.200.30 (Local Database)]]></username>
            </created>
            <updated>
                <time>1589536973</time>
                <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
            </updated>
        </rule>
        <separator>
            <opt2></opt2>
            <opt4></opt4>
            <lan></lan>
            <wan></wan>
        </separator>
        <bypassstaticroutes>yes</bypassstaticroutes>
    </filter>
    <shaper></shaper>
    <ipsec></ipsec>
    <aliases></aliases>
    <proxyarp></proxyarp>
    <cron>
        <item>
            <minute>1,31</minute>
            <hour>0-5</hour>
            <mday>*</mday>
            <month>*</month>
            <wday>*</wday>
            <who>root</who>
            <command>/usr/bin/nice -n20 adjkerntz -a</command>
        </item>
        <item>
            <minute>1</minute>
            <hour>3</hour>
            <mday>1</mday>
            <month>*</month>
            <wday>*</wday>
            <who>root</who>
            <command>/usr/bin/nice -n20 /etc/rc.update_bogons.sh</command>
        </item>
        <item>
            <minute>1</minute>
            <hour>1</hour>
            <mday>*</mday>
            <month>*</month>
            <wday>*</wday>
            <who>root</who>
            <command>/usr/bin/nice -n20 /etc/rc.dyndns.update</command>
        </item>
        <item>
            <minute>*/60</minute>
            <hour>*</hour>
            <mday>*</mday>
            <month>*</month>
            <wday>*</wday>
            <who>root</who>
            <command>/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 virusprot</command>
        </item>
        <item>
            <minute>30</minute>
            <hour>12</hour>
            <mday>*</mday>
            <month>*</month>
            <wday>*</wday>
            <who>root</who>
            <command>/usr/bin/nice -n20 /etc/rc.update_urltables</command>
        </item>
        <item>
            <minute>1</minute>
            <hour>0</hour>
            <mday>*</mday>
            <month>*</month>
            <wday>*</wday>
            <who>root</who>
            <command>/usr/bin/nice -n20 /etc/rc.update_pkg_metadata</command>
        </item>
    </cron>
    <wol></wol>
    <rrd>
        <enable></enable>
        <category>left=system-processor&amp;right=&amp;resolution=300&amp;timePeriod=-1d&amp;startDate=&amp;endDate=&amp;startTime=0&amp;endTime=0&amp;graphtype=line&amp;invert=true&amp;refresh-interval=0</category>
    </rrd>
    <load_balancer>
        <monitor_type>
            <name>ICMP</name>
            <type>icmp</type>
            <descr><![CDATA[ICMP]]></descr>
            <options></options>
        </monitor_type>
        <monitor_type>
            <name>TCP</name>
            <type>tcp</type>
            <descr><![CDATA[Generic TCP]]></descr>
            <options></options>
        </monitor_type>
        <monitor_type>
            <name>HTTP</name>
            <type>http</type>
            <descr><![CDATA[Generic HTTP]]></descr>
            <options>
                <path>/</path>
                <host></host>
                <code>200</code>
            </options>
        </monitor_type>
        <monitor_type>
            <name>HTTPS</name>
            <type>https</type>
            <descr><![CDATA[Generic HTTPS]]></descr>
            <options>
                <path>/</path>
                <host></host>
                <code>200</code>
            </options>
        </monitor_type>
        <monitor_type>
            <name>SMTP</name>
            <type>send</type>
            <descr><![CDATA[Generic SMTP]]></descr>
            <options>
                <send></send>
                <expect>220 *</expect>
            </options>
        </monitor_type>
    </load_balancer>
    <widgets>
        <sequence>system_information:col1:open:0,interfaces:col2:open:0</sequence>
        <period>10</period>
    </widgets>
    <openvpn></openvpn>
    <dnshaper></dnshaper>
    <unbound>
        <enable></enable>
        <dnssec></dnssec>
        <active_interface></active_interface>
        <outgoing_interface></outgoing_interface>
        <custom_options></custom_options>
        <hideidentity></hideidentity>
        <hideversion></hideversion>
        <dnssecstripped></dnssecstripped>
    </unbound>
    <revision>
        <time>1589875412</time>
        <description><![CDATA[admin@10.128.10.30 (Local Database): Saved static route configuration.]]></description>
        <username><![CDATA[admin@10.128.10.30 (Local Database)]]></username>
    </revision>
    <cert>
        <refid>5ebe5df4744c4</refid>
        <descr><![CDATA[webConfigurator default (5ebe5df4744c4)]]></descr>
        <type>server</type>
        <crt>***********OBFUSCATED**********==</crt>
        <prv>***********OBFUSCATED**********==</prv>
    </cert>
    <ppps></ppps>
    <gateways>
        <defaultgw4></defaultgw4>
        <defaultgw6></defaultgw6>
        <gateway_group>
            <name>gw_group_test</name>
            <item>WAN1_DHCP|1|address</item>
            <trigger>downlosslatency</trigger>
            <descr></descr>
        </gateway_group>
        <gateway_item>
            <interface>lan</interface>
            <gateway>192.168.222.1</gateway>
            <name>gw_to_old_network</name>
            <weight>1</weight>
            <ipprotocol>inet</ipprotocol>
            <descr></descr>
        </gateway_item>
    </gateways>
    <vlans>
        <vlan>
            <if>igb2</if>
            <tag>5</tag>
            <pcp></pcp>
            <descr><![CDATA[axn_mgmt]]></descr>
            <vlanif>igb2.5</vlanif>
        </vlan>
        <vlan>
            <if>igb2</if>
            <tag>10</tag>
            <pcp></pcp>
            <descr><![CDATA[axn_intra]]></descr>
            <vlanif>igb2.10</vlanif>
        </vlan>
    </vlans>
</pfsense>


I also wanted to provide an export of the Zyxel but as this network is fully operational the config is HUGE and possibly bloats some vulnerabilities (the device was already in use where i joined the company, my predecessor left). For that reason i added some print screens with the settings i made. I could not find a place where to configure a gateway in the Zyxel like i did for Pfsense with the ip of Pfsense. I only could only find how to set a "next hop" at the static route.

Zyxel interface 1 configuration:

enter image description here enter image description here

Configured route (Gateway: pfsense represents ip 192.168.222.2): enter image description here

Firewall rule:

enter image description here

  • For a device to be on-topic here, the manufacturer must offer optional, paid support. Unfortunately, Zyxel does not offer that, so we cannot help with that device. Firewalls often need a special configuration to allow or respond to ICMP, which is what ping uses. – Ron Maupin May 19 at 13:36
  • @Ron Maupin, thanks for the comment. --- The Zyxel will be completely replaced by the Pfsense in future but for now i need to keep the current network. --- I understand what you say about ICMP but i can ping from pfsense to devices behind the zyxel so i suppose i did a misconfiguration in Pfsense. --- I can not only not ping devices in the other network but also not connect to them via ssh or view webinterfaces in the browser. So not only pinging is the issue... --- I do not understand why people here cannot help me when Zyxel does not offer support ? – CodeNinja May 19 at 13:53
  • The pfSense may need an explicit configuration, either in or separated from a firewall rule, to allow ICMP. You could try a different protocol to test, rather than ICMP. There is an explanation of the reason for the offered support requirement in this meta answer. – Ron Maupin May 19 at 13:59
  • Default of pfSense (and many other firewalls) is deny, unless there is an allow rule. – vidarlo May 29 at 19:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.