Accessing the internet with VLANS and pfSense

[J_Worth]

Hello everyone,

 

I am having an issue trying to access the internet from some VLANS located behind a pfSense (which is doing NAT and is set to Automatic) box. The setup is as follows:

 

VLAN 5 - 10.10.255.253 (Layer 3 Switch) -> 10.10.255.254 (pfSense LAN interface)

 

VLAN 10 - 10.10.10.0/24

VLAN 20 - 10.10.20.0/24

VLAN 30 - 10.10.30.0/24

 

The VLANs can ping each other so inter VLAN routing is working ok.

 

I have set a default route of: 0.0.0.0 0.0.0.0 10.10.255.254

 

I can ping 8.8.8.8 from the Layer 3 switch CLI, but for some reason, I cannot ping that address from any of the clients on any of the VLANS.

 

The clients cannot ping 10.10.255.254 but the Layer 3 switch can.

 

How can I get internet access on the clients?

 

Thanks.

Edited March 6, 2014 by J_Worth

[psydii]

The clients need to have a default gateway set to be the IP interface of the Layer 3 switch for their vlan.

 

Only the core switch should have a default gateway of the LAN interface of the pfsense box.

[nicholab]

I am going to ask where do you want the routing to take place and to control inter vlan acl's?

[J_Worth]

The clients need to have a default gateway set to be the IP interface of the Layer 3 switch for their vlan.

 

Only the core switch should have a default gateway of the LAN interface of the pfsense box.

 

The clients have a default gateway of the IP interface of the vlan.

The core switch has: 10.10.255.253 set on a vlan interface (5) and the pfSense has 10.10.255.254.

 

 

Sent from my iPhone using EduGeek

[J_Worth]

I am going to ask where do you want the routing to take place and to control inter vlan acl's?

 

Routing is taking place on the Layer 3 switch. This is where VLAN ACLs will be placed.

 

 

Sent from my iPhone using EduGeek

[psydii]

Does the layer 3 switch have a default route defined?

[J_Worth]

Does the layer 3 switch have a default route defined?

 

Yep. It has: 0.0.0.0 0.0.0.0 10.10.255.254

 

I can ping 8.8.8.8 from the layer 3 switch but not the clients.

 

 

Sent from my iPhone using EduGeek

[nicholab]

Is the default route set on the switch? Have you set a second route on the pfsense box so it know to send all packets to the core switch?

[J_Worth]

Is the default route set on the switch? Have you set a second route on the pfsense box so it know to send all packets to the core switch?

 

That's what I've tried doing. On the pfSense box I have created a gateway on the LAN interface of 10.10.255.253

I have then defined static routes back to the individual VLAN subnets. For example:

 

Network: 10.10.10/24

Gateway: LANRouting - 10.10.255.253

Interface: LAN

 

I have set a default route on the switch

 

Sent from my iPhone using EduGeek

Edited March 6, 2014 by J_Worth

[localzuk]

Question - is the edge router your own? Or is it ISP provided?

 

We had an issue here recently where we were given a new IP range to extend into by our LEA/ISP/RBC was not added to the edge router by the LEA. So, even though we had the right routing rules set up on our core L3 switch, the new range failed to route to the internet.

 

The LEA had to add rules to the edge router to allow traffic to traverse it from the new IP range.

[psydii]

Of course you have. Reading too fast sorry.

 

My last suggestion before I bow out and back to what has most of my attention IRL... are you sure there aren't any rules in on the pfsense box that might be doing this (say a rule that only allows traffic from the subnet on vlan5?)

 

EDIT: you've basically already answered this too. I'm off back to the rock whence I crawled.

Edited March 6, 2014 by psydii

[J_Worth]

Question - is the edge router your own? Or is it ISP provided?

 

We had an issue here recently where we were given a new IP range to extend into by our LEA/ISP/RBC was not added to the edge router by the LEA. So, even though we had the right routing rules set up on our core L3 switch, the new range failed to route to the internet.

 

The LEA had to add rules to the edge router to allow traffic to traverse it from the new IP range.

 

The edge router is a LEA owned router. We have LEA range of 10.208.208.0/21, but we want to have flexibility and more addresses, so we want to place a pfSense between our LEA IP range and our custom ranges. Like this:

 

School Network ----> pfSense (LAN 10.10.255.254 & WAN: 10.208.208.10) -----> LEA Router (10.208.208.1) -----> Internet

 

pfSense is configured to use NAT, could this be causing the problem?

Edited March 6, 2014 by J_Worth

[J_Worth]

I cracked it! I hadn't changed the default LAN rule from "LAN subnet" to "any". The router was pinging successfully because it was directly connected to the "LAN Subnet"

 

Thanks for the pointers and your help.