Hi all,
have VLANs defined on xcp-ng, configured DHCP servers, and rules on the pfsense. Everything works fine, except one thing. I don’t have access from one VLAN to another, the only difference is that they are on different gateways.
LAN firewall rule:
IPv4* Lan net * * * NORDVPN - this is the main LAN under VPN
VPN Free LAN:
IPv4* VPN_FREE net * * * WAN_DHCP - VLAN not under VPN
I can’t ping devices from the main LAN on VPN_FREE LAN.
If I set the gateway on the main LAN to default, I can ping devices but in this case, the main LAN is not under VPN.
I guess I’m missing something, but can’t figure out what exactly
Might be easier to create an alias with all your vlans then use the alias in your rules to allow traffic to access LAN/vlans. The different gateways won’t make a difference if you define a rule to for LAN and for WAN traffic.
Perhaps there is another way but I’ve found the above to work.
My destination from LAN net is set to * which means everywhere, have no idea how alias would help in this case.
If i change gateway on the main LAN to default i have access to devices on VLANs
When you specify a gateway in advanced settings of a rule, all traffic is routed to the gateway unless something else specifies otherwise. This is different from leaving the gateway as default in advanced settings. In that case, traffic can still find your other VLANs.
There are two solutions. Above your rule with the specified gateway, add a rule permitting traffic to the VLANs or, better, to all private ip addresses through use of an alias. I.e., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
A more elegant solution is to add into the same rule specifying the gateway a set of destinations, for example, the alias with all private IP addresses. But make it the “inverse” of those addresses. That would mean that if the traffic is not heading to a private IP address, the rule with the specified gateway is applied and the traffic goes to the gateway. If the traffic is headed to a private address, there is no match and the rule is skipped. You should in either case have a default allow to anywhere rule at the bottom without a specified gateway.
Impovich, sorry I hadn’t scrolled down to see that you’d solved the problem when I composed my response. As an addendum, at the end I should have said: You should in either case have a default allow to anywhere rule at the bottom without a speified gateway if you want traffic routed to the internet when your VPN is down. I think the absense of such a rule creates a block if the VPN is down, something that Tom achieved in a different way in his video, but I haven’t tested that.
