News: This forum is now permanently frozen.
linktree m0n0wall Forum  >  m0n0wall Support (English)  >  Firewall/NAT
linktree Topic: LAN Packets Being Blocked
Pages: [1]
Topic: LAN Packets Being Blocked  (Read 1875 times)
« on: February 12, 2011, 15:51:30 »
SnAzBaZ *
Posts: 3
I have two LAN subnets that I need to link together they are 192.168.4.0/24 and 192.168.5.0/24

There is a m0n0wall running on 192.168.4.1. It's LAN connection goes out to our network switch, and it's WAN port goes out to our ADSL modem. WAN is connected via PPPoE.

The 192.168.4.0 subnet contains all of our office workstations. The 192.168.5.0 subnet contains development servers and test machines that need to obtain internet access and be "managed" by computers on the 192.168.4.0 subnet, but need to be on their own subnet as well.

I have a Draytek 2820N configured on 192.168.5.1 with it's WAN2 port configured as 192.168.4.25 and a default gateway of 192.168.4.1. Machines on the 5.0 subnet can connect to the internet via the m0n0wall just fine.

I configured a static route on the m0n0wall LAN interface, Network 192.168.5.0/24 and Gateway 192.168.4.25.

Machines on the 5.0 subnet can ping machines on the 4.0 network but the reverse does not work. I configured a new firewall rule on the m0n0wall that allows any traffic on the LAN interface with a source IP of 192.168.4.25 to be allowed. The DrayTek firewall is currently configured to pass all traffic regardless.

When I try to ping a machine in the 5.0 subnet from 4.0 I see this in my m0n0wall log:

BLOCK 14:45:27.888157      LAN      192.168.4.25      192.168.4.37, type echoreply/0      ICMP

So the reply is being sent from the 5.0 subnet but is not being allowed to reach my workstation because the firewall is blocking it. Why is the firewall blocking it ?

I hope the explanation of my network is clear, please ask if you require further clarification.

Thank you.
« Reply #1 on: February 14, 2011, 15:11:32 »
iridris ***
Posts: 145
When you set up the firewall rule on m0n0wall, did you set the protocol to ANY instead of the default TCP?  If it is still set to TCP then ICMP (pings) would still be blocked.
« Reply #2 on: February 14, 2011, 15:34:21 »
SnAzBaZ *
Posts: 3
Yes the firewall is setup correctly. The issue has been resolved by replacing the Draytek with a Mikrotik RB750. I also had to check the box in Advanced to "Bypass firewall rules for traffic on the same interface".

It now works as expected. Upgraded to 1.33b2 at the same time so the new version of ipfilter might have helped as well.
 
Pages: [1]
 
 
Powered by SMF 1.1.20 | SMF © 2013, Simple Machines