How can I configure pfSense to allow traffic from LAN to WAN?

Question

My topology is as the picture above. I've configure to allow incoming traffic into each pfSense interface, include 3 LAN and 1 WAN. Ex: I can ping from DC to pfSense interface in the same network. I used default Manual Outbound NAT rule generation but still can't ping from inside network to outside and receive this message "PING: transmit failed. General failure." Help me fixing this please.

Solution

Okay, by default the first LAN connection should be able to ping from the LAN to WAN (Outbound rules) but the rest of the LAN interfaces do not have rules automatically created: You will need to add rules under Firewall > Rules > [LAN*] and Firewall > NAT > Outbound.

Clarifying the LAN rules again, you will need a rule to say certain traffic is allowed in and out.

I do not know exactly what you have configured - IP address wise - from your original post.

If you require further assistance, could you send a screen-shot of the above tabs.

I hope the above helps.

Kind regards,

Andre Morton

Comments

[Nguyen Khanh]

This is detailed topology with IP address:

[Nguyen Khanh]

Sorry, this is detailed topology with IP address: imgur.com/a/dOWqz Sorry if it's hard to see. The default LAN network is 192.168.1.0, as you said, it should be able to ping to WAN. But it can't, this is the result: imgur.com/fERsTfM Configuration for each interface: imgur.com/zhXgVCv Thank's for your help.

[A. Morton]

Can you also send a screen shot of the Firewall > Rules > [LAN*] tab please. The other settings look correct.

[A. Morton]

Also, have you unchecked the 'Block private networks' check box under Interfaces > WAN? As this blocks all private RFC1918 addresses: 192.168.*.* 10.*.*.* 172.16.*.*

[Nguyen Khanh]

Here's it: imgur.com/MmeLWFu I've unchecked it already. Thanks!!

[A. Morton]

Hello, Sorry, I think I have gone in the wrong direction for your issue: PING: transmit failed. General failure. would suggest to me that the actual system you are pinging from is having the issue. I would expect to see a timeout error in your case if the packet was actually sent. What OS is running on the device that you were pinging from. So check: - On the source device that there is a default route set on that interface - On pfSense that the WAN interface is up, as it will not ping otherwise - Check that pfSense can ping 192.168.40.1

[Nguyen Khanh]

I tried to ping from each network in my topology, include CSMARS in LAN, Windows Server 2008 and Windows 7 in OPT1(DC) and CentOS in OPT2(DMZ) but no one can ping through pfSense. Especially, the reply message in Windows Server 2008 is "PING: transmit failed, error code 1231.", a bit strange for me.<>

[Nguyen Khanh]

I can ping from LANs to pfSense's inside network interface. <br>Ping from 192.168.40.10 --> 192.168.40.1 is OK. <br>Thank you!!.

[A. Morton]

Can you use the ping tool on pfSense to ping from the LAN to the WAN? If so, I would look at the routes for your machines. Windows machines can use the route print command to see the routing table. You should see a 0.0.0.0 route with the pfSense gateway address. If not, look at adding that route.

[Nguyen Khanh]

Sorry, I fixed this haha, I forgot to add default gateway in each machine.

[A. Morton]

No problem, sorry I didn't see the solution the first time round.