I have a network with a Layer 3 switch running as my core router. I have OPNSense running as my perimeter firewall. Computers connected on the same subnet as the firewall can get out to the internet any other computer on other subnets cannot. The live log shows the traffic as being passed but I get nothing.
On my switch I configured a default route pointed at the OPNSense Lan IP
On FW
I ran through the start-up wizard.
Created a Lan gateway pointed at my LAN router IP. (WAN gateway is present and active)
Created a static route for LAN networks pointed at LAN IP
Created a FW alias with all LAN networks.
Created a permit FW rule to allow all LAN network (alias) to any
I am sure I am missing something, but I can't find it.
I have reconfigured OPNSense box on the inside of my network and can duplicate the problem. Only local interface network can get out.
Any ideas on what I am doing wrong?
If the switch doesn't nat outgoing traffic to the gateway, you have to add source NAT rules to WAN for the local networks behind it.
OPNsense creates such rules automatically, but only for subnets defined on its interfaces.
Thank you sir! I changed NAT to hybrid and added the LAN alias and now other subnets can get out.
I thought all addresses on the LAN would get out, but you were correct adjusting NAT fixed it.
Thanks again!