[SOLVED] I can't access WEB GUI from a local PC

[ricksense]

Hi,

I can access my OPNsense web GUI either from a management interface or directly from WAN (I set a firewall rule for that), no security issues since everything runs in a virtual lab environment.
I found out that I can't access the web GUI from local PCs running in a  VLAN,even though I set a pass rule for that, and the PCs can ping the local gateway (10.30.30.1) and go to the internet regularly.

here is the VLAN firewall rules:



and a Wireshark capture on the trunk interface:



I also disabled the firewall filters in the advanced option but I still can't access the web GUI from the "main" VLAN.

I don't know what it is wrong with it. Could you please help figure it out? Thanks

[bartjsmit]

System: Settings: Administration

Is the Web GUI listening on all interfaces?

[ricksense]

System: Settings: Administration

Is the Web GUI listening on all interfaces?

Yes it is.
Thanks

[bartjsmit]

Can you access the firewall with SSH?

[ricksense]

Can you access the firewall with SSH?

only from WAN or the MNG port, not from the PC on the VLAN

[Monviech (Cedrik)]

Maybe that VLAN has a Gateway set accidentally?

[ricksense]

Maybe that VLAN has a Gateway set accidentally?

Where?

Apart from WebGUI access, everything works as expected.
Can you see anything interesting in the wireshark capture screenshot I uploaded earlier?

Very weird issue

[Monviech (Cedrik)]

If only traffic targeted to a service on the firewall itself does not work, the response of the firewall might be sent to a different destination than back to the requesting client.

I havent checked the packet capture sorry, just an idea.

[ricksense]

If only traffic targeted to a service on the firewall itself does not work, the response of the firewall might be sent to a different destination than back to the requesting client.

I havent checked the packet capture sorry, just an idea.

I didn't set anything about the gateway, so it must be on the default setting.
Thanks

[Monviech (Cedrik)]

Well can you tcpdump/wireshark on the requesting client to see if it receives the correct responses from the firewall when initiating an ssh session for example?

[ricksense]

Well can you tcpdump/wireshark on the requesting client to see if it receives the correct responses from the firewall when initiating an ssh session for example?

Ok. I ran wireshark on the windows 7 machine while I was trying to access the OPNsense's WEBGUI

[ricksense]

UPDATE!!

I set MSS at 600 and now it works!

I can guess it, but I don't know exactly why.

[bartjsmit]

There may be a discrepancy in the MTU at layer-2. Check for switches or network cards that are set to different values.

[ricksense]

There may be a discrepancy in the MTU at layer-2. Check for switches or network cards that are set to different values.

There is a virtual Cisco switch between OPNsense and clients

[bartjsmit]

Set all the internal MTU to 1500. Jumbo frames are best for dedicated storage networks/VLANs.