[pfSense] How do I get routing to work in both directions?

[JeffS]

I've combed through the FreeBSD and pfSense forums, and the FreeBSD Handbook, but haven't had luck with the ideas I've gotten so far. In case it's relevant, FreeBSD is running as a guest in virtualbox with bridged interfaces. I feel like I'm having an elementary routing issue, but having not been able to find the answer after a day of research, I feel I have to ask for help.

Basically what I have are two subnets, 192.168.1.0/24, and 192.168.2.0/24. They both access the internet through 192.168.1.1. I have a machine with one NIC attached to each subnet. It has the IP addresses 192.168.1.2, and 192.168.2.1. Computers in the 192.168.2.0 network go through 192.168.2.1 to reach 192.168.1.0 and the internet.

The problem is that I can't get packets to go in the other direction.

To minimize anything I've done to complicate the issue or issues due to PfSense, I installed a fresh copy of FreeBSD 8.1, and created a minimal /etc/rc.conf.

ifconfig_em1="inet 192.168.1.2 netmask 255.255.255.0"
ifconfig_em0="inet 192.168.2.1 netmask 255.255.255.0"
gateway_enable="YES"
defaultrouter="192.168.1.1"
hostname="fbsdrouter.localdomain

This lets computers in 192.168.2.0 access computers in 192.168.1.0, but not the other way around. I added a route on my internet gateway so that I think it's supposed to know how to send packets to the 192.168.2.0 subnet. netstat -r on 192.168.1.1 has the entry

Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface 
192.168.2.0     192.168.1.2     255.255.255.0   UG        0 0          0 br0

Pinging from 192.168.1.1 to 192.168.2.1 fails, but the other direction is fine. I don't think I have any firewall enabled on 192.168.1.2, and 192.168.2.1 can ping other computers in both subnets.

I feel like I'm missing something really simple. The following are a couple of posts I found that seemed to describe problems similar to mine.

http://forum.pfsense.org/index.php/topic,37872.0.html
http://forum.pfsense.org/index.php/topic,37661.0.html

 

[SirDice]

Remove the 192.168.2.0/24 route to 192.168.1.2, it's incorrect. You don't need to set a route to 192.168.2.0/24 as it is directly connected.

 

[JeffS]

Unfortunately, if I do that, then computers in 192.168.2.0/24 can't ping outside their subnet, except to 192.168.1.2.

 

[SirDice]

Unfortunately, if I do that, then computers in 192.168.2.0/24 can't ping outside their subnet, except to 192.168.1.2.

It will work if the computers in 192.168.2.0/24 have 192.168.2.1 as a default gateway. However, the router at 192.168.1.1 does need a route to 192.168.2.0/24 (I didn't spot that one before).