pfSense short config summary:

WAN interface is on a registered Internet block of addresses 
    connected to ISP via fibre
LAN interface has IP address
OPT1 interface has IP address 

A separate wireless network exists on subnet, via an HP MSM760 wireless controller.

Problem summary: I cannot route from the wireless subnet 172.16 to the LAN subnet 10.200.1

------------- network
HP ProCurve VSC wireless subnet
(traffic from 172.16 intercepted by HP MSM760 and egress to 
 interface with IP
          |  (external interface on MSM760 controller)
          |  (OPT1 interface on pfSense server)

On pfSense the following gateway is set as:

Name: BYOD,  Interface: OPT1,  Gateway:

... and the following route is set as:

Network:,  Gateway: BYOD -,  Interface: OPT1

Diagnostics: A host in the 172.16 network has the address and it has no firewall, so it can respond to PING

I can ping from the OPT1 interface in pfSense' Diagnostics/Ping page but I cannot ping that address from the WAN or LAN interface in pfSense.

Is there anything obvious from the above description that would explain why I cannot see the 10.200.1 net from the 172.16 net?

Here is a screenshot of the VSC config on the MSM760. The network is defined by the DHCP server config at the bottom of the shot.

This is the VSC config on the MSM760

And these are relevant pages from pfSense. As you can see there is a route to the network via gateway (which is an IP interface connected to VLAN #9 on the MSM760)

This is the pfSense config

At the end you can see a diagnostic Ping from the pfSense to a host on the 172.16 network.

And just to clarify what the VSC Egress Mapping is going to:

MSM760 BYOD interface enter image description here

  • Did you verify the MSM760 controller config? Perhaps it doesn't know how to route out of its subnet? Or perhaps its an ACL issue? Mar 20, 2014 at 5:12
  • To be honest, I'm not 100% sure how the VSC Egress traffic interception works - it seems to be some 'black box' trickery on the MSM760's part. Would it help if I posted a link to some screenshots of the VSC config?
    – ChrisNZ
    Mar 20, 2014 at 5:47
  • Sorry, I can't add comments. So what is the default gateway of the wireless clients? Mar 20, 2014 at 6:18
  • I've added some screenshots. The wireless clients gateway (as defined in the VSC) is 172.16.02, and this appears to be intercepted (as per the VSC egress mapping) and routed out to the VLAN BYOD interface which has an IP address of
    – ChrisNZ
    Mar 20, 2014 at 23:04

1 Answer 1


I would put up a sniffer between the pfsense OPT interface and the MSM760 just to see what the packets look like and if they're even making it onto that line.

You'd want to see if:

1. Your pings TO the 172.16 network from LAN and WAN are even exiting the OPT interface and

2. Packets FROM the 172.16 network destined to the LAN are making it passed the MSM760 to the pfsense.

Either one of those two isn't happening OR there's something wrong with ARP. I'm still confused about what is? What device is their default gateway? If the MSM760 is intercepting it and putting it onto the OPT1 connection, is it re-writing the packet so that it's new destination is the OPT1 interface IP or is it just dumping it onto the wire?

Not the answer you're looking for? Browse other questions tagged or ask your own question.