IOT VLAN not reaching internet

For this rule please enable the following option!

try again and check your firewall logs

sven72

@silence Thanks, I have restricted as suggest the first allowed rule to Thie Firewall Only (this device) and activated the logs as suggested for the blocking of DNS on this interface. I will post the result when I see something.

sven72

@silence some entries start to appear

That mass spam is actually the TV !

@sven72, Can you Publish the network configuration?

DNS servers
?

because in this logs your tv is clearly shown trying to use 8.8.8.8 as dns it is possible that this is due to a manuel dns configuration on the device or I simply configure in pfsense 8.8.8.8 as a dns server for your IOT network

sven72

@silence This is very strange ! I do not use G's DNS at all, but Quad9.
Would you mind pointing me on how to enforce that for the entire pfsense ?
And I will see on the TV where this could be "hard" coded ..?

@sven72, Ok post screenshot of System General Setup

sven72

@silence there you go

@sven72 and dhcp server ?

sven72

@silence besides the range, the rest is blank, no WINS or DNS entry, I thought the General Setup was actually doing the job for the entire appliance if not overriden..?

@sven72, Ok post capture of DHCP Server settings for interfaces

johnpoz

@sven72 said in IOT VLAN not reaching internet:

I create a VLAN that I tied up to WAN and LAN members.

Huh? Sorry but that makes zero sense. Sure you would ride a vlan on a physical interface - but it sure and the hell wouldn't be your wan, nor would it be both wan and lan..

Your rules you posted there would be problematic with out of the box config for dhcp server, since it would hand out the ip of the interface its running on as dns. Where in your rules do you allow your client to use anything other than some dns on your lan net?

But your not allowing that.. You have a block all DNS rule above where you allow any..

You would need a rule to allow your IOT vlan access to dns on IOT address if you want them to use pfsense for dns, not lan net..

The first rule on a new vlan/network your setting up is any any until you validate connectivity works.. Then you can limit to what you want to allow, etc..

@johnpoz said in IOT VLAN not reaching internet:

You would need a rule to allow your IOT vlan access to dns on IOT address if you want them to use pfsense for dns, not lan net..

Exactly.

@sven72 If you have any questions, how to do it, let me know and I will help you.

@sven72 said in IOT VLAN not reaching internet:

This is very strange ! I do not use G's DNS at all, but Quad9.

Confirm that your IOT is not using STATIC DNS, PLEASE!
.

johnpoz

What you put in pfsense general dns settings mean nothing for clients, unless you setup forwarding in unbound.

Out of the box pfsense resolves. Out of the box dhcp server will hand out its own IP for client to use.. What you set in pfsense dns general means nothing to a client. That is only what pfsense itself could use for dns.

Maybe the documentation needs to be better? Maybe the notes on the dns settings in general need to point out that these are only for pfsense use unless you setup forwarding? The term system might be confusing? ;) Or the note is too long and they are never getting to the part where it says they are used when you setup forwarding?

This seems to be a real stumbling block for new users, understanding the difference between a resolver and a forwarder seems to be where users get lost.

sven72

@silence It is not, I did not configure any, as I thought the DNS queries (and only them) would go to the firewall itself, that I thought was using the General Setup.
And I still wonder where that G DNS comes from ..?

sven72

@johnpoz said in IOT VLAN not reaching internet:

Huh? Sorry but that makes zero sense.

Maybe not the right terminology then, here is what I meant:

@johnpoz said in IOT VLAN not reaching internet:

You have a block all DNS rule above where you allow any..

Thinking process is that I would first allow all to ensure this thing is working, yes the tagging etc. makes it very cumbersome even with the manual.
Then force any DNS query onto what I thought would be the default, the General Setup, hence the conversation with Silence at the top re what is only allowed to.

@sven72 said in IOT VLAN not reaching internet:

still wonder where that G DNS comes from ..?

Can you connect your pc in this same vlan and then test?

sven72

@silence I actually now get internet access (since the change you suggested at the top, to point to This Firewall)..!
So I am now even more confused.

nameserver 127.0.0.53
options edns0 trust-ad
search home.arpa

$ dig kernel.org

; <<>> DiG 9.16.15-Ubuntu <<>> kernel.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37302
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;kernel.org.			IN	A

;; ANSWER SECTION:
kernel.org.		596	IN	A	198.145.29.83

;; Query time: 156 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: sam. janv. 08 13:21:36 HKT 2022
;; MSG SIZE  rcvd: 55

@sven72 said in IOT VLAN not reaching internet:

I am now even more confused.

Ok Publish your firewall logs again to confirm that everything is in order.

sven72

@silence well not much change there, I now suppose the TV has G's DNS hardcoded somewhere which is very annoying.
And on the TV as I could find some advanced Wi-Fi setting, the DNS points to 192.168.112.1.