Netgate SG-1100 LAN in bridge mode with a router no internet
-
There are a number of things that could be happening here but, yes, a subnet conflict is most likely.
What subnets are you using here on the LAN of each of your three routers?You are probably triple NATing unless you have set either of the other devices into bridge or access point mode which is generally bad but should not prevent outgoing connections.
Ideally the router you're using for WIFI should be set in access point mode. If it doesn't have one then you can do this: https://docs.netgate.com/pfsense/en/latest/recipes/external-wireless-router.html#turning-a-wireless-router-into-an-access-point
And the ISP router should be in bridge or modem mode so that the public IP is passed to the pfSense WAN directly. Many ISP devices do not allow that however.
Steve
-
@stephenw10 said in Netgate SG-1100 LAN in bridge mode with a router no internet:
https://docs.netgate.com/pfsense/en/latest/recipes/external-wireless-router.html#turning-a-wireless-router-into-an-access-point
this is where i can set my pfsense into an access point? but i dont need / have wifi.
seems the instructions are not easy to follow & made for experts, can anyone else explain some of the steps? -
@flowermoron said in Netgate SG-1100 LAN in bridge mode with a router no internet:
this is where i can set my pfsense into an access point? but i dont need / have wifi.
No. You need wifi hardware to use pfSense as a wifi access point. But it makes a bad access point anyway.
But if you don't need wifi why are you trying to make pfSense into an AP?This seems unrelated to your issue in which you're trying to use pfSense as a VPN router.
Steve
-
@stephenw10 said in Netgate SG-1100 LAN in bridge mode with a router no internet:
You need wifi hardware to use pfSense as a wifi access point. But it makes a bad access point anyway.
thanks, that's all i needed to know.
-
@stephenw10 Thanks Steve for your reply. Please see below:
ISP modem/router (xDSL using PPPoE with username and password)
192.168.2.1
255.255.255.0Netgate SG-1100
192.168.1.1/24TP-Link
192.168.0.1
255.255.255.0I can reset and configure TP-link and Netgate but I'm not sure if I can re-configure my ISP modem. As you mentioned often they don't allow it.
Any idea how the above-mentioned set up can be configured differently? I can assign different IP addresses and subnet masks in all 3 devices. It's awful design I'm completely aware of, but just trying to make it work :)
Thanks for your support,
Mike
-
@stephenw10 Forgot to mention that my TP-Link can be set in AP mode if that helps
-
NATing at each router is ugly but should work fine for almost everything.
So if the 1100 itself can ping out to any site but things behind it cannot that implies an outbound NAT issue. Check the config in Firewall > NAT > Outbound. It should be in automatic mode (the default) and you should see automatic rules on the WAN interface shown.
Steve
-
Yeah the ideal scenario is only one NAT between clients and the internet. So that would mean the TP-link in AP mode and the ISP router in modem mode with the 1100 running the PPPoE session. But that can wait until you have it running as it is.
-
@stephenw10 said in Netgate SG-1100 LAN in bridge mode with a router no internet:
Check the config in Firewall > NAT > Outbound. It should be in automatic mode (the default) and you should see automatic rules on the WAN interface shown.
I have checked and indeed it's set in automatic mode. I have reset both Tp-link & Netgate to default factory settings. To start off from there. Funny thing is that I can communicate with Netgate through TP-link ( using Wi-fi )
-
But do you see the expected automatically created rules there for WAN?
-
@stephenw10 I see two rules automatically created. One thing that puzzles me is that when I reset the Netgate to factory settings, it still says:"current date and time 23rd of December 2021". That is really strange. That was the date I left my home for holidays.
-
Are you running a 22.01 Beta version?
The 1100 does not have a battery backed RTC so if it been de-powered and cannot connect to ntp it will show the build date.
Go to Diag > Ping. Try to ping netgate.com from the default source.
Now set the source to LAN and try again.If it can ping from default or WAN but not LAN check Diag > Routes for a default route.
Steve
-
@stephenw10 No Beta. It's running on 21.05.2-RELEASE. I have pinged netgate.com successfully from WAN & LAN as well. I have switched my TP Link to AP mode and connected LAN from the Netgate to LAN of TP LInk. No change.
-
@stephenw10 some logs if it helps:
System logs → gateways:
dpinger
58371
WAN_DHCP 192.168.2.1: sendto error: 65System logs → routing:
radvd
64557
sendmsg: Permission deniedSystem logs → DNS resolver
unbound
79031
[79031:0] info: failed to prime trust anchor -- DNSKEY rrset is not secure . DNSKEY IN -
@stephenw10 When I run a wizard after resetting the Netgate, do I need to leave DHCP as it is ( checkbox ticked something like override DHCP or something like that) Does empty DHCP fields need to remain empty by default? I saw in some tutorials ppl adding 8.8.8.8 and 8.8.4.4 with checkbox ticked override DHCP.
-
Hmm, can you try just connecting a client to the 1100 LAN directly?
Do you still have the default firewall rules on LAN? If not can we see a screenshot?
Steve
-
By default pfSense using Unbound in resolving mode directly for DNS so setting allow DHCP override should not make any difference. However that won't happen if Unbound is failing to start with that error.
Can you resolve anything from Diag > DNS Lookup?
That still wouldn't stop pings to 8.8.8.8 working.
-
@stephenw10 Yes I have it. Even if I connect directly to a client. I can't get internet even with a direct LAN connection. Obviously Netgate is blocking it.
-
@stephenw10 Yes it can resolve. I will send you all relevant screenshots if that can help.
-
@stephenw10 One more screenshot with LAN firewall rules:
