Netgate SG-1100 LAN in bridge mode with a router no internet
-
@stephenw10 Forgot to mention that my TP-Link can be set in AP mode if that helps
-
NATing at each router is ugly but should work fine for almost everything.
So if the 1100 itself can ping out to any site but things behind it cannot that implies an outbound NAT issue. Check the config in Firewall > NAT > Outbound. It should be in automatic mode (the default) and you should see automatic rules on the WAN interface shown.
Steve
-
Yeah the ideal scenario is only one NAT between clients and the internet. So that would mean the TP-link in AP mode and the ISP router in modem mode with the 1100 running the PPPoE session. But that can wait until you have it running as it is.
-
@stephenw10 said in Netgate SG-1100 LAN in bridge mode with a router no internet:
Check the config in Firewall > NAT > Outbound. It should be in automatic mode (the default) and you should see automatic rules on the WAN interface shown.
I have checked and indeed it's set in automatic mode. I have reset both Tp-link & Netgate to default factory settings. To start off from there. Funny thing is that I can communicate with Netgate through TP-link ( using Wi-fi )
-
But do you see the expected automatically created rules there for WAN?
-
@stephenw10 I see two rules automatically created. One thing that puzzles me is that when I reset the Netgate to factory settings, it still says:"current date and time 23rd of December 2021". That is really strange. That was the date I left my home for holidays.
-
Are you running a 22.01 Beta version?
The 1100 does not have a battery backed RTC so if it been de-powered and cannot connect to ntp it will show the build date.
Go to Diag > Ping. Try to ping netgate.com from the default source.
Now set the source to LAN and try again.If it can ping from default or WAN but not LAN check Diag > Routes for a default route.
Steve
-
@stephenw10 No Beta. It's running on 21.05.2-RELEASE. I have pinged netgate.com successfully from WAN & LAN as well. I have switched my TP Link to AP mode and connected LAN from the Netgate to LAN of TP LInk. No change.
-
@stephenw10 some logs if it helps:
System logs → gateways:
dpinger
58371
WAN_DHCP 192.168.2.1: sendto error: 65System logs → routing:
radvd
64557
sendmsg: Permission deniedSystem logs → DNS resolver
unbound
79031
[79031:0] info: failed to prime trust anchor -- DNSKEY rrset is not secure . DNSKEY IN -
@stephenw10 When I run a wizard after resetting the Netgate, do I need to leave DHCP as it is ( checkbox ticked something like override DHCP or something like that) Does empty DHCP fields need to remain empty by default? I saw in some tutorials ppl adding 8.8.8.8 and 8.8.4.4 with checkbox ticked override DHCP.
-
Hmm, can you try just connecting a client to the 1100 LAN directly?
Do you still have the default firewall rules on LAN? If not can we see a screenshot?
Steve
-
By default pfSense using Unbound in resolving mode directly for DNS so setting allow DHCP override should not make any difference. However that won't happen if Unbound is failing to start with that error.
Can you resolve anything from Diag > DNS Lookup?
That still wouldn't stop pings to 8.8.8.8 working.
-
@stephenw10 Yes I have it. Even if I connect directly to a client. I can't get internet even with a direct LAN connection. Obviously Netgate is blocking it.
-
@stephenw10 Yes it can resolve. I will send you all relevant screenshots if that can help.
-
@stephenw10 One more screenshot with LAN firewall rules:
-
Hmm, that looks fine. I note the dns server at 192.168.3.1 is not one of the subnets you listed above. Did the ISP router LAN change?
Start a ping from a client on the 1100 LAN to, say, 1.1.1.1. Then go to Diag > States and filter by 1.1.1.1. You should see two states. One on LAN and one on WAN with NAT applied.
Steve
-
@stephenw10 Yes I have changed it to 192.168.3.1. I have pinged 1.1.1.1 from a client and all went well. Please see below the screenshot:
-
OK, that looks correct. So what is not working here?
-
@stephenw10 We are back to square one I guess :) The Netgate LAN connection is not providing internet to a client nor to the TP-Link AP. It's possible to ping the Netgate from a client but I don't have internet. It looks like it's blocking outbound traffic but don't know where. Do you think it can be a possible hardware issue with LAN on the Netgate device? Thanks
-
@stephenw10 Is it possible to use OPT interface and connect it to TP-Link AP (WAN) and check if it works? How should I go about it?
