Netgate SG-1100 LAN in bridge mode with a router no internet
-
But do you see the expected automatically created rules there for WAN?
-
@stephenw10 I see two rules automatically created. One thing that puzzles me is that when I reset the Netgate to factory settings, it still says:"current date and time 23rd of December 2021". That is really strange. That was the date I left my home for holidays.
-
Are you running a 22.01 Beta version?
The 1100 does not have a battery backed RTC so if it been de-powered and cannot connect to ntp it will show the build date.
Go to Diag > Ping. Try to ping netgate.com from the default source.
Now set the source to LAN and try again.If it can ping from default or WAN but not LAN check Diag > Routes for a default route.
Steve
-
@stephenw10 No Beta. It's running on 21.05.2-RELEASE. I have pinged netgate.com successfully from WAN & LAN as well. I have switched my TP Link to AP mode and connected LAN from the Netgate to LAN of TP LInk. No change.
-
@stephenw10 some logs if it helps:
System logs → gateways:
dpinger
58371
WAN_DHCP 192.168.2.1: sendto error: 65System logs → routing:
radvd
64557
sendmsg: Permission deniedSystem logs → DNS resolver
unbound
79031
[79031:0] info: failed to prime trust anchor -- DNSKEY rrset is not secure . DNSKEY IN -
@stephenw10 When I run a wizard after resetting the Netgate, do I need to leave DHCP as it is ( checkbox ticked something like override DHCP or something like that) Does empty DHCP fields need to remain empty by default? I saw in some tutorials ppl adding 8.8.8.8 and 8.8.4.4 with checkbox ticked override DHCP.
-
Hmm, can you try just connecting a client to the 1100 LAN directly?
Do you still have the default firewall rules on LAN? If not can we see a screenshot?
Steve
-
By default pfSense using Unbound in resolving mode directly for DNS so setting allow DHCP override should not make any difference. However that won't happen if Unbound is failing to start with that error.
Can you resolve anything from Diag > DNS Lookup?
That still wouldn't stop pings to 8.8.8.8 working.
-
@stephenw10 Yes I have it. Even if I connect directly to a client. I can't get internet even with a direct LAN connection. Obviously Netgate is blocking it.
-
@stephenw10 Yes it can resolve. I will send you all relevant screenshots if that can help.
-
@stephenw10 One more screenshot with LAN firewall rules:
-
Hmm, that looks fine. I note the dns server at 192.168.3.1 is not one of the subnets you listed above. Did the ISP router LAN change?
Start a ping from a client on the 1100 LAN to, say, 1.1.1.1. Then go to Diag > States and filter by 1.1.1.1. You should see two states. One on LAN and one on WAN with NAT applied.
Steve
-
@stephenw10 Yes I have changed it to 192.168.3.1. I have pinged 1.1.1.1 from a client and all went well. Please see below the screenshot:
-
OK, that looks correct. So what is not working here?
-
@stephenw10 We are back to square one I guess :) The Netgate LAN connection is not providing internet to a client nor to the TP-Link AP. It's possible to ping the Netgate from a client but I don't have internet. It looks like it's blocking outbound traffic but don't know where. Do you think it can be a possible hardware issue with LAN on the Netgate device? Thanks
-
@stephenw10 Is it possible to use OPT interface and connect it to TP-Link AP (WAN) and check if it works? How should I go about it?
-
But we can see above that a client on the pfSense LAN can ping 1.1.1.1 which is a successful connection to the public internet. So what exactly is not working?
I imagine it's a DNS problem (because it's always dns!
).
If you try to ping google.com from the client I imagine that fails, what error does it give.Yes you can use OPT1. You need to:
Enable the interface and give it a new IP/subnet to use like 192.168.10.1/24
Enable a dhcp server on it in Services > DHCP Server > OPT tab.
Add a firewall rule to the OPT interface to pass all traffic, at least as a test.Steve
-
@stephenw10 It looks like LAN is working. I have rebooted it with reroot option and that did the trick. Thanks for your help :-)
-
Cool. Not sure what happened there then but I guess take the win .
