NO INTERNET TRAFFIC ON LAN

johnpoz

@pamela Why do you have a gateway on your lan.. Yeah that is not going to work! And you just point it to itself? Why did you do that - pfsense all over the place warns you that this is LAN do not set a gateway..

mcury

Hi, try these steps:

1st: Fix your firewall rules, you are only allowing ICMP.
Create in LAN a rule allowing LAN_NET to ANY ports TCP 80/443 and TCP/UDP 53.

2nd: You don't need a gateway in the LAN, you can remove that.

3rd: I would also disable the outbound NAT for the LAN network and create a static route in that huawei router like this:
Route to 192.168.55.0 next hop 192.168.10.27.
Edit: It would be better to put pfsense facing WAN directly, without that router... Public IP directly in Pfsense WAN..

Pamela

@johnpoz I have removed that still problem persisits

Pamela

@mcury Problem remains the same. I have removed the gateway from LAN and also edit the rules as follows

FIREWALL RULES WAN.JPG

FIREWALL RULES 1.JPG FIREWALL RULE.JPG FIREWALL RULE LAN.JPG

And also on the router side i have created a static route in huawei router as mentioned

Router version.JPG STATIC ROUTE.JPG DHCP ON ROUTER.JPG

When i ping the traffic routed as mentioned in following screen shots

It is replying but not opening the website.

johnpoz

@pamela that setup makes no sense.. I highly doubt your Huawei is going to nat your downstream 192.168.55 network.

There is no need to add that route on that router, and you should let pfsense nat to its wan IP.

mcury

@johnpoz said in NO INTERNET TRAFFIC ON LAN:

@pamela that setup makes no sense.. I highly doubt your Huawei is going to nat your downstream 192.168.55 network.

There is no need to add that route on that router, and you should let pfsense nat to its wan IP.

She is behind a double nat, which is not desirable.
If she disables the NAT in pfsense, she will reach the Huawei router with a source IP of the 192.168.55.0/24 network.
The Huawei router won't know how to route back the packet, and it will send it through the default route, which is WAN.
That is why I told her to create a static route, so the Huawei router knows that the 192.168.55.0 is behind the LAN interface.

mcury

@pamela br0 is the WAN interface? Try changing that to the LAN interface of the Huawei router.

johnpoz

@mcury said in NO INTERNET TRAFFIC ON LAN:

which is not desirable.

But works.. triple nat, quadruple nat also works, etc.. I find it highly unlikely that router she has at the edge will do natting of downstream networks..

I would highly suggest just getting it to work with the double nat, before attempting anything else.. Pfsense should just like any other client connected to that router.. If after that works they want to play with removing the double nat.. Great but out of the box just plugging in pfsense should work, as long as the pfsense lan and wan are not overlapping networks.

mcury

@johnpoz said in NO INTERNET TRAFFIC ON LAN:

I find it highly unlikely that router she has at the edge will do natting of downstream networks..

Hm, I didn't take that in consideration.. Its most likely won't have that option..
You are right, better to keep the double nat, then in case she needs in the future, work to remove it..

So Pamela, sorry for giving you that 3rd step instruction, better to remove the static route from Huawei router, and leave the NAT enabled at the pfsense side.. Should work..

stephenw10

Yes there appears to be no default gateway set.
As others have suggested, remove the LAN gateway.
Set the default v4 gateway to WAN instead of automatic.

Steve