Setting up new device on LAN
-
So you can ping 192.168.4.1 from devices on the pfSense LAN just not from the pfSense GUI?
-
@networkcowboy
I haven't tried this before. It didn't occur to me to try it from hosts on its LAN because it was an obvious NO since the gateway shows "offline".
But now that you mentioned it, I tried and not only can I ping 4.1 from hosts on the 192.168.1.0 LAN but I can even get websites.So why is the gateway showing "offline"?
-
I would check your rules related to ICMP because it should be working.
-
@networkcowboy
It's not just ICMP. pfSense can't do DNS lookups in Diag and it can't check for updates nor Retrieve support information on the [Netgate Services And Support] widget. It itself cannot see the gateway or anything past it, but it can NAT hosts on its LAN. -
Does the gateway IP appear in the ARP table?
Have you configured your WAN with a static IP?
-
@peterlecki
can you tell us what is in the arp table (diagnostics > arp table) ? -
@peterlecki questions:
- does the "production gateway" allow icmp?
- make sure your pfSense has outbound NAT enabled so source IP of your pings from 192.168.1.x gets translated to 192.168.4.244
- maybe production gateway blocks traffic to rfc1918 subnets? check its rules....
edit: sorry I see you answered some of these already. I would really check your outbound NAT rules, try setting to Hybrid and then save and then switch back to Automatic and save again. And check System -> Routing and make sure you have the correct gateway as your default system gateway, and monitor IP should probably be something beyond the 4.1 gateway like 1.1.1.1 or 8.8.4.4
-
@stephenw10 @f-meunier
MAC for the gateway's IP is "incomplete"? But then again, clients on the LAN get NATted to the WAN just fine. pfSense cannot reach the gateway for its own purposes but can do it on behalf of others.
-
@luckman212
NAT works fine for clients on the LAN, it's only pfSense itself that cannot see the gateway but yet can NAT clients to it just fine.I tried the gateway settings both monitor to the IP and past it but it did make a difference:
-
@peterlecki ok confused, thought you said your gateway was 192.168.4.1 - why are you blocking it out? from the wangw on the gateway tabs.
Is what pfsense show for it wangw not 192.168.4.1 and some public IP?
If pfsense was actually sending traffic to 192.168.4.1 there is no possible way it could work without a mac address... Just not possible at all..
You say clients behind pfsense work - lets see your state table please to some remote site... So for example... get a constant ping going to say 8.8.8.8, you say that works right from your clients..
In the state table list that... So example here is mine..
See where you see state on lan from my pc at 192.168.9.100 sending to 8.8.8.8 and then pfsense natting this to my wan IP (which is public IP address)..
-
This post is deleted! -
There is no NAT on those WAN states so something upstream is NATing it. Or not NATing it since there are no replies.
More importantly that's not ping traffic so where ever you're pinging from there is not going through the firewall at all.
Steve
-
8.8.8.8 does show states in UDP on port 53 but 8.8.8.8 is my primary configured DNS. Still no icmp states, though. So 8.8.4.4 is a better test you wanted to see, John.
-
Where are you running that ping? It's not passing the firewall.
-
@peterlecki yup clearly that client isn't using pfsense at all..
Do a simple traceroute, or even lets see the ipconfig /all of that box..
Clearly pfsense that you say is connect to your other router isn't - since if it was it would see the mac address. Since it can not see the mac address - there is no way anything could route through it, etc..
Your states of your wan IP trying to talk to 8.8.8.8:53 go unanswered.. Not even sure why it would create a state - if has no where to send it, ie no mac of your gateway 4.1
Still not sure why you would hide your wangw if like you say its 192.168.4.1..
-
@johnpoz @stephenw10
This was an ID10T error. I had wireless active on the client device I was testing from so of course it was accessing the internet via the normal gateway. I now noticed this after you pointed it out and turned it off. Now it no longer can access the internet. Apologies for wasting your time and energy and thank you for pointing this out.Anyway, now that I no longer complicate the situation even further with "fake news", let's get back to the issue at hand. John, blocked out in that screenshot was my real ISP gateway IP. The WANGW_TEMP was configured as the gateway for the WAN interface. So the public WANGW gateway was available but not used. Just to eliminate any potential problems, I now completely removed it:
And here are the icmp states:
-
Ok, so the states look correct but your temporary WAN gateway is not responding so the pings go nowhere.
I assume it is not in the ARP table still?So what is 192.168.4.1? How is the WAN interface connected to it?
I would not expect the public WAN gateway to be available at the same time if there is another router in between.
Steve
-
@peterlecki here is the thing if 192.168.4.1 is actually suppose to be pfsense gateway. It needs to answer arp.. If no then no there is no way its going to do anything, answer ping pass traffic nothing.
So either you do not have pfsense wan IP plugged into the correct port, or 192.168.4.1 is not the correct IP..
Your saying if you plug pfsense into this router it gets that wan IP via dhcp? But can not arp for 192.168.4.1?? You sure that is what is suppose to be used for the gateway?
If I had a router and its IP was say 192.168.4.254, I could hand out dhcp - in the 192.168.4.x network - but if I told dhcp clients 192.168.4.1 was the gateway when there is no 192.168.4.1 then no you wouldn't work couldn't arp for it..
So your saying when wifi clients are on wifi they get 192.168.4.1 as their gateway and they can ping it.. Well then seems whatever your plugging pfsense wire into isn't that..
-
4.1 does answer ARP and I can see it from PC 4.100: 192.168.4.1 70-4f-57-01-24-b0
but pfSense still shows MAC of 4.1 as "incomplete" in the ARP table.from 4.100 I can ping 4.244 and 4.1
from 4.1 I can ping 4.100 but cannot ping 4.244
so it does seem as if the wires were not correctly plugged in somewhere but 4.1 has just ONE wire going into it but only 4.100 can ping it but 4.244 cannot
-
Try swapping the wires or the ports on the switch.
There is something low level failing.
I assume you see link LEDs on the WAN port and switch?
It could be a bad NIC you could reassign the WAN to a different port.
Steve
