Starlink with SG6100

xineo

@steveits From the Diagnostics menu I can ping 1.1.1.1 from the WAN but the LAN side fails. I can ping anything on the LAN side from the LAN interface just nothing WAN Facing.

SteveITS

@xineo How far does a traceroute from LAN get?

Is NAT outbound set to automatic?

xineo

@steveits it is.

stephenw10

And do you see an auto outbound NAT rule created for 10.5.11.0/24 on the WAN?

Is your WAN using DHCP to get it's address from the Starlink router?

xineo

@stephenw10 Yes, wan is using DHCP and is pulling an ip address of 192.168.1.81 from Starlink, since that's a private I made sure to turn off "Block Private Networks and Loopback Addresses".

pfsense is getting the Automatic NAT Rules for WAN. I will be back at the site today to try some more things.

SteveITS

@xineo said in Starlink with SG6100:

I made sure to turn off "Block Private Networks and Loopback Addresses".

Just for reference that affects inbound traffic on WAN so wouldn't affect outbound, getting a DHCP address, accessing the Starlink router IP, etc.

Did you try the traceroute?

Out of the box it should just work in this config.

xineo

@stephenw10
@SteveITS
I'm at the site and went over the config again, everything looks good until I went into the firewall logs and saw this block coming from my address.

Jan 11 10:36:05 LAN Default deny rule IPv4 (1000000103)

That's really strange because I have a Top Level 'Any Any' Rule on the LAN Interface so nothing should be getting blocked.

It's also blocking Locals on WAN despite having that turned off.

photomankc

Those blocks with PA and FPA look like some type of traffic that got sent after the firewall had already closed the stateful connection out in its table. It happens sometimes. Or maybe a connection that was dormant too long and the state entry timed out. Probably not really a blocked connection.

stephenw10

Those are all TCP ACK packets so they are blocked either because the state has already closed or because you have some asymmetric routing:
https://docs.netgate.com/pfsense/en/latest/troubleshooting/log-filter-blocked.html

What do you see blocked on WAN?

xineo

@stephenw10 Issue turned out to be a Traffic Shaper that I didn't realize was setup. Thank you all for your help.