Clientlan not able to reach WAN Gateway

toddehb

It is set to manual mode. Don't ask me why IP did not change. WAN is on DHCP. After Reset of Fritz Box the Wan interface could have gotten a different IP, cause the default Net of the Fritz Box is not what I am using. Could that make pfsense to forget about NAT entries?

johnpoz

@toddehb if it didn't get the same IP as before that could of been issue sure. So did you switch back to automatic?

The most common reason people are manual is they followed some vpn guide that said to do that - when its not needed at all, all that is needed for a vpn is hybrid and set a outbound nat for your vpn.

toddehb

@johnpoz

you are right, I read a Wireguard guide suggesting to switch to manual. Is it save to go back to auto or maybe hybrid without loosing current settings?

johnpoz

@toddehb switch to auto, make sure normal works. Then switch to hybrid create whatever nat you want/need for wireguard in the hybrid

Delete all your settings, switch back to auto normally leaves them

https://docs.netgate.com/pfsense/en/latest/recipes/wireguard-client.html#outbound-nat

That looks to be instructions for wireguard..

toddehb

@johnpoz

thanks. I will do so.

viragomann

@toddehb said in Clientlan not able to reach WAN Gateway:

you are right, I read a Wireguard guide suggesting to switch to manual

I'm wondering, why this stupid tuts are suggesting to set the outbound NAT to manual again and again over the years.
I bet, the writer even cannot answer this question.

johnpoz

@viragomann most of those of guides are clearly written by someone that doesn't actually understand what they are doing..

from the nord 2.5 pfsense guide

That is the default web cert that pfsense creates for self signed for you to access the web gui... It sure and F is not a client cert you should use to connect to a vpn.. So clearly they are not using client certs - so the guide should say set that to none

This is from my client connection to a vps of mine I run for demo purposes in helping people here with client vpn setups, etc. I use the ns1 cert that is the actual client cert. But if your not going to actually use a cert to auth, which clearly your web gui self signed cert is not going to auth to some vpn service on the internet - then it should be set to none.

Every single guide I have read over by these vpn services are pretty lame to be honest..

viragomann

@johnpoz
Omg. That's really bad!

So clearly they are not using client certs - so the guide should say set that to none

Agree. If they would check the certs you would never get a connection. ^^

johnpoz

@viragomann Eveyone I have ever looked horrible.. I would never in a million years send traffic to any of these services - they can't even write a doc that makes any sense.. They hand it off to the intern most likely who copies it from somewhere else not understanding what any of it does..

stephenw10

@viragomann said in Clientlan not able to reach WAN Gateway:

I'm wondering, why this stupid tuts are suggesting to set the outbound NAT to manual again and again over the years.

They do that specifically to prevent LAN traffic leaving the WAN outside the VPN. Because persuading users that unencrypted traffic there is somehow unsafe and must all be sent via them is their business model. It also gets me that they use the term 'kill switch' for that.

johnpoz

@stephenw10 but it doesn't look at the stupid nord guide, it has you switch to manual and create nord output nat, but it doesn't have you delete the normal wan nats.. So it wouldn't stop normal traffic from leaving out your normal wan..

If they had you delete all the outbound other than the nord, ok that could be their business model or goal. But from the guides I havve seen they just don't have a clue what hybrid does, etc.

And they say to delete all the IPv6 outbound nat rules - WTF???

Why anyone would actually trust moving data through these people is beyond me..

maybe typo with ipv6 and they meant all rules? But then they show you what your outbound nat should look like

They are all bad - have looked at all the so called major players in this vpn space - they are just horrible without a clue to what the F they are trying to even accomplish..

stephenw10

I mean.... I'm pretty sure that's what they are trying to do. But that doesn't rule out ineptitude!
Hanlon's razor may apply.