No internet on LAN

stephenw10

All traffic that is not explicitly passed in pfSense is blocked by the default block rules like that.

That means it's not matching the default pass rules which exist on LAN. Those normally catch traffic from anything in the LAN subnet so that traffic is either not from the LAN subnet or the default rules have been changed perhaps. Or maybe this is a new internal interface, not actually LAN?

What is the traffic in question?

What firewall rules do you have on that interface?

rakya

@johnpoz LAN rules.png
THe "Internet Access" ones were from a tutorial but they didnt work so I disabled them

rakya

NAT outbound rules.png WAN rules.png

Als here are the WAN and NAT outbound rules.

I had played around with adding a pass rule in WAN, and looked over the docs, but came up empty so deleted it as part of reverting to system generated.

I am going AFK for abt 2 hours, thanks for your help so far!

johnpoz

@rakya so your rule on your lan is the default any any.. It currently shows you have a 123 states via that rule.. So it is allowing traffic..

if your saying you can not ping say 8.8.8.8 from a client on your lan network.. its not a firewall rule blocking it - unless you have rules in floating that would? But that would not be logged a default deny, that would be logged by the rule in floating that was blocking it.

There is nothing there that would prevent you from accessing the internet if pfsense has internet access via its wan.

But if your wan is the same network as your lan - that would be very problematic for sure.. What is the network on your wan.. Normally this would be some public IP 1.2.3.4 for example, if its a rfc1918 address that overlaps with your lan of 192.168.1/24 then yeah your going to have a bad day..

The only way something on your lan would be blocked by the default deny rule, is if its IP was not in the lan network.. For example if you had a device on your "lan" with and IP of say 192.168.2.x/16 while it could send traffic to pfsense on 192.168.1.1 to pfsense that IP is not part of the lan net and would not be allowed by the default rule, and would not be natted either..

stephenw10

Yup those rules look fine and they are opening and passing traffic.

What traffic is shown as blocked?

rakya

@johnpoz @stephenw10 So I am able to ping 8.8.8.8 from LAN client, still no google.com does that mean the issue is DNS?

Based on what was said abt a subnet conflict I moved my LAN IP to 192.168.0.1 (previously 192.168.1.1, which is also where my current router is, which will be converted into a switch/WAP if I am able to get pfSense working). Still not able to get through though. same ping behavior as before.

stephenw10

Yes sounds like a DNS issue now.

Make sure Unbound is running in Status > Services

Try resolving something in Diag > DNS Lookup.

rakya

@stephenw10 Unbound is running, and I found the following when doing the lookup
DNS lookup.png
Somehow the issue is not present in the VMs LAN interface, but both my laptop and phone are unable to connect to the internet when hooked up to the VMs LAN

stephenw10

@stephenw10 said in No internet on LAN:

Try resolving something in Diag > DNS Lookup.

Do that^. It will show how all the configured DNS servers are responding.

rakya

This post is deleted!

rakya

@stephenw10 Here is the lookup
DNS lookup.png

and I also did a traceroute

johnpoz

@rakya so what is not working.. You clearly can get to the internet if you can ping 8.8.8.8 and you can lookup something.. So what is not working?

stephenw10

DNS is failing on the LAN side client.

So check what the client is using for DNS. It would normally be passed the pfSense LAN IP to use via DHCP but that can be ignored/overridden on the client.

rakya

@stephenw10 I did a ipconfig/all on my laptop and it seems to be saying the pfSense LAN IP is correctly set as the DHCP, and DNS provider, but i am still unable to ping google.com
@johnpoz in addition to being unable to ping google.com, i cannot browse the web, that is why I had believed that DNS was the issue, but am now unsure again... everything seems to be working great from within the VM, but the 2 clients I have tried are unable to navigate to anything except the webconfigurator. I will try a different ethernet cable.

DNS client server.png

rakya

switching cables made no difference

johnpoz

@rakya so can you actually do a dns query via say nslookup on your machine?

Do you see your pfsense name by the address.. See how mine tells me that 192.168.9.253 (pfsense IP on my lan) that its name is sg4860.home.arpa

If your not seeing that - that points to not being able to talk to pfsense IP for dns, or unbound isn't even running.. What error or timeout do you see? If you get back name for pfsense with nslookup but queries for like www.google.com don't work what about asking about pfsense name.. like this

Did you happen to mess with the acls? Pfsense will normally auto add all your local networks to the ACL of unbound to allow your local networks to query it, but if you turned that off? Under unbound / advanced near the bottom

If you did that you would have to manually create your acls, which is what I do.

The output of nslookup should be informative to what is going on. If you can talk to unbound for dns, etc.

You don't have any rules in floating do you? That could be blocking dns? But again if you had that, it wouldn't log as the default deny rule.

And yeah without working dns, internet not going to work ;)

rakya

@johnpoz Here is the output of nslookup

however if I go to Diag/DNS lookup google.com, it works and I get a 142.x.x.x
I didnt mess with the ACLs, but mine is unchecked, as opposed to your pic.
I dont have any floating rules

Ill be afk for a couple hours, thanks for your continued help!

johnpoz

@rakya ok so your able to talk to unbound.. Be it responded with servfail - for some reason it says it can't look that up..

Are you using anything like pfblocker?

What about that youtube.com you looked up in diag.. Can it find that? Maybe your resolving isn't actually working, I would do say a dig +trace on pfsense itself..

So for example on mine.

[23.09.1-RELEASE][admin@sg4860.home.arpa]/root: dig www.google.com +trace

; <<>> DiG 9.18.16 <<>> www.google.com +trace
;; global options: +cmd
.                       53022   IN      NS      a.root-servers.net.
.                       53022   IN      NS      l.root-servers.net.
.                       53022   IN      NS      m.root-servers.net.
.                       53022   IN      NS      g.root-servers.net.
.                       53022   IN      NS      b.root-servers.net.
.                       53022   IN      NS      k.root-servers.net.
.                       53022   IN      NS      j.root-servers.net.
.                       53022   IN      NS      h.root-servers.net.
.                       53022   IN      NS      f.root-servers.net.
.                       53022   IN      NS      c.root-servers.net.
.                       53022   IN      NS      e.root-servers.net.
.                       53022   IN      NS      d.root-servers.net.
.                       53022   IN      NS      i.root-servers.net.
.                       53022   IN      RRSIG   NS 8 0 518400 20240202050000 20240120040000 30903 . CTewF1Ps34mxmQNsY2egNalTgiHJ2bgGrfl6vqIVoEDi9h0Y8SfEweK0 a7lKlksKjOBOwXIqY0zFYbavNxBWUiMgmvlxRz0cOrQIGmZKcRcm3U9M eKF0AK3ZanCAGBl9JxgiHsErlW+aE55UgKouQGW2E7HQ9+FhYpYSUXft KSn8Dh8pEfzCwKjxAF7KYY2/UeFw6iDH9EvL8YTJvqXIcmISv+mwa1U8 R6uFy/Lj/f84cU20DNDfEH2H6zNGVu+sjkCNOJhCzRgbgILTsEVC4Vix UB9JRWWEoorGusWYj6eKbVFnI1LoPX1lBdP3T7jg3ZlofihNaBlG2Aye kAsdYA==
;; Received 525 bytes from 127.0.0.1#53(127.0.0.1) in 0 ms

com.                    172800  IN      NS      j.gtld-servers.net.
com.                    172800  IN      NS      e.gtld-servers.net.
com.                    172800  IN      NS      a.gtld-servers.net.
com.                    172800  IN      NS      m.gtld-servers.net.
com.                    172800  IN      NS      k.gtld-servers.net.
com.                    172800  IN      NS      i.gtld-servers.net.
com.                    172800  IN      NS      h.gtld-servers.net.
com.                    172800  IN      NS      b.gtld-servers.net.
com.                    172800  IN      NS      d.gtld-servers.net.
com.                    172800  IN      NS      f.gtld-servers.net.
com.                    172800  IN      NS      g.gtld-servers.net.
com.                    172800  IN      NS      c.gtld-servers.net.
com.                    172800  IN      NS      l.gtld-servers.net.
com.                    86400   IN      DS      19718 13 2 8ACBB0CD28F41250A80A491389424D341522D946B0DA0C0291F2D3D7 71D7805A
com.                    86400   IN      RRSIG   DS 8 1 86400 20240202050000 20240120040000 30903 . aM4F4/AGcBOqkGKmZBzVH+7MZ2j31PkhcTY4PhYL2JpMcj/+4VmWujq4 Dp5wFkkR/A0zjuXTkhIXL1ybVLvlC2ULXA95ER6Ci5XODkO/95Vm3ZKl ZzDgJgTOHKBcMB2YsFtUPl1U104uY9u7ekNAxl/6UJRBqKAHRC4iwX0N To0B47K2Wk0DBpax7jhYcC6l8jJ8V9THLXTA6N+xy8YxYqBwtpwjC1W0 r23G54R8fOsq7/9vewt6QUlMRtpaKIjKbiT6bz1LhonC4wmlF+E1DG5z WaDC9D+c9hImD/CQQRYxveHt53xdlUyy5HW+9/2tM8inDwYPUPo171O9 W58eEQ==
;; Received 1205 bytes from 192.33.4.12#53(c.root-servers.net) in 11 ms

google.com.             172800  IN      NS      ns2.google.com.
google.com.             172800  IN      NS      ns1.google.com.
google.com.             172800  IN      NS      ns3.google.com.
google.com.             172800  IN      NS      ns4.google.com.
CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN NSEC3 1 1 0 - CK0Q2D6NI4I7EQH8NA30NS61O48UL8G5 NS SOA RRSIG DNSKEY NSEC3PARAM
CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN RRSIG NSEC3 13 2 86400 20240125052629 20240118041629 4534 com. ykfYgHHugNyHP7+geKoIrJKpkbPB/yuIEn6/vtfQoY6/j1BYd6oVV31c pPSVMcC1vzyGVQtwdfwiInvV9K/ZjA==
S84BKCIBC38P58340AKVNFN5KR9O59QC.com. 86400 IN NSEC3 1 1 0 - S84BR9CIB2A20L3ETR1M2415ENPP99L8 NS DS RRSIG
S84BKCIBC38P58340AKVNFN5KR9O59QC.com. 86400 IN RRSIG NSEC3 13 2 86400 20240126053742 20240119042742 4534 com. nVkxHFIPFvfEgs6nZi5frFPlGUQoh5ACiLJuqYNIIrTxHinPrqbx3RTy dWhmFUF2wpZCbB13rZ3xbyHc8QRe3A==
;; Received 648 bytes from 192.31.80.30#53(d.gtld-servers.net) in 41 ms

www.google.com.         300     IN      A       142.250.190.100
;; Received 59 bytes from 216.239.36.10#53(ns3.google.com) in 21 ms

[23.09.1-RELEASE][admin@sg4860.home.arpa]/root:

This is how unbound would resolve whatever your looking for..

SteveITS

@rakya If you have forwarding enabled in DNS Resolver, disable DNSSEC.

rakya

@johnpoz I didnt setup any pfBlocker (no idea how)
also the diag DNS lookup can find youtube as well
This is the result of my dig+trace

are you using some kind of verbose option by default?