Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    No internet on LAN

    Scheduled Pinned Locked Moved General pfSense Questions
    72 Posts 4 Posters 12.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      rakya @rakya
      last edited by rakya

      NAT outbound rules.png WAN rules.png

      Als here are the WAN and NAT outbound rules.

      I had played around with adding a pass rule in WAN, and looked over the docs, but came up empty so deleted it as part of reverting to system generated.

      I am going AFK for abt 2 hours, thanks for your help so far!

      johnpozJ 1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator @rakya
        last edited by johnpoz

        @rakya so your rule on your lan is the default any any.. It currently shows you have a 123 states via that rule.. So it is allowing traffic..

        if your saying you can not ping say 8.8.8.8 from a client on your lan network.. its not a firewall rule blocking it - unless you have rules in floating that would? But that would not be logged a default deny, that would be logged by the rule in floating that was blocking it.

        There is nothing there that would prevent you from accessing the internet if pfsense has internet access via its wan.

        But if your wan is the same network as your lan - that would be very problematic for sure.. What is the network on your wan.. Normally this would be some public IP 1.2.3.4 for example, if its a rfc1918 address that overlaps with your lan of 192.168.1/24 then yeah your going to have a bad day..

        The only way something on your lan would be blocked by the default deny rule, is if its IP was not in the lan network.. For example if you had a device on your "lan" with and IP of say 192.168.2.x/16 while it could send traffic to pfsense on 192.168.1.1 to pfsense that IP is not part of the lan net and would not be allowed by the default rule, and would not be natted either..

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        R 1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          Yup those rules look fine and they are opening and passing traffic.

          What traffic is shown as blocked?

          1 Reply Last reply Reply Quote 0
          • R
            rakya @johnpoz
            last edited by

            @johnpoz @stephenw10 So I am able to ping 8.8.8.8 from LAN client, still no google.com does that mean the issue is DNS?

            Based on what was said abt a subnet conflict I moved my LAN IP to 192.168.0.1 (previously 192.168.1.1, which is also where my current router is, which will be converted into a switch/WAP if I am able to get pfSense working). Still not able to get through though. same ping behavior as before.

            stephenw10S 1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              Yes sounds like a DNS issue now.

              Make sure Unbound is running in Status > Services

              Try resolving something in Diag > DNS Lookup.

              R stephenw10S 2 Replies Last reply Reply Quote 0
              • R
                rakya @stephenw10
                last edited by

                @stephenw10 Unbound is running, and I found the following when doing the lookup
                DNS lookup.png
                Somehow the issue is not present in the VMs LAN interface, but both my laptop and phone are unable to connect to the internet when hooked up to the VMs LAN

                1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator @stephenw10
                  last edited by

                  @stephenw10 said in No internet on LAN:

                  Try resolving something in Diag > DNS Lookup.

                  Do that^. It will show how all the configured DNS servers are responding.

                  R 2 Replies Last reply Reply Quote 0
                  • R
                    rakya @stephenw10
                    last edited by rakya

                    This post is deleted!
                    1 Reply Last reply Reply Quote 0
                    • R
                      rakya @stephenw10
                      last edited by

                      @stephenw10 Here is the lookup
                      DNS lookup.png

                      and I also did a traceroute
                      tracroute.png

                      johnpozJ 1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator @rakya
                        last edited by

                        @rakya so what is not working.. You clearly can get to the internet if you can ping 8.8.8.8 and you can lookup something.. So what is not working?

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S
                          stephenw10 Netgate Administrator
                          last edited by

                          DNS is failing on the LAN side client.

                          So check what the client is using for DNS. It would normally be passed the pfSense LAN IP to use via DHCP but that can be ignored/overridden on the client.

                          R 1 Reply Last reply Reply Quote 0
                          • R
                            rakya @stephenw10
                            last edited by

                            @stephenw10 I did a ipconfig/all on my laptop and it seems to be saying the pfSense LAN IP is correctly set as the DHCP, and DNS provider, but i am still unable to ping google.com
                            @johnpoz in addition to being unable to ping google.com, i cannot browse the web, that is why I had believed that DNS was the issue, but am now unsure again... everything seems to be working great from within the VM, but the 2 clients I have tried are unable to navigate to anything except the webconfigurator. I will try a different ethernet cable.

                            DNS client server.png

                            R johnpozJ 2 Replies Last reply Reply Quote 0
                            • R
                              rakya @rakya
                              last edited by

                              switching cables made no difference

                              1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator @rakya
                                last edited by johnpoz

                                @rakya so can you actually do a dns query via say nslookup on your machine?

                                dns.jpg

                                Do you see your pfsense name by the address.. See how mine tells me that 192.168.9.253 (pfsense IP on my lan) that its name is sg4860.home.arpa

                                If your not seeing that - that points to not being able to talk to pfsense IP for dns, or unbound isn't even running.. What error or timeout do you see? If you get back name for pfsense with nslookup but queries for like www.google.com don't work what about asking about pfsense name.. like this

                                pfsense.jpg

                                Did you happen to mess with the acls? Pfsense will normally auto add all your local networks to the ACL of unbound to allow your local networks to query it, but if you turned that off? Under unbound / advanced near the bottom

                                unbound.jpg

                                If you did that you would have to manually create your acls, which is what I do.

                                The output of nslookup should be informative to what is going on. If you can talk to unbound for dns, etc.

                                You don't have any rules in floating do you? That could be blocking dns? But again if you had that, it wouldn't log as the default deny rule.

                                And yeah without working dns, internet not going to work ;)

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                R 1 Reply Last reply Reply Quote 0
                                • R
                                  rakya @johnpoz
                                  last edited by rakya

                                  @johnpoz Here is the output of nslookup
                                  nslookup.png
                                  however if I go to Diag/DNS lookup google.com, it works and I get a 142.x.x.x
                                  I didnt mess with the ACLs, but mine is unchecked, as opposed to your pic.
                                  I dont have any floating rules

                                  Ill be afk for a couple hours, thanks for your continued help!

                                  johnpozJ S 2 Replies Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator @rakya
                                    last edited by

                                    @rakya ok so your able to talk to unbound.. Be it responded with servfail - for some reason it says it can't look that up..

                                    Are you using anything like pfblocker?

                                    What about that youtube.com you looked up in diag.. Can it find that? Maybe your resolving isn't actually working, I would do say a dig +trace on pfsense itself..

                                    So for example on mine.

                                    [23.09.1-RELEASE][admin@sg4860.home.arpa]/root: dig www.google.com +trace
                                    
                                    ; <<>> DiG 9.18.16 <<>> www.google.com +trace
                                    ;; global options: +cmd
                                    .                       53022   IN      NS      a.root-servers.net.
                                    .                       53022   IN      NS      l.root-servers.net.
                                    .                       53022   IN      NS      m.root-servers.net.
                                    .                       53022   IN      NS      g.root-servers.net.
                                    .                       53022   IN      NS      b.root-servers.net.
                                    .                       53022   IN      NS      k.root-servers.net.
                                    .                       53022   IN      NS      j.root-servers.net.
                                    .                       53022   IN      NS      h.root-servers.net.
                                    .                       53022   IN      NS      f.root-servers.net.
                                    .                       53022   IN      NS      c.root-servers.net.
                                    .                       53022   IN      NS      e.root-servers.net.
                                    .                       53022   IN      NS      d.root-servers.net.
                                    .                       53022   IN      NS      i.root-servers.net.
                                    .                       53022   IN      RRSIG   NS 8 0 518400 20240202050000 20240120040000 30903 . CTewF1Ps34mxmQNsY2egNalTgiHJ2bgGrfl6vqIVoEDi9h0Y8SfEweK0 a7lKlksKjOBOwXIqY0zFYbavNxBWUiMgmvlxRz0cOrQIGmZKcRcm3U9M eKF0AK3ZanCAGBl9JxgiHsErlW+aE55UgKouQGW2E7HQ9+FhYpYSUXft KSn8Dh8pEfzCwKjxAF7KYY2/UeFw6iDH9EvL8YTJvqXIcmISv+mwa1U8 R6uFy/Lj/f84cU20DNDfEH2H6zNGVu+sjkCNOJhCzRgbgILTsEVC4Vix UB9JRWWEoorGusWYj6eKbVFnI1LoPX1lBdP3T7jg3ZlofihNaBlG2Aye kAsdYA==
                                    ;; Received 525 bytes from 127.0.0.1#53(127.0.0.1) in 0 ms
                                    
                                    com.                    172800  IN      NS      j.gtld-servers.net.
                                    com.                    172800  IN      NS      e.gtld-servers.net.
                                    com.                    172800  IN      NS      a.gtld-servers.net.
                                    com.                    172800  IN      NS      m.gtld-servers.net.
                                    com.                    172800  IN      NS      k.gtld-servers.net.
                                    com.                    172800  IN      NS      i.gtld-servers.net.
                                    com.                    172800  IN      NS      h.gtld-servers.net.
                                    com.                    172800  IN      NS      b.gtld-servers.net.
                                    com.                    172800  IN      NS      d.gtld-servers.net.
                                    com.                    172800  IN      NS      f.gtld-servers.net.
                                    com.                    172800  IN      NS      g.gtld-servers.net.
                                    com.                    172800  IN      NS      c.gtld-servers.net.
                                    com.                    172800  IN      NS      l.gtld-servers.net.
                                    com.                    86400   IN      DS      19718 13 2 8ACBB0CD28F41250A80A491389424D341522D946B0DA0C0291F2D3D7 71D7805A
                                    com.                    86400   IN      RRSIG   DS 8 1 86400 20240202050000 20240120040000 30903 . aM4F4/AGcBOqkGKmZBzVH+7MZ2j31PkhcTY4PhYL2JpMcj/+4VmWujq4 Dp5wFkkR/A0zjuXTkhIXL1ybVLvlC2ULXA95ER6Ci5XODkO/95Vm3ZKl ZzDgJgTOHKBcMB2YsFtUPl1U104uY9u7ekNAxl/6UJRBqKAHRC4iwX0N To0B47K2Wk0DBpax7jhYcC6l8jJ8V9THLXTA6N+xy8YxYqBwtpwjC1W0 r23G54R8fOsq7/9vewt6QUlMRtpaKIjKbiT6bz1LhonC4wmlF+E1DG5z WaDC9D+c9hImD/CQQRYxveHt53xdlUyy5HW+9/2tM8inDwYPUPo171O9 W58eEQ==
                                    ;; Received 1205 bytes from 192.33.4.12#53(c.root-servers.net) in 11 ms
                                    
                                    google.com.             172800  IN      NS      ns2.google.com.
                                    google.com.             172800  IN      NS      ns1.google.com.
                                    google.com.             172800  IN      NS      ns3.google.com.
                                    google.com.             172800  IN      NS      ns4.google.com.
                                    CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN NSEC3 1 1 0 - CK0Q2D6NI4I7EQH8NA30NS61O48UL8G5 NS SOA RRSIG DNSKEY NSEC3PARAM
                                    CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN RRSIG NSEC3 13 2 86400 20240125052629 20240118041629 4534 com. ykfYgHHugNyHP7+geKoIrJKpkbPB/yuIEn6/vtfQoY6/j1BYd6oVV31c pPSVMcC1vzyGVQtwdfwiInvV9K/ZjA==
                                    S84BKCIBC38P58340AKVNFN5KR9O59QC.com. 86400 IN NSEC3 1 1 0 - S84BR9CIB2A20L3ETR1M2415ENPP99L8 NS DS RRSIG
                                    S84BKCIBC38P58340AKVNFN5KR9O59QC.com. 86400 IN RRSIG NSEC3 13 2 86400 20240126053742 20240119042742 4534 com. nVkxHFIPFvfEgs6nZi5frFPlGUQoh5ACiLJuqYNIIrTxHinPrqbx3RTy dWhmFUF2wpZCbB13rZ3xbyHc8QRe3A==
                                    ;; Received 648 bytes from 192.31.80.30#53(d.gtld-servers.net) in 41 ms
                                    
                                    www.google.com.         300     IN      A       142.250.190.100
                                    ;; Received 59 bytes from 216.239.36.10#53(ns3.google.com) in 21 ms
                                    
                                    [23.09.1-RELEASE][admin@sg4860.home.arpa]/root: 
                                    

                                    This is how unbound would resolve whatever your looking for..

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    R 1 Reply Last reply Reply Quote 0
                                    • S
                                      SteveITS Galactic Empire @rakya
                                      last edited by

                                      @rakya If you have forwarding enabled in DNS Resolver, disable DNSSEC.

                                      Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                                      When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                                      Upvote 👍 helpful posts!

                                      johnpozJ R 2 Replies Last reply Reply Quote 1
                                      • R
                                        rakya @johnpoz
                                        last edited by rakya

                                        @johnpoz I didnt setup any pfBlocker (no idea how)
                                        also the diag DNS lookup can find youtube as well
                                        This is the result of my dig+trace
                                        dig-trace.png
                                        are you using some kind of verbose option by default?

                                        johnpozJ 1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator @SteveITS
                                          last edited by

                                          ^yup if your forwarding that could be very problematic.

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          1 Reply Last reply Reply Quote 0
                                          • R
                                            rakya @SteveITS
                                            last edited by

                                            @SteveITS @johnpoz
                                            I never setup DNSSEC, and according to Services/DNS Resolver settings I have the all the settings unchecked
                                            DNS fwding.png

                                            S 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.