No internet on LAN

johnpoz · Jan 20, 2024, 5:45 PM

^yup if your forwarding that could be very problematic.

rakya · Jan 20, 2024, 5:50 PM

@SteveITS @johnpoz
I never setup DNSSEC, and according to Services/DNS Resolver settings I have the all the settings unchecked

johnpoz · Jan 20, 2024, 6:02 PM

@rakya said in No internet on LAN:

are you using some kind of verbose option by default?

no.. you got something wrong there.. what you should get back from 127.0.0.1 is the root servers.


; <<>> DiG 9.18.16 <<>> www.google.com +trace
;; global options: +cmd
.                       53022   IN      NS      a.root-servers.net.
.                       53022   IN      NS      l.root-servers.net.
.                       53022   IN      NS      m.root-servers.net.
.                       53022   IN      NS      g.root-servers.net.
.                       53022   IN      NS      b.root-servers.net.
.                       53022   IN      NS      k.root-servers.net.
.                       53022   IN      NS      j.root-servers.net.
.                       53022   IN      NS      h.root-servers.net.
.                       53022   IN      NS      f.root-servers.net.
.                       53022   IN      NS      c.root-servers.net.
.                       53022   IN      NS      e.root-servers.net.
.                       53022   IN      NS      d.root-servers.net.
.                       53022   IN      NS      i.root-servers.net.
.                       53022   IN      RRSIG   NS 8 0 518400 20240202050000 20240120040000 30903 . CTewF1Ps34mxmQNsY2egNalTgiHJ2bgGrfl6vqIVoEDi9h0Y8SfEweK0 a7lKlksKjOBOwXIqY0zFYbavNxBWUiMgmvlxRz0cOrQIGmZKcRcm3U9M eKF0AK3ZanCAGBl9JxgiHsErlW+aE55UgKouQGW2E7HQ9+FhYpYSUXft KSn8Dh8pEfzCwKjxAF7KYY2/UeFw6iDH9EvL8YTJvqXIcmISv+mwa1U8 R6uFy/Lj/f84cU20DNDfEH2H6zNGVu+sjkCNOJhCzRgbgILTsEVC4Vix UB9JRWWEoorGusWYj6eKbVFnI1LoPX1lBdP3T7jg3ZlofihNaBlG2Aye kAsdYA==
;; Received 525 bytes from 127.0.0.1#53(127.0.0.1) in 0 ms

Yeah if don't know who to start talking to, its going to fail that is for sure.

Be curious what this shows

Also curious what this outputs

"unbound-control -c /var/unbound/unbound.conf lookup ."

See the dot/period at the end, this is asking hey where would you look up the root which is the .

[23.09.1-RELEASE][admin@sg4860.home.arpa]/root: unbound-control -c /var/unbound/unbound.conf lookup .
The following name servers are used for lookup of .
;rrset 49813 13 1 11 5
.       49813   IN      NS      g.root-servers.net.
.       49813   IN      NS      b.root-servers.net.
.       49813   IN      NS      k.root-servers.net.
.       49813   IN      NS      j.root-servers.net.
.       49813   IN      NS      h.root-servers.net.
.       49813   IN      NS      f.root-servers.net.
.       49813   IN      NS      c.root-servers.net.
.       49813   IN      NS      e.root-servers.net.
.       49813   IN      NS      d.root-servers.net.
.       49813   IN      NS      i.root-servers.net.
.       49813   IN      NS      a.root-servers.net.
.       49813   IN      NS      l.root-servers.net.
.       49813   IN      NS      m.root-servers.net.
.       49813   IN      RRSIG   NS 8 0 518400 20240202050000 20240120040000 30903 . CTewF1Ps34mxmQNsY2egNalTgiHJ2bgGrfl6vqIVoEDi9h0Y8SfEweK0a7lKlksKjOBOwXIqY0zFYbavNxBWUiMgmvlxRz0cOrQIGmZKcRcm3U9MeKF0AK3ZanCAGBl9JxgiHsErlW+aE55UgKouQGW2E7HQ9+FhYpYSUXftKSn8Dh8pEfzCwKjxAF7KYY2/UeFw6iDH9EvL8YTJvqXIcmISv+mwa1U8R6uFy/Lj/f84cU20DNDfEH2H6zNGVu+sjkCNOJhCzRgbgILTsEVC4VixUB9JRWWEoorGusWYj6eKbVFnI1LoPX1lBdP3T7jg3ZlofihNaBlG2AyekAsdYA== ;{id = 30903}
;rrset 49793 1 0 8 3
m.root-servers.net.     49793   IN      A       202.12.27.33
;rrset 83191 1 0 8 3
l.root-servers.net.     83191   IN      A       199.7.83.42
;rrset 83191 1 0 8 3
a.root-servers.net.     83191   IN      A       198.41.0.4
;rrset 83191 1 0 8 3
i.root-servers.net.     83191   IN      A       192.36.148.17
;rrset 83191 1 0 8 3
d.root-servers.net.     83191   IN      A       199.7.91.13
;rrset 83191 1 0 8 3
e.root-servers.net.     83191   IN      A       192.203.230.10
;rrset 83191 1 0 8 3
c.root-servers.net.     83191   IN      A       192.33.4.12
;rrset 83191 1 0 8 3
f.root-servers.net.     83191   IN      A       192.5.5.241
;rrset 83191 1 0 8 3
h.root-servers.net.     83191   IN      A       198.97.190.53
;rrset 83191 1 0 8 3
j.root-servers.net.     83191   IN      A       192.58.128.30
;rrset 83191 1 0 8 3
k.root-servers.net.     83191   IN      A       193.0.14.129
;rrset 83191 1 0 8 3
b.root-servers.net.     83191   IN      A       170.247.170.2
;rrset 83191 1 0 8 3
g.root-servers.net.     83191   IN      A       192.112.36.4
Delegation with 13 names, of which 0 can be examined to query further addresses.
It provides 13 IP addresses.
192.112.36.4            expired, rto 3613560 msec, tA 0 tAAAA 0 tother 0.
170.247.170.2           expired, rto 3613560 msec, tA 0 tAAAA 0 tother 0.
193.0.14.129            expired, rto 3613560 msec, tA 0 tAAAA 0 tother 0.
192.58.128.30           expired, rto 3613560 msec, tA 0 tAAAA 0 tother 0.
198.97.190.53           expired, rto 3613560 msec, tA 0 tAAAA 0 tother 0.
192.5.5.241             expired, rto 3613560 msec, tA 0 tAAAA 0 tother 0.
192.33.4.12             expired, rto 3613560 msec, tA 0 tAAAA 0 tother 0.
192.203.230.10          expired, rto 3613560 msec, tA 0 tAAAA 0 tother 0.
199.7.91.13             expired, rto 3613560 msec, tA 0 tAAAA 0 tother 0.
192.36.148.17           expired, rto 3613560 msec, tA 0 tAAAA 0 tother 0.
198.41.0.4              expired, rto 3613560 msec, tA 0 tAAAA 0 tother 0.
199.7.83.42             expired, rto 3613560 msec, tA 0 tAAAA 0 tother 0.
202.12.27.33            expired, rto 3613560 msec, tA 0 tAAAA 0 tother 0.
[23.09.1-RELEASE][admin@sg4860.home.arpa]/root:

In resolving mode - which is unbound default, it needs to know where to go ask (the roots) to start the process.. If it can't or doesn't know where to go for the roots, then yeah any resolving will fail..

SteveITS · Jan 20, 2024, 6:27 PM

@rakya Out of the box it should just work implying something changed. Can you compare an earlier config file? There’s a recent history : https://docs.netgate.com/pfsense/en/latest/backup/restore.html#restoring-from-the-config-history

Or post your Resolver page(s).

johnpoz · Jan 20, 2024, 7:45 PM

@SteveITS said in No internet on LAN:

Or post your Resolver page(s).

really more interested in seeing the output of

"unbound-control -c /var/unbound/unbound.conf lookup ."

that trace should of shown the roots.. why it isn't if in resolving mode would explain why dns is not working.. If in forwarding mode it would show where to forward.. For example I switched it to forward mode, but didn't put in anything forward, it showed error.

I then setup up to forward to 9.9.9.9, so the output of the above cmd shows that

So if unbound is trying to forward, where you forward should be in that output, if your resolve, then the roots should be in there. If there is nothing then no its never going to work.

rakya · Jan 20, 2024, 9:50 PM

@johnpoz @SteveITS
Here is my DNS resolver Status page (is this what you meant by Resolver page(s)?)

This is the result of unbound-control -c /var/unbound/unbound.conf lookup .

so it looks like it has no clue who to talk to, but then why is the Diag/DNS lookup able to get proper addresses? Also is there a way to investigate further on what are the "configured roots"?

In terms of earlier configs, here is a diff file for as far back as the system goes (9 days)
jan20_pfSense-total.diff

SteveITS · Jan 20, 2024, 10:14 PM

@rakya I meant, all the settings :)

rakya · Jan 20, 2024, 10:33 PM

@SteveITS
ok here are the general setting

rakya · Jan 20, 2024, 10:38 PM

@SteveITS
Here are the advanced settings

The access list is empty

johnpoz · Jan 21, 2024, 3:58 AM

@rakya said in No internet on LAN:

The access list is empty

it would be if your doing auto, if you had no acls set.. Then you wouldn't even get back pfsense name when you did a nslookup, and your query would come back refused.

for example.. I disabled my acl that allows my machine network to talk to unbound.. and you see.

Something is very odd... I fired up my 2.7.2 vm to see if something is different with that command on it vs my + version..

You got something really funky going on that is for sure.

edit: when was the last time you restarted unbound? Could you try restarting it.. You for sure should see roots listed there..

rakya · Jan 21, 2024, 3:59 AM

@johnpoz I restarted unbound from the webgui, but still seeing the same behavior with the unbound-control -c /var/unbound/unbound.conf lookup . command, and the same ping behavior.

should I try to reinstall? or should I look into adding custom ACLs, like you did?

johnpoz · Jan 21, 2024, 5:18 AM

@rakya the acl would have zero to do with you not seeing the roots with that above command.

At the moment I am at a loss to what could cause that to be honest.

I removed all acls - and I can still query for the roots..

Since I am at a loss to what to try, a clean install sure couldn't hurt, I mean its not working now..

stephenw10 · Jan 21, 2024, 8:49 PM

I would try disabling dnssec in Unbound. It may have failed to pull in the valid keys at first boot because of the original subnet conflict. Though I would have expected it to do so on subsequent reboots. And to be logging an error somewhere.

rakya · Jan 22, 2024, 4:38 AM

@johnpoz @stephenw10
Unfortunately I did not take a snapshot, because I have tried multiple times to reinstall, and am completely unable to get a WAN address from the installer, as well as multiple attempts to assign the interfaces , and the set interface IPs

THis happened last time, but eventaully I was able to get to a promt that told me to ensure the WAN link was up/plugged-in and press enter, then did the same for LAN, and that was how I was able to get an address for both WAN/LAN

currently I cant even get to the web configurator when connected to the LAN

johnpoz · Jan 22, 2024, 10:38 AM

@rakya well your not going to be able get anywhere without a wan ip.. If your wan is 192.168.1 your going to need to change your lan IP when you first set it up.

rakya · Jan 23, 2024, 12:39 AM

@johnpoz @SteveITS
Any ideas on how to work the install to see why I am not getting a WAN address?
If I plug the same cable that I am trying to (and was previously successful) use as a WAN connection into my laptop or phone, I am immediately connected to my buildings LAN -
Which Im not keen on since I was able to confirm I can Wireshark my neighbors traffic from my parking lot!
I dont know if that LAN/WAN introduces a subnet conflict, as @stephenw10 thought in the first reply 3 days ago... Any thoughts?

johnpoz · Jan 23, 2024, 1:01 AM

@rakya if you can not get a IP your wan, its never going to work.. But your lan and wan can not overlap if you want connectivity to work.. When you install pfsense you can set the IP on the lan to something other than the 192.168.1 network..

What is this wan connectivity exactly..

I was able to confirm I can Wireshark my neighbors traffic from my parking lot!

Huh?

stephenw10 · Jan 23, 2024, 12:59 AM

@rakya said in No internet on LAN:

I moved my LAN IP to 192.168.0.1

Do that again. At least as a test. If there is a conflict between WAN and LAN it will always fail.

rakya · Jan 23, 2024, 1:06 AM

@johnpoz
I'm an idiot and didn't realize the interfaces on the NIC cards were reversed in software from my last install. I have a WAN now, and I have a totally stock installation, but I am seeing the same ping behavior as before.
I can ping 8.8.8.8, but not google.com
nslookup cannot find www.google.com

I also see the same reply to unbound-control -c /var/unbound/unbound.conf lookup .

The following name servers are used for lookup of .
no delegation from cache; goes to configured roots

stephenw10 · Jan 23, 2024, 1:04 AM

Something upstream blocking DNS maybe?

We previously saw that pfSense can resolve against the server passed by the upstream router. Can it resolve against anything else:

[2.7.2-RELEASE][admin@t70.stevew.lan]/root: dig +short @8.8.8.8 google.com
172.217.16.238