Verizon CR200a in ip passthrough?
-
@stephenw10 said in Verizon CR200a in ip passthrough?:
But I would try adding a policy routing rule for your desktop source IP on LAN via the other WAN
I love how you toss that out like I have any idea what that means, or how to do it.
-
Well I try not to make it too easy!
But basically add a firewall rule on the LAN above the default pass rule that matches only you test host as source Then on that rule set the old WAN gateway specifically.
https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html
-
Like:
-
@stephenw10 One thing you didn't mention... is this a pass or block rule? Am I trying to allow all traffic specifically from the old DSL WAN, or block it? I'm not clear on the point of this rule, sorry. If I set the WANDHCP (DSL) back to the default routing gateway, then everything works, including YT and my ZeroTier link. If I disable that gateway and use the Verizon one, things go awry. Can you please clarify what this test will tell us? I'm going it now, I just don't fully follow...
-
It's a pass rule. The green tick in the table indicates it's pass.
You are trying to send traffic from only your test desktop machine via the old WAN, whilst all other traffic from LAN hosts uses the default gateway which is the new WAN.
Then if youtube starts working we know it's somehow because of the new WAN. Or the routing to it.
-
@stephenw10 Oh, Duh. I missed the green check.
So while running this rule, I need to have the Verizon gateway set back as default then?EDIT: Confirmed. With the rule in place, and the Verizon gateway set as default, my desktop works...sorta. Youtube videos play, but my ZeroTier tunnel is still broken. I suspect because maybe it's not TCP traffic?
On my wife's desktop, YT does not work, as expected. -
The rule should route all traffic unless you specifically set it for TCP only.
Interesting. Do you see any unexpected blocked traffic in the firewall logs?
-
@stephenw10 Your example showed TCP only, and that's the default, so I assumed that was the correct option. Should I change it to "any"?
@stephenw10 said in Verizon CR200a in ip passthrough?:
Do you see any unexpected blocked traffic in the firewall logs?
I guess it depends on what you mean by 'unexpected'. I have no idea I'm looking at, so it's all unexpected to me. lol
Seriously, though, I have to revert my settings to default back to the DSL between messages, so that my whole network isn't unusable and my wife kills me. ;)
Let me go try it an see what happens and I'll post a screenshot. You can tell me what you see... -
@stephenw10 said in Verizon CR200a in ip passthrough?:
Do you see any unexpected blocked traffic in the firewall logs?
This does look suspicious. It appears to pop up when I attempt to open a ZeroTier session.
I know my IP is visible. There are just too many to redact. :/
-
@Elmojo said in Verizon CR200a in ip passthrough?:
Your example showed TCP only,
Doh! So it did. Yeah set that to any protocol and retest.
-
@stephenw10 I did. The image above is with it set to "any".
-
Ok does Zerotier work now?
Nothing in that log looks unexpected. Though you are logging passed traffic on LAN so that is most of the log. Try filtering it by only blocked traffic. Anything blocked on LAN or blocked outbound would be unexpected.
-
@stephenw10 said in Verizon CR200a in ip passthrough?:
Anything blocked on LAN or blocked outbound would be unexpected.
So sorry for the long delay. I was out of town over the weekend.
Yeah, I don't see anything blocked on LAN or outbound, but youtube still isn't working on Verizon.
I've added an easyrule for a certain port I saw popping up when I tried to access ZeroTier, and now that's kinda working, but not as smooth or quickly as it does on the DSL.
Here's a new log, with a 'block' filter applied. Looks like a lot of blocked incoming traffic to me, given the short time span shown, and the fact that I'm not actively doing anything at the time, but maybe that's normal these days?
I just can't figure what would be causing these roadblocks, but I won't be able to keep Verizon as my ISP if it's going to cause issues with certain services and sites.
-
Hmm, so with the policy routing rule sending al traffic from the test host via the DSL WAN you are still seeing some issues connecting from that?
-
@stephenw10 said in Verizon CR200a in ip passthrough?:
Hmm, so with the policy routing rule sending al traffic from the test host via the DSL WAN you are still seeing some issues connecting from that?
@Elmojo said in Verizon CR200a in ip passthrough?:
With the rule in place, and the Verizon gateway set as default, my desktop works...sorta. Youtube videos play, but my ZeroTier tunnel is still broken
No, if I enable that policy routing rule, then my desktop mostly works. But that's just a temporary test, since the idea is for eventually the DSL WAN to go away, and only to have the Verizon WAN.
It appears that whatever the issue is, it's some sort of conflict between the Verizon ISP and the configuration of my desktop. I just can't imagine what it would be. I've tried changing my DNS servers back to defaults, turning my software firewall off, and even disabling my antivirus temporarily. None of it makes any difference.
-
Right. But that fact that test host doesn't work it did before even when it's traffic is routed via DSL implies the problem could be due to the existence of the dual WANs rather than which WAN it's using.
For example if the DNS is broken because that is all going via WAN2.
You see all configured DBS servers responding in Diag > DNS Lookup still though?
-
@stephenw10 said in Verizon CR200a in ip passthrough?:
For example if the DNS is broken because that is all going via WAN2.
WAN2 being the new Verizon ISP?
I'm not sure what exactly I'm seeing when I perform a DNS lookup. This looks weird to me. Does it look correct to you?
I mean, should I be seeing the localhost address under the name server?
-
Yes localhost is the default. That means the system queries Unbound running locally.
The slightly odd thing there is that there are no other DNS servers set. Usually servers would be passed to the system from the ISP when the WAN connects via DHCP or PPPoE. So in your case I'd expect to that from both WANs.
-
@stephenw10 Where would you expect the DNS servers to be set? Is that something that I would have config'd in unraid, in pfsense, or on an individual machine? I am running specific DNS servers on my desktop (adguard for ad blocking), but I don't recall setting anything special anywhere else. If I was ever asked to specify DNS servers, it would have been either Google (8.8.8.8/8.8.4.4) or maybe Cloudflare (1.1.1.1).
-
I expect them to be passed to pfSense over DHCP or PPPOE when they connect. That wouldn't happen if your WANs are both statically assigned?
