Verizon CR200a in ip passthrough?
-
@stephenw10 said in Verizon CR200a in ip passthrough?:
I expect them to be passed to pfSense over DHCP or PPPOE when they connect. That wouldn't happen if your WANs are both statically assigned?
So they should be automatically assigned by the ISP(s)? Is there any way for me to check?
-
You should see them in Status > Interfaces on the WANs like:
However this should wok fine with only the local resolver. The only reason it may not is because that will use the default route to reach the root servers and that has now changed to WAN2.
-
@stephenw10 Weird, no mention of DNS on either WAN.
I'm not sure I quite follow your 2nd statement. Are you saying it's trying to use the DNS servers from my original WAN, but it's connecting through the new Verizon WAN, and getting confused?
-
Well that's odd that neither DHCP server passes any DNS server to use but that shouldn't cause an issue by itself.
The DNS resolver (Unbound) should always work. But what may have changed here is that traffic from Unbound is now using WAN2.
So one thing you can try is setting the outbound interface Unbound is using using in Services > DNS Resolver. If you set that to WAN (DSL) instead of all that puts the system back in the same conditions it was before adding the second WAN. The test host being routed via DSL should work as before at that point.
-
@stephenw10 I'll give that a try, thanks. Would you suggest leaving the routing rule in place, or removing it temporarily while testing the DNS thing?
If I leave it in please, I'm thinking we won't know which one is fixing the trouble, since everything is working fine right now, with the rule active...
Is that wrong? -
I would leave the rule in place initially.
If moving the outgoing DNS to the old WAN appears to fix things then try disabling to the policy routing rule and see if it's still good. I doubt it will though TBH
-
@stephenw10 said in Verizon CR200a in ip passthrough?:
If you set that to WAN (DSL) instead of all
OK, done.
Confirmed that with the policy routing rule in place, all works fine.
With that rule removed, youtube is instantly broken again.
I'm a little confused about what the DNS change tells us, since things are working fine with only the policy rule, and break without it.
Is any of this informing you of what the issue may be? -
Oh, I'm sorry too many threads! I got confused there.
Ok, then with the DNS moved to the DSL WAN does the problem still return if you disable the policy rule? Or just test from a different host that isn't using the rule?
-
@stephenw10 said in Verizon CR200a in ip passthrough?:
with the DNS moved to the DSL WAN does the problem still return if you disable the policy rule? Or just test from a different host that isn't using the rule?
So I learned something last night.
With the policy rule in place (only affecting my Desktop PC of course) and the outgoing DNS resolver set to WAN only, everything works fine on my machine.
However, my wife was trying to watch a video on a site for work (not youtube), and it would not play on her Desktop or her iPad until I changed the default gateway under System->Routing back to WAN (dsl), then it worked fine again.
There definitely appears to be some issue with the Verizon WAN and certain video streaming services. -
@Elmojo said in Verizon CR200a in ip passthrough?:
There definitely appears to be some issue with the Verizon WAN and certain video streaming services.
Yet when you connected a host to the Verizon modem directly it worked fine? It only fails like that when routed via pfSense?
-
@stephenw10 said in Verizon CR200a in ip passthrough?:
Yet when you connected a host to the Verizon modem directly it worked fine? It only fails like that when routed via pfSense?
You know, at this point I can't even recall. lol
I know we tested that earlier. It must be buried somewhere in this thread...
Ok, So I see back around post #32 where you asked me to check that, but I don't see a clear response from me as to whether I actually was able to test it that way or not. I'll check that and get back to you. -
@stephenw10 said in Verizon CR200a in ip passthrough?:
Yet when you connected a host to the Verizon modem directly it worked fine?
Short answer = yes
The Verizon gateway has 2 LAN ports. One is for "normal traffic", the other is for "admin". When I connect directly to the Verizon gateway via LAN port 1, I get IP 192.168.1.2, and I can log into the gateway UI to do admin stuff, but I have no internet access.
If I use LAN port 2 (which is the one that normally would be connected to the pfsense box), then I get an external IP, and everything (including YouTube) works fine.It does indeed seem to be something o do with pfsense, or perhaps some other aspect of my network infrastructure, although I can't imagine what else it would be.
The topology is as follows:
Verizon gateway -> Cat5e -> pfsense Verizon WAN interface (igb2)
Leaving pfsense via LAN interface (igb1) -> Cat5e -> TP-Link managed Gb switch -> rest of home networkAny of that look fishy to you?
-
@Elmojo said in Verizon CR200a in ip passthrough?:
Any of that look fishy to you?
Not beyond the fact it seems to be not passing traffic correctly.
It's odd that it would be streaming traffic like that. How exactly does it fail?
Some sites failing like that is usually either some subnet conflict, like an interface incorrectly configured as /8 or similar. Or an MTU issue when large packets fail to pass:
https://docs.netgate.com/pfsense/en/latest/troubleshooting/website-access-issues.htmlThe other common issue is IPv6 failing and some devices preferring and therefore trying to use it. But we checked that. And also that usually presents as sites initially failing to load but then eventually loading.
Is there a site you've found that fails to load entirely? That would be much more convenient for troubleshooting.
-
@stephenw10 said in Verizon CR200a in ip passthrough?:
It's odd that it would be streaming traffic like that. How exactly does it fail?
The site itself loads fine, but when I actually request a video to play, it just buffers forever. Every now and then, if I leave it long enough, one might play, but it defaults to the lowest (144p) resolution. However, once it actually starts, I can choose any resolution I want, and it plays fine. I can skip around, and it keeps up without issue. I appears to be the initial loading that presents the trouble.
@stephenw10 said in Verizon CR200a in ip passthrough?:
Is there a site you've found that fails to load entirely?
Unfortunately, no. Actual web sites all appear to load fine. Granted, I tend to visit many of the same sites, like most folks. Are you aware of a site that's more 'challenging', or one that may be designed to test the capabilities of a browser or connection? Something like that may be useful in diagnosing this gremlin.
-
Not really. It feels like something being blocked so it has to fall back to some lesser connection type though. Hmm.
If you could find something that fails completely we could look for those connections specifically to see why they are failing. That's far harder with random streams.
I assume there is still nothing shown blocked in the firewall log?
-
@stephenw10 Thanks so much for all your time and patience, but I finally admitted defeat and gave up. I canceled the Verizon service today and will be returning the gateway device shortly.
I'd love to track down the gremlins and eventually switch away from my horrible DSL provider, but the trial I was on was about to expire, and I was out of time to screw with it for now.
Maybe one day I'll try it again, possibly with T-Mobile home internet, which I think it also in my area. I've heard they will be making it easier to 'bridge' their gateway device soon, so that might be an option.
I really do appreciate all your help, sorry we couldn't come up with a real solution!
