Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Verizon CR200a in ip passthrough?

    General pfSense Questions
    2
    74
    4.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S
      stephenw10 Netgate Administrator
      last edited by

      Well that's odd that neither DHCP server passes any DNS server to use but that shouldn't cause an issue by itself.

      The DNS resolver (Unbound) should always work. But what may have changed here is that traffic from Unbound is now using WAN2.

      So one thing you can try is setting the outbound interface Unbound is using using in Services > DNS Resolver. If you set that to WAN (DSL) instead of all that puts the system back in the same conditions it was before adding the second WAN. The test host being routed via DSL should work as before at that point.

      E 2 Replies Last reply Reply Quote 1
      • E
        Elmojo @stephenw10
        last edited by

        @stephenw10 I'll give that a try, thanks. Would you suggest leaving the routing rule in place, or removing it temporarily while testing the DNS thing?
        If I leave it in please, I'm thinking we won't know which one is fixing the trouble, since everything is working fine right now, with the rule active...
        Is that wrong?

        1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          I would leave the rule in place initially.

          If moving the outgoing DNS to the old WAN appears to fix things then try disabling to the policy routing rule and see if it's still good. I doubt it will though TBH

          1 Reply Last reply Reply Quote 1
          • E
            Elmojo @stephenw10
            last edited by Elmojo

            @stephenw10 said in Verizon CR200a in ip passthrough?:

            If you set that to WAN (DSL) instead of all

            OK, done.
            Confirmed that with the policy routing rule in place, all works fine.
            With that rule removed, youtube is instantly broken again.
            I'm a little confused about what the DNS change tells us, since things are working fine with only the policy rule, and break without it.
            Is any of this informing you of what the issue may be?

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              Oh, I'm sorry too many threads! I got confused there.

              Ok, then with the DNS moved to the DSL WAN does the problem still return if you disable the policy rule? Or just test from a different host that isn't using the rule?

              E 1 Reply Last reply Reply Quote 0
              • E
                Elmojo @stephenw10
                last edited by

                @stephenw10 said in Verizon CR200a in ip passthrough?:

                with the DNS moved to the DSL WAN does the problem still return if you disable the policy rule? Or just test from a different host that isn't using the rule?

                So I learned something last night.
                With the policy rule in place (only affecting my Desktop PC of course) and the outgoing DNS resolver set to WAN only, everything works fine on my machine.
                However, my wife was trying to watch a video on a site for work (not youtube), and it would not play on her Desktop or her iPad until I changed the default gateway under System->Routing back to WAN (dsl), then it worked fine again.
                There definitely appears to be some issue with the Verizon WAN and certain video streaming services.

                stephenw10S 1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator @Elmojo
                  last edited by

                  @Elmojo said in Verizon CR200a in ip passthrough?:

                  There definitely appears to be some issue with the Verizon WAN and certain video streaming services.

                  Yet when you connected a host to the Verizon modem directly it worked fine? It only fails like that when routed via pfSense?

                  E 2 Replies Last reply Reply Quote 0
                  • E
                    Elmojo @stephenw10
                    last edited by Elmojo

                    @stephenw10 said in Verizon CR200a in ip passthrough?:

                    Yet when you connected a host to the Verizon modem directly it worked fine? It only fails like that when routed via pfSense?

                    You know, at this point I can't even recall. lol
                    I know we tested that earlier. It must be buried somewhere in this thread...
                    Ok, So I see back around post #32 where you asked me to check that, but I don't see a clear response from me as to whether I actually was able to test it that way or not. I'll check that and get back to you.

                    1 Reply Last reply Reply Quote 1
                    • E
                      Elmojo @stephenw10
                      last edited by

                      @stephenw10 said in Verizon CR200a in ip passthrough?:

                      Yet when you connected a host to the Verizon modem directly it worked fine?

                      Short answer = yes
                      The Verizon gateway has 2 LAN ports. One is for "normal traffic", the other is for "admin". When I connect directly to the Verizon gateway via LAN port 1, I get IP 192.168.1.2, and I can log into the gateway UI to do admin stuff, but I have no internet access.
                      If I use LAN port 2 (which is the one that normally would be connected to the pfsense box), then I get an external IP, and everything (including YouTube) works fine.

                      It does indeed seem to be something o do with pfsense, or perhaps some other aspect of my network infrastructure, although I can't imagine what else it would be.
                      The topology is as follows:
                      Verizon gateway -> Cat5e -> pfsense Verizon WAN interface (igb2)
                      Leaving pfsense via LAN interface (igb1) -> Cat5e -> TP-Link managed Gb switch -> rest of home network

                      Any of that look fishy to you?

                      stephenw10S 1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator @Elmojo
                        last edited by

                        @Elmojo said in Verizon CR200a in ip passthrough?:

                        Any of that look fishy to you?

                        Not beyond the fact it seems to be not passing traffic correctly.

                        It's odd that it would be streaming traffic like that. How exactly does it fail?

                        Some sites failing like that is usually either some subnet conflict, like an interface incorrectly configured as /8 or similar. Or an MTU issue when large packets fail to pass:
                        https://docs.netgate.com/pfsense/en/latest/troubleshooting/website-access-issues.html

                        The other common issue is IPv6 failing and some devices preferring and therefore trying to use it. But we checked that. And also that usually presents as sites initially failing to load but then eventually loading.

                        Is there a site you've found that fails to load entirely? That would be much more convenient for troubleshooting.

                        E 1 Reply Last reply Reply Quote 0
                        • E
                          Elmojo @stephenw10
                          last edited by

                          @stephenw10 said in Verizon CR200a in ip passthrough?:

                          It's odd that it would be streaming traffic like that. How exactly does it fail?

                          The site itself loads fine, but when I actually request a video to play, it just buffers forever. Every now and then, if I leave it long enough, one might play, but it defaults to the lowest (144p) resolution. However, once it actually starts, I can choose any resolution I want, and it plays fine. I can skip around, and it keeps up without issue. I appears to be the initial loading that presents the trouble.

                          @stephenw10 said in Verizon CR200a in ip passthrough?:

                          Is there a site you've found that fails to load entirely?

                          Unfortunately, no. Actual web sites all appear to load fine. Granted, I tend to visit many of the same sites, like most folks. Are you aware of a site that's more 'challenging', or one that may be designed to test the capabilities of a browser or connection? Something like that may be useful in diagnosing this gremlin.

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            Not really. It feels like something being blocked so it has to fall back to some lesser connection type though. Hmm.

                            If you could find something that fails completely we could look for those connections specifically to see why they are failing. That's far harder with random streams.

                            I assume there is still nothing shown blocked in the firewall log?

                            E 1 Reply Last reply Reply Quote 0
                            • E
                              Elmojo @stephenw10
                              last edited by

                              @stephenw10 Thanks so much for all your time and patience, but I finally admitted defeat and gave up. I canceled the Verizon service today and will be returning the gateway device shortly.
                              I'd love to track down the gremlins and eventually switch away from my horrible DSL provider, but the trial I was on was about to expire, and I was out of time to screw with it for now.
                              Maybe one day I'll try it again, possibly with T-Mobile home internet, which I think it also in my area. I've heard they will be making it easier to 'bridge' their gateway device soon, so that might be an option.
                              I really do appreciate all your help, sorry we couldn't come up with a real solution!

                              1 Reply Last reply Reply Quote 1
                              • First post
                                Last post