pfsense test bed on zimaboard behind main pfsense router

[mr.singh]

I want to setup a pfsense test bed on a zimboard 832 to test out the new features before upgrading the main router

I have flashed pfsense ce latest to Zimboard and am facing issues on the lan interface which has no internet.

WAN interface has no rules and LAN has allow everything

ping to google.com works from the cli but not from laptop connected to the lan

DNS Resolver is configured and laptop gets the right ip from test bed pfsense lan subnet

pfsense test bed wan is on 10 subnet
lan on 192.168.1.1

[SteveITS]

@mr-singh is DNS working on the laptop? Traceroute? Ping 8.8.8.8?

[mr.singh]

@SteveITS on the laptop, the dns is not working. the ping doesn't resolve the host.

[Gertjan]

@mr-singh

You have a "main pfSense device", which has a LAN with the default 192.168.1.1/24.
This means that you can attach to this LAN every possible device available on planet earth : the DHCP client on this devcie will request a leas ( = gateway, network, DNS, and an IP).
Your "test pfSense" is such a device.

But there is one condition : If your "test pfSense" also uses 192.168.1.1/24, the you have an issue : both a 192.168.1.0/24 network on the "test pfSense" LAN & WAN => problem.

You've probably took the correct action
@mr-singh said in pfsense test bed on zimaboard behind main pfsense router:

pfsense test bed wan is on 10 subnet

I say probably, because I can't tell what you didn't do right : no details ==> no real help.

Typically, you've set up your "test pfSense" with an 10.0.01/24 LAN. (and not 32, right, as this would disallow any DHCP server activity on the LAN).
You've set up the LAN DHCP server so it has a 'pool' like 10.0.0.10 (example) -> 10.0.0.100 (example).
As soon as you power on the "test pfSense" and wait for it to start, and then hook up a PC to the "test pfSense" LAB port, you can see (and I'm not sure why you didn't mention / test ) : that this PC got a lease with DNS = 10.0.0.1 - gateway 10.0.0.1 - IP 10.0.0.x where x is between 10 and 100.
If the PC is a Windows PC : type

ipconfig /all

and you'll see all the answers.
If it didn't get an IP : go back to the test pfSense and set it up correctly : LAN & DHCP.

When it got a "IP" (a DHCP lease actually), then you can hook up the "test pfSense" WAN port to the "main pfSense" LAN network / port.
Because the "test pfSense" uses 'DHCP' as the WAN connection method, it should obtain a lease with an IP WAN like 192.168.1.x (and a gateway 192.168.1.1 - DNS : don't care).
You can see the dtails in the DHCP logs and here : Status > Interfaces

[mr.singh]

@Gertjan my main pfsense is on 10.2.1.1/24 subnet and thr test bed pfsense is on 192.168.1.1

The laptop which is a mac is connected using a usbc 2.5gb dongle

[Gertjan]

@mr-singh said in pfsense test bed on zimaboard behind main pfsense router:

my main pfsense is on 10.2.1.1/24 subnet and thr test bed pfsense is on 192.168.1.1

In that case : install pfSense with the one golden rule : use the keyword ones, when you define your password. And stop there using your keyboard. Don't change anything else. Don't add or change DNS related stuff. It's a plug and play experience.

Forget about my story above : plugin in WAN, plugin in LAN, and done.

@mr-singh said in pfsense test bed on zimaboard behind main pfsense router:

The laptop which is a mac is connected using a usbc 2.5gb dongle

If this works on your main bed pfSense router, it will work on any other router (as long as DHCP is active).

[stephenw10]

On the Zimaboard you need to run the alternative Realtek module to avoid watchdog timeout isues. That wouldn't stop it connecting completely though.

[mr.singh]

@stephenw10 I have 2 x4 nics that I would try with.

Keeping pfsense zimboard wan port on a vlan aware lan port would make any difference?

[mr.singh]

i have pflbocker on the main pfsense router

[stephenw10]

@mr-singh said in pfsense test bed on zimaboard behind main pfsense router:

Keeping pfsense zimboard wan port on a vlan aware lan port would make any difference?

Probably not. The WAN connection is working as expected as I understand it? You can ping out OK from pfSense itself.

It's clients behind it that are failing to connect? Are those clients even getting a DHCP lease from pfSense?

[mr.singh]

@stephenw10 yes they are.

Any subnet changes I do on the test bed pfsense, are reflected on the client side

[stephenw10]

OK. So DNS is failing on the clients, what are they using for DNS? They should be being passed the pfSense LAN interface address to use.

Can clients ping out by IP address directly?

[mr.singh]

@stephenw10 client can't ping out

[stephenw10]

Ok so cant resolve or ping external sites. Can clients ping the pfSense LAN address?

If they get DHCP leases but can't ping anything (even locally) that sounds like a missing or bad firewall rule. However on LAN that should be passed by default.

[mr.singh]

@stephenw10 pfsense ui ping, traceroute and dns lookup can connect to external hosts

But devices on the lan can't ping or do nslookup on any site.

[stephenw10]

But can they connect to the pfSense GUI or ping it's local IP address?