Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    ATT Internet AIr

    General pfSense Questions
    5
    290
    43.6k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      ahole4sure @stephenw10
      last edited by

      @stephenw10
      So I am attaching the Diag > Routing table

      I am attaching my current setup for my interfaces / gateways
      And my current setting in the General Setup DNS page

      Lastly I am attaching what I thought / hoped might work form a Protectli support page for setting up LTE modem on thier devices (in the Advanced Settings of the LAN Rules - forcing it to use the Failover GW

      But this AM tested and it still failed -- AND had to completely reboot to get internet back up and going once the main WAN2 was plugged back in!
      Image 10-26-24 at 12.14 PM.jpeg Image 10-26-24 at 12.14 PM (1).jpeg Image 10-26-24 at 12.15 PM.jpeg Image 10-26-24 at 12.15 PM (1).jpeg

      1 Reply Last reply Reply Quote 0
      • A
        ahole4sure @stephenw10
        last edited by

        @stephenw10
        Image 10-26-24 at 12.13 PM (1).jpeg Image 10-26-24 at 12.13 PM.jpeg Screenshot 2024-10-26 at 12.11.31 PM.png

        1 Reply Last reply Reply Quote 0
        • A
          ahole4sure @stephenw10
          last edited by

          @stephenw10
          Image 10-26-24 at 12.11 PM.jpeg Image 10-26-24 at 12.10 PM.jpeg Image 10-26-24 at 12.09 PM.jpeg

          1 Reply Last reply Reply Quote 0
          • A
            ahole4sure @stephenw10
            last edited by

            @stephenw10

            also btw, I am not sure what .179 is
            it is not the device I'm testing form - but the network is large with probably more than 50 or 60 devices connected

            The routing table does not gicve the device a name (like many have) - it just gives a MAC address

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              Ok you have some conflicting settings there. You have DNS servers set with specific gateways and you also have the same DNS servers set as monitoring IPs for the gateways. Both those thing add static routes and must match to work correctly.

              In your setup you don't need to set gateways on the configured DNS servers because they should work on either WAN and you're using a failover group as the default gateway. Additionally your are resolving directly so the DNS servers configured there are only used as a backup. However the conflicting static routes still breaks DNS for anything trying to use those servers directly. So remove the gateway settings from the DNS servers on the general setup page.

              If you add a failover group to the pass rules on LAN you bypass rules for local traffic. That includes DNS traffic from LAN side clients to the LAN interface. Otherwise it will be forced out of the WAN and never reach Unbound in pfSense.

              A 3 Replies Last reply Reply Quote 0
              • A
                ahole4sure @stephenw10
                last edited by

                @stephenw10

                Ok. Thank you for advice
                I’ll change the DNS settings

                So do I leave the advanced LAN rule like Protectli recommended or change back to not using. I’m sorry I wasnt clear …

                1 Reply Last reply Reply Quote 0
                • A
                  ahole4sure @stephenw10
                  last edited by

                  This post is deleted!
                  1 Reply Last reply Reply Quote 0
                  • A
                    ahole4sure @stephenw10
                    last edited by

                    @stephenw10
                    Here is the new routing table after removing the DNS static routesIMG_0061.jpeg IMG_0062.jpeg

                    1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by

                      Hmm, well I still expect to see the gateway monitoring IPs there, did you remove those too?

                      Anyway that device at 192.168.1.79 should work fine trying to access 8.8.8.8 directly.

                      I'm assuming (because it's the default) that your LAN side clients are being passed the LAN interface address to use for DNS?

                      A 2 Replies Last reply Reply Quote 0
                      • A
                        ahole4sure @stephenw10
                        last edited by

                        @stephenw10
                        I didn't change the monitor IP's on the gateways
                        ??
                        Is this what you were referring to?
                        Image 10-27-24 at 7.28 PM.jpeg Image 10-27-24 at 7.29 PM.jpeg

                        1 Reply Last reply Reply Quote 0
                        • A
                          ahole4sure @stephenw10
                          last edited by

                          @stephenw10

                          I'm not on site until Tuesday - not sure how to safely test while being remote (unless you have ideas on how to "fail" the main internet and not lose connection ??

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            Hmm, I expect to see static routes for 8.8.4.4 and 1.1.1.1 unless you have checked the box to not add them on the gateway config page.

                            You may need to resave them to add those routes. Though not doing so should not affect DNS.

                            If you have the DMZ feature setup on the AT&T router you should be able to access the WAN remotely as long as rules allow it. However I'm not sure I would want to try disconnecting WAN2 without being on site to recover it if required.

                            A 1 Reply Last reply Reply Quote 0
                            • A
                              ahole4sure @stephenw10
                              last edited by ahole4sure

                              @stephenw10
                              Weird -- might even be a part of why I need to reboot after a failed state
                              BUT. I had to completely reboot the box to get those static routes to show back up (the monitor IPs). Resaving the interface settings , restarting the service , etc - nothing brought back the expected routes until I rebooted the box

                              Image 10-27-24 at 9.07 PM.jpeg

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                Ok, you should not use 8.8.8.8 though since at least one device you have is trying to use it. If you use it as a monitoring IP it can only ever work via that gateway.

                                A 1 Reply Last reply Reply Quote 0
                                • A
                                  ahole4sure @stephenw10
                                  last edited by

                                  @stephenw10
                                  Ok

                                  IMG_0069.jpeg

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    Ok, good. Well with that that one device should work at least.

                                    So to confirm you are still passing the LAN address to clients for DNS?

                                    A 1 Reply Last reply Reply Quote 0
                                    • A
                                      ahole4sure @stephenw10
                                      last edited by

                                      @stephenw10

                                      Thanks for hanging in there and helping! Need to buy you a big cup of coffee!

                                      Not sure I understand what you mean with your question. Sorry

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        In the LAN DHCP server config have you entered any DNS servers to pass to clients when they pull a lease?

                                        If you don't enter anything there it will pass the DHCP server address (LAN address) to clients to use for DNS by default. That means they use Unbound in pfSense which should work on both WANs.

                                        If you passed, for example, 8.8.4.4 or 1.1.1.1 that can only work via one WAN.

                                        A 4 Replies Last reply Reply Quote 0
                                        • A
                                          ahole4sure @stephenw10
                                          last edited by

                                          This post is deleted!
                                          1 Reply Last reply Reply Quote 0
                                          • A
                                            ahole4sure @stephenw10
                                            last edited by

                                            @stephenw10

                                            So I’m on my iPhone so it not great screenshots
                                            But here are my LAN DHCP server settings

                                            Should I change something? It’s kinda greyed out but DNS is listed as 192.168.1.1

                                            IMG_0094.jpeg

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.