• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Unable to access internet from remote site

Scheduled Pinned Locked Moved Routing and Multi WAN
27 Posts 3 Posters 10.4k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • P
    PhatBot
    last edited by May 24, 2007, 9:55 AM

    Hi, first post here.
    We've been using pfSense at our company for a couple of days now. So far it's been working great.
    A big thanks to all you guys whos been putting so much effort into this great product. :)

    Everything is working like we hoped for except one small thing.
    We cannot access internet from a remote subnet.
    The subnet is connected via a router and when I do a traceroute from that site to a host on the internet the last reply I get is from the pfSense box after that it just times out.
    I think I've set up all the needed routes, rules and such.
    To get the internet working on the remote site I hade to install squid and then set up the browsers with proxy settings.
    This works temporarily but will not work in the long run sinze we have applications that arn't proxy-aware.

    Could someone give me some pointers to what might cause this problem?

    Thanks!

    1 Reply Last reply Reply Quote 0
    • P
      Perry
      last edited by May 24, 2007, 1:36 PM

      @PhatBot:

      We cannot access internet from a remote subnet.

      I think I've set up all the needed routes, rules and such.

      Use the latest beta if it should be a pfsense issue

      Post your routes, rules and such. :)  a bit hard to know what you have done so fare.

      /Perry
      doc.pfsense.org

      1 Reply Last reply Reply Quote 0
      • C
        cmb
        last edited by May 24, 2007, 7:45 PM

        You need to make sure the static route(s) for these subnet(s) are entered properly, and also change the default LAN permit rule so it allows more than just the LAN subnet. by default only the subnet directly connected on the LAN is permitted out by the firewall rules.

        1 Reply Last reply Reply Quote 0
        • P
          PhatBot
          last edited by May 25, 2007, 9:41 AM

          Thanks for the reply guys.
          Lets see if I can describe it better…

          Interfaces:
          IF1(WAN) - IP XXX.XXX.XXX.XXX
          IF2(LAN) - IP 10.58.112.5/22
          IF3(DMZ) - IP 192.168.0.1/24

          Routes:
          LAN 10.58.118.0/24 GW 10.58.112.12
          LAN 10.58.204.0/24 GW 10.58.112.12
          LAN 10.58.202.0/24 GW 10.58.112.1

          NAT: (Advanced outbound)
          WAN 10.58.0.0/16 * * * * * NO    (LAN -> WAN)
          WAN 192.168.0.0/24 * * * * * NO (DMZ ->WAN)

          Rules: (on LAN IF)

          • 10.58.0.0/16 * * * * * (Allow all out)

          10.58.118.0/24 and 10.58.204.0/24 comes over VLAN via a routing switch with IP 10.58.112.12
          10.58.202./24 comes in via a leased line through a router with IP 10.58.112.1

          Entire LAN, 10.58.118.0/24 and 10.58.204.0/24 works flawlessly in every sense. However 10.58.202.0/24 never passes through the pfSense. It's like it refuses to do NAT for that subnet.

          Hope this describes it better.

          Thanks again!

          1 Reply Last reply Reply Quote 0
          • P
            PhatBot
            last edited by May 26, 2007, 8:31 PM

            bump  :)

            1 Reply Last reply Reply Quote 0
            • C
              cmb
              last edited by May 26, 2007, 10:53 PM

              can you ping IP's on those subnets from pfsense itself?

              Do you see the traffic getting dropped in your firewall log?

              1 Reply Last reply Reply Quote 0
              • P
                PhatBot
                last edited by May 27, 2007, 6:48 AM

                Yes, pinging from pfSense to the remote subnet works just fine.
                And no, the log show thats the traffic gets through.

                1 Reply Last reply Reply Quote 0
                • C
                  cmb
                  last edited by May 28, 2007, 1:52 AM

                  Based on what you said, your pfsense sounds fine. I didn't see it mentioned, what version are you running?

                  1 Reply Last reply Reply Quote 0
                  • P
                    PhatBot
                    last edited by May 28, 2007, 8:00 AM

                    Version 1.0.1

                    Well it seems like it's doing fine yet it doesn't seem to NAT that subnet.

                    Can't really see any other things in my network typology that could cause this problem.

                    1 Reply Last reply Reply Quote 0
                    • P
                      Perry
                      last edited by May 28, 2007, 8:30 AM May 28, 2007, 8:28 AM

                      Then you should update http://pfsense.best-view.net/updates/

                      more info here http://pfsense.blogspot.com/2007/05/choosing-which-version-to-run.html

                      /Perry
                      doc.pfsense.org

                      1 Reply Last reply Reply Quote 0
                      • P
                        PhatBot
                        last edited by May 28, 2007, 7:14 PM

                        Ok upgraded to 1.2-Beta-1 (Excellent job on the firmware upgrade routine guys. Quick and accurate.)

                        Still no go though.
                        Passes firewall rules but seems to get stuck in NAT or something.

                        1 Reply Last reply Reply Quote 0
                        • C
                          cmb
                          last edited by May 28, 2007, 9:52 PM

                          Yeah I would have suspected a NAT bug in 1.0.1, there are a few of those that have been fixed in 1.2b1.

                          Do you have advanced outbound NAT enabled?

                          1 Reply Last reply Reply Quote 0
                          • P
                            PhatBot
                            last edited by May 28, 2007, 10:23 PM

                            Yes, advanced NAT enabled.

                            1 Reply Last reply Reply Quote 0
                            • C
                              cmb
                              last edited by May 29, 2007, 12:01 AM

                              Then it's a problem with your advanced NAT rules. Do you need it for some reason? If not, just disable it and your problem goes away.

                              1 Reply Last reply Reply Quote 0
                              • P
                                PhatBot
                                last edited by May 29, 2007, 7:31 AM

                                Changed to normal NAT.
                                Still same problem though.

                                Very odd.

                                1 Reply Last reply Reply Quote 0
                                • P
                                  Perry
                                  last edited by May 29, 2007, 7:58 AM

                                  Is there be anything special with that leased line?

                                  10.58.202./24 comes in via a leased line through a router with IP 10.58.112.1

                                  maybe do some trace with pftop or tcpdump ( just a though )

                                  /Perry
                                  doc.pfsense.org

                                  1 Reply Last reply Reply Quote 0
                                  • C
                                    cmb
                                    last edited by May 29, 2007, 8:25 PM

                                    Yeah it's time to start capturing packets and seeing what's really happening.

                                    1 Reply Last reply Reply Quote 0
                                    • P
                                      PhatBot
                                      last edited by May 29, 2007, 8:44 PM

                                      Right… hehe... the thing is.....  :-\

                                      I havn't got a clue how to do that.???
                                      Could someone give me some pointers?

                                      Thanks!

                                      Also. Thanks for the help on this subject. I really appreciate you guys taking your free time to help me. :)

                                      1 Reply Last reply Reply Quote 0
                                      • P
                                        PhatBot
                                        last edited by May 31, 2007, 9:45 AM

                                        Tried some TCPDUMP. Not really sure what to look for though.

                                        The thing I find strange is that I'm able to ping hosts on the remote subnet from the pfsense box.
                                        And the pfsense box also replies to pings from the remote subnet.
                                        Feels like the data is flowing like it should in our internal network.
                                        It just doesn't let me do nat for that subnet.

                                        1 Reply Last reply Reply Quote 0
                                        • P
                                          PhatBot
                                          last edited by May 31, 2007, 10:39 AM

                                          In the Webgui Diagnostics: Show States I see
                                          ICMP 10.58.202.21:512 -> external-ip:35350 -> external-gw 0:0
                                          ICMP external-gw:512 <- 10.58.202.21 0:0
                                          when I try to ping from the host on the remote subnet to our ISP gateway.
                                          This should indicate that NAT is working like it should right?

                                          1 Reply Last reply Reply Quote 0
                                          20 out of 27
                                          • First post
                                            20/27
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received