It was working?
-
So i just got into the idea of using pfsense for a router/firewall due to my consumer grade router that been in use
for a few years faltering under 13 computers all connected at once.
So i built a box using some salvage components:
Athlon 64 3000+ @ 2.0gHz
Asus A8V motherboard
ATi 9550 GPU
2 x Intel PRO/1000 GT NIC's (one for WAN, one for LAN)
2gB Kingston DataTravlerEverything installed fine and i was able to access the internet using my laptop (directly connected to LAN).
But as i had lots of homework to do this week (in grade 10 :) i had to leave the rest of the configuration til
today (changing old router to just be a switch, forwarding the wall of ports to my server, etc.)When i attempt to connect today from my laptop, no connection to the laptop, i can ping stuff from the webGUI
so that means that the WAN is connected but now the lan won't connect to the internet.My configs are below:
Rules:
LAN:
Default one, allow anything from LAN subnet to go anywhereWAN:
Proto Source Port Destination Port Gateway
ICMP * * WAN address * *
TCP/UDP * * * * *NAT:
Outbound set to manual and using the default rule created for thatDHCP:
LAN:
Range: 192.168.1.100-192.168.1.149 (LAN subnet is 192.168.1.0/24)
Gateway: 174.0.76.1 (IP given to WAN interface from ISP)Any ideas on why my laptop will no longer connect to the internet?
~{}
-
Try removing gateway from your dhcp settings.
-
Just tried that, now when i ping using my laptop it says the destination is unreachable instead of request has timed out…
-
please show ipconfig /all from your laptop (I suppose it is MS Windows) and ifconfig from your pfSense
-
There you go :D
-
Don't you have statically configured default gateway on your laptop?
0.0.0.0 might be messing up everything for you. -
Yay for the stupid laptop… now everything seems to be working...
-
Congratulations. Don't forget to remove 'allow all' rule from WAN interface. You want it to be The Firewall after all. -)
-
Spoke too soon…
Now the issue seems to be that when i connect the pfsense box to my old router (need it to use as a switch for now and to emit wireless)nothing but the laptop can connect to the internet. I have disabled the DHCP server on the old router as well as the firewall and have the LAN interface of the pfsense box plugged into one of the LAN interfaces of the old router. When i run ipconfig /all on my desktop it reports the pfsense box as being the default gateway and assigning it an address but when i ping 74.125.53.104 (google.ca) i get the old routers ip address saying that the "destination net unreachable". -
Try
ipconfig /release ipconfig /renewon your desktop
-
Did that, it could ping stuff but not access any webpages… same goes for all the other computers on the network (i got excited wayyy too fast). Strange thing is i can still play TF2 without any issues, and a far stabler ping (used to flux from 50-70 normally but sometimes up to 900) and now it sits in the low 50's without issues...
-
Did that, it could ping stuff but not access any webpages
It would be helpful to have more information about the access failure.
Can you access the pfSense web GUI? If not, what URL did you try and what was reported by the browser?
Can you access www.google.com? If not, what URL did you try and what was reported by the browser?
-
i can access the webGUI but not access google.com, opera reports that no apge is found and IE reports an incorrect URL. But if i ping it i get 4 successful responses back
-
pfctl -sr | grep em0 pfctl -sn -
$ pfctl -sr | grep em0
pass in quick on em0 inet proto udp from any port = bootpc to 255.255.255.255 port = bootps keep state label "allow access to DHCP server on LAN"
pass in quick on em0 inet proto udp from any port = bootpc to 192.168.1.4 port = bootps keep state label "allow access to DHCP server on LAN"
pass out quick on em0 inet proto udp from 192.168.1.4 port = bootps to any port = bootpc keep state label "allow access to DHCP server on LAN"
block drop in on ! em0 inet from 192.168.1.0/24 to any
block drop in on em0 inet6 from fe80::21b:21ff:fe08:7a7a to any
pass out quick on em0 proto icmp all keep state label "let out anything from firewall host itself"
pass out quick on em0 all flags S/SA keep state label "let out anything from firewall host itself"
pass in quick on em0 inet from any to 192.168.1.4 flags S/SA keep state label "anti-lockout web rule"
pass in quick on em0 inet from 192.168.1.0/24 to any flags S/SA keep state label "USER_RULE: Default LAN -> any"
pass in quick on em0 inet proto tcp from any to 127.0.0.1 port = ftp-proxy flags S/SA keep state label "FTP PROXY: Allow traffic to localhost"
pass in quick on em0 inet proto tcp from any to 127.0.0.1 port = ftp flags S/SA keep state label "FTP PROXY: Allow traffic to localhost"
$ pfctl -sn
nat-anchor "pftpx/*" all
nat-anchor "natearly/*" all
nat-anchor "natrules/*" all
nat on em1 inet from 192.168.1.0/24 to any -> (em1) port 1024:65535 round-robin
rdr-anchor "pftpx/*" all
rdr-anchor "slb" all
no rdr on em0 proto tcp from any to <vpns>port = ftp
rdr on em0 inet proto tcp from any to any port = ftp -> 127.0.0.1 port 8021
rdr-anchor "imspector" all
rdr-anchor "miniupnpd" all</vpns>
-
well.. at this point the only thing I can think of is DNS.
What is the IP of DNS server your desktop gets? I suppose LAN interface of your pfSense?
If this is the case make sure your pfSense's DNS is correctly configured - go to System->Packages. If DNS is misconfigured you will not see a list of available packages. -
Alright, everything is working now… time to forward ports and get my new IP out to my clients. Thank you for all your great help and for being patient with a total noob.
~{}
-
Alright, everything is working now.
Just for the record, what did you change to make it work?