No internet access from LAN side
-
"As i understand it, pfsense is firewall and for clients on LAN side, gateway should be pfsense's LAN IP and that's all."
What?? Do you want pfsense to be a PROXY.. how are you suppose to get to the internet, if you can not talk past pfsense??
Pfsense is a ROUTER/Firewall – for clients to get to the internet they are routed and natted in a normal pfsense configuration. Yes you can create firewall rules on the lan side that say only client with IP 1.2.3.4 can talk to 4.5.6.7 on port 21, or port 80, etc.
But generally speaking as phil already pointed out - lan clients can create whatever traffic they want going out. Its unsolicited traffic coming in the wan where the firewall is mostly used.
Or like I do between my lan segments you can do something like this
Notice the !LAN last rule, this allows anything on my 192.168.2.0/24 segment to go anywhere they want, except my lan.. So they can talk to the internet.. Say google, but they can not talk to my lan.. So
BusyBox v1.22.0 (2014-01-10 06:12:31 CET) built-in shell (ash)
Enter 'help' for a list of built-in commands.root@dd-wrt:~# ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: seq=0 ttl=47 time=25.537 ms
64 bytes from 8.8.8.8: seq=1 ttl=47 time=25.632 ms
64 bytes from 8.8.8.8: seq=2 ttl=47 time=25.969 ms
^C
--- 8.8.8.8 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 25.537/25.712/25.969 ms
root@dd-wrt:~# ping 192.168.1.100
PING 192.168.1.100 (192.168.1.100): 56 data bytes
^C
--- 192.168.1.100 ping statistics ---
5 packets transmitted, 0 packets received, 100% packet lossSo again lets ask this really simple question "What are you lan rules in pfsense"
-
Here are the screenshots:
i've done factory reset of pfsense before that but it didn't help.
-
You don't need/want a GW on LAN, please remove it ;)
-
Somehow people are feeling the urge to specify a gateway on LAN. pfSense understands gateways to be the way out to the rest of the internet (or at least some other networks), and a gateway set on an interface is assumed to be a general way out to "everywhere". One of the gateways has to be the default gateway, and if you specify a gateway on LAN and it is the default gateway then packets are going to spin around somewhere inside LAN and never get out.
After removing that LAN gateway, make sure that you have a WAN gateway that points to a real upstream router that gets to the internet, and set that as the default gateway.
I wonder if the words describing this in the initial setup scripts can be enhanced in some way so that people do not feel the urge to put a gateway on LAN? -
yeah it is becoming a very recurring issue – maybe we need to create BIG FLASHING RED letters that say do not put a GW on this LAN interface unless you fully understand what that means. And then rethink it and then don't do it!! ;)
Can we just remove the option all together, if you you classify it as LAN interface there is NO option to put a GW on it at all.. ;) Is this connection used as WAN/INTERNET sort of check mark, and if not checked no GW option is even available? I am almost positive that the wizard of setup clearly skips over asking the question even - doesn't it??
-
@ptt:
You don't need/want a GW on LAN, please remove it ;)
There is none selected under LAN interface "gateway" but in "status" there are 2 gateways shown(see screenshots).
Did pfsense restart and nothing changed.
 -
Please Remove/Delete the "GW_LAN" you Don't Need It !
The ONLY GW that a "pfSense default install" (with 2 interfaces, WAN & LAN) Need to work "OK" is the WAN GW
-
3 levels of nats? Your 3rd hop in your trace is 172.29 which is private as well..
-
@ptt:
Please Remove/Delete the "GW_LAN" you Don't Need It !
The ONLY GW that a "pfSense default install" (with 2 interfaces, WAN & LAN) Need to work "OK" is the WAN GW
Finally it works! Problem was that i didn't know how to delete LAN gateway because it's under "System>routing" and i tried to remove it under "interfaces>LAN(gateway)". Once i saw your SS i start opening all sub menus under "system" and found "gateways" menu.
Thank you and thank you johnpoz, too.
-
3 levels of nats? Your 3rd hop in your trace is 172.29 which is private as well..
I don't know what address is that and to whom it belongs to. I think it belongs to ISP. Can it be? My router's private LAN address is 192.168.1.1 which is first hop.
-
172.29 doesn't really belong to anyone its private address space - just like your 192.168, it rfc1918 address space and clearly needed for you to have multiple boxes behind an actual public. That is what your adsl gateway should be doing.. But your showing 2 hops past that still private??
I would think you have a hard time doing any sort of unsolicited inbound traffic? Port Forwards. Shoot I would guess your clients behind pfsense are 4 nats deep, unless your ISP just routing the privates then your only 3 ;) isp to public, your adsl to pfsense and then pfsense to your lan clients behind pfsense ;)
-
I would think you have a hard time doing any sort of unsolicited inbound traffic? Port Forwards. Shoot I would guess your clients behind pfsense are 4 nats deep, unless your ISP just routing the privates then your only 3 ;) isp to public, your adsl to pfsense and then pfsense to your lan clients behind pfsense ;)
I don't have any need for unsolicited inbound traffic on LAN interface of pfsense. I run pfsense only to have hotspot(tickets/captive portal - that's next step) for web surfing. On WAN side (192.168.1.x - 5-6 clients) I have few open ports on main router(192.168.1.1) and all unsolicited inbound traffic passes through main router fine.
-
yeah it is becoming a very recurring issue – maybe we need to create BIG FLASHING RED letters that say do not put a GW on this LAN interface unless you fully understand what that means. And then rethink it and then don't do it!! ;)
Can we just remove the option all together, if you you classify it as LAN interface there is NO option to put a GW on it at all.. ;) Is this connection used as WAN/INTERNET sort of check mark, and if not checked no GW option is even available? I am almost positive that the wizard of setup clearly skips over asking the question even - doesn't it??
THIS.
Argh. I've been working on getting VLANs to work and part of that was moving DHCP off the pfsense box so I could configure the subnetting correctly. I didn't notice this put a gateway on pfsense's LAN side. And until this thread, didn't realize that was why the internet just turned off. :(
Thanks though! I hate having my business behind store bought wifi routers.
Chris
