Firewall behind firewall?
-
On Interfaces->WAN try unchecking "Block private networks" - but actually that should not make any difference to initiating outbound traffic from LAN onto WAN.
It should work with:- Default allow all on LAN rule
- Automatic Outbound NAT (the default in Firewall->NAT, Outbound)
- WAN DHCP getting an IP address from the ISP device
- System->General Setup - "Allow DNS server list to be overridden by DHCP/PPP on WAN" checked - so pfSense will use whatever DNS server the ISP device tells it.
- LAN clients getting DHCP from pfSense, or at least setting their default gateway and DNS server to pfSense LAN IP.
Hopefully something in the above list is not right on your system. Post more details of your WAN, LAN, DHCP… settings if you can't spot the problem.
-
There is an option you will find in Interfaces: WAN: "Block private networks". This sets a default firewall rule to block incoming traffic from rfc1918 addresses, such as your upstream routers address. You should uncheck that since it might cause confusion during testing of WAN side firewall rules but it won't be stopping your clients behind the pfSense box getting internet access.
Something that seems to commonly trip up users when they have to change the LAN subnet is setting a gateway on LAN. You should not have gateway on the pfSense LAN address. If you did add one, remove it and then go to System: Routing: and make sure it's removed from there too and that the WAN gateway is now default.
Steve
Sounds like this might be the thing that gets it going! I put 192.168.2.1 as gateway for the LAN-NIC in pf Sense when I did the basic setup. So <enter for="" none="">is my friend? Or should I simply do this from the webConfig?
The thing is, that when I do a reinstall, I'll get conflicts between WAN and LAN since the DHPC-adress on WAN will be on the same subnet as the preconfed LAN-address range. Can't remember if I can skip setting a gateway on LAN when i manually assign the IP's..</enter>
-
Yes, both those things definitely:
a) WAN and LAN must end up being different subnets.
b) Do not set a gateway on LAN (lots of people seem to be doing that recently)You can change the gateway setting on Interfaces->LAN from whatever you put back to "none" and then also change the LAN subnet to be different to WAN and all should be fine.
-
You can remove the gateway from the webgui. No need to reset the interface from the console.
lots of people seem to be doing that recently
Yes, interesting that. Has the wording changed somewhere to something confusing?
Steve
-
There is definately something fishy going on here. I've configured pfSense as you instructed, no gateway on LAN and letting the ISP-device assign DNSes. And the DNS resolve seems to work, I can ping www.google.com from my internal PC. But I get "Reply from 192.168.2.1: TTL Expired in transit." It can resolve the host google.com, but can't reach it. Seriously strange. Could there be something I need to do on the ISP-device? I tried turning the firewall off, but no difference.
I can reach hosts on my normal 192.168.1.x-network, but not by hostname, only by IP (perhaps an effect of being on different subnets?).
But still no internet connection to speak of.
-
You should allow pfSense to hand out itself (LAN IP address) as the DNS server to clients behind it. That would be the usual configuration. TTL expired is interesting.
Try pinging Google from the pfSense console both by url and at, say, 8.8.8.8. What is the actual response?Steve
-
If I ping google.com or 8.8.8.8 from WAN interface as source adress (192.168.1.78) it works fine. But if I try from default, LAN or localhost as source, I get this:
PING google.com (173.194.40.232) from 192.168.2.1: 56 data bytes
36 bytes from localhost (127.0.0.1): Time to live exceeded
Vr HL TOS Len ID FLG off TTL PRO cks Src Dst
4 5 00 5400 a326 0 0000 01 01 0000 192.168.2.1 173.194.40.232x3, just different ID's from the pings. I'm gessing the pfSense isn't letting stuff through?
Interesting result from a traceroute to 8.8.8.8.
If I do it from the WAN-adress, it all works fine. If I do it from LAN-source, I get 18 hops of 127.0.0.1 with sub-ms times. Only 127.0.0.1.
Whaaaat..?
-
Ok if you're doing that via the webgui you specify which interface to send the ping from. Obviously only WAN is the correct inerface but that implies that 'default' is sending from the wrong interface which is bad.
Did you do this:…then go to System: Routing: and make sure it's removed from there too and that the WAN gateway is now default.
Steve
-
Ok if you're doing that via the webgui you specify which interface to send the ping from. Obviously only WAN is the correct inerface but that implies that 'default' is sending from the wrong interface which is bad.
Did you do this:…then go to System: Routing: and make sure it's removed from there too and that the WAN gateway is now default.
Steve
Totally missed that step. Works fine now, thanks a bunch, guys!
EDIT:
The modem is now in stupid-mode, so the pfSense is my only firewall and DHCP-server. Works like a charm! :DJust gotta find out how to shut it the hell up…sounds like a vacuumcleaner. =P
-
Nice. ;D
What hardware are you running? Have you investigated powerd?Steve
-
The cheapest crap I could get my hands on! :D
AMD Athlon 64 X2 5600+ on a ASUS M2N32-SLI Deluxe Wifi-edition w/ 2 onboard NICs, working just fine.
Got it stationed in a SilverStone LC17 HTPC chassis, so it looks real good too. ;)The preinstalled chassis fans were cheap LED-lighted basterds, so I ripped them out and made sure that the CPU cooler is unobstructed. That cut the noise down radically, and will get some more silent fans soon to keep the case a bit cooler. With only the CPU cooler fan running in the whole system (not counting PSU) the CPU runs at about 45-48C, acceptable if not optimal.
Next step is to get familiar with the Traffic Shaper to setup bandwidth throttling/limiting to specific LAN DHCP clients. Need to be able to make sure certain units on the network doesn't eat up all the available bandwidth.
-
Well that CPU has power saving features in the form of 'cool'n'quiet' and powerd should be able to control that via the powernow_k8 driver. Probably save you some Watts at idle and hence fan noise (if your fans are thermal control).
It should show up in the boot log if it's working. For example:
CPU: AMD Athlon(tm) 64 X2 Dual Core Processor 5200+ (2705.78-MHz K8-class CPU) FreeBSD/SMP: Multiprocessor System Detected: 2 CPUs cpu0 (BSP): APIC ID: 0 cpu1 (AP): APIC ID: 1 cpu0: <acpi cpu=""> on acpi0 cpu1: <acpi cpu=""> on acpi0 powernow0: <powernow! k8=""> on cpu0 powernow1: <powernow! k8=""> on cpu1</powernow!></powernow!></acpi></acpi>Steve
-
Well, the CPU fan noise is not an issue, I got a replacement for the loud Zalman previously installed (it was also too large for the new chassis). The problem was the chassis fans, and those were not PWM, so I could not control their RPMs properly. So I yanked them out, and now the box is mostly silent.
Will look into powerd tho, guessing it is installed as some kind of addon?
-
It's included by default but not enabled. Try enabling it under System: Advanced: Miscellaneous: You may have to tweak it or load some further modules. You might find it throws errors for various reasons. Check the system logs.
Steve
-
Coolio. However, does the cool'n'quiet-mode need to be enabled in BIOS beforehand? 'Cuz I ripped out the Graphics card as well to decrease noise, so to enable it is a bit more work than just rebooting the system.. ^^
-
I have no experience with cool'n'quiet but I would expect it needs to be enabled in the BIOS. It might be enabled already.
Steve
-
Ok. At any appropriate moment I will tear down the firewall and install the GPU again. =)
