IP address issue

[KOM]

Any ideas on how to get this issue resolved are greatly appreciated.

If you use incorrect settings then of course things won't work right.  Post details of your LAN, firewall rules and client network settings if anyone has a hope of helping you.

[d4t4str34m]

Firewall address is 10.0.0.254 with a subnet mask of 255.0.0.0. One of the clients having an issue has the address of 10.0.0.230 with the same subnet mask and 10.0.0.254 for the gateway.

The machines can't ping the dns number assigned outside of our network. Any machine with that address goes no further than the firewall.

Attached is a screenshot of my LAN rules.


[johnpoz]

Well what is the mask you are using on these machines that don't work - using a /8 mask on your lan segment is not normal.  Do plan on having somewhere in the area of 16 million hosts on this 1 network?  Use a normal mask, /24 or if you have lots of hosts /23  which would be about the limit of machines you would want on the same layer 2 anyway..

[KOM]

Your LAN rules are fine.  What are the details of your pfSense LAN NIC, and the settings for your client PCs?

[d4t4str34m]

Attached are screenshots of my LAN configuration and my DHCP configuration.


[KOM]

Well, that's a start.  For a LAN client to have Internet access, it must have an IP address, a netmask, a gateway and at least one DNS server.  Can you provide the network details of one of your client systems that can't go through the firewall?  Run ipconfig is a DOS box (assuming you're running Windows clients) and report back what it says.

[d4t4str34m]

Attached is the output to ifconfig. The numbers 10.0.0.230, 10.0.0.232, and 10.0.0.234 will not get out. The only thing that I see in common are that they are Apple servers. I can give it a different address like 10.0.190.242 and it will get out just fine. I have a Windows server that has 10.0.0.241 and it works just fine.

If I statically assign that 230 address to a Windows machine it won't work either. I have also tried setting up the 230 address in DHCP as a reserve for that server instead of being statically assigned at the machine so I made sure it was getting all of the other network settings like other machines and it still doesn't work.

network.txt

[KOM]

Are you sure there isn't an IP conflict with .230?  Change the .230 box to something else and then try to ping .230, or delete its entry from the ARP table and then check it in a minute or so to see if a different MAC appears with .230.  Usually client connectivity is one of the easiest things to get working right out of the box.  What happens if you statically configure the client NIC as follows:

IP: 10.0.0.230
Mask: 255.255.255.0
Gateway: 10.0.0.254
DNS: 8.8.8.8

[Derelict]

Loves me some 10.0.0.0/8.

Running anything like snort/suricata?

Anything in the firewall log for .230 when you try to get out?

[johnpoz]

Well if pfsense interface is with a /8 mask, how would setting the client to /24 work??

What happens if you statically configure the client NIC as follows:

IP: 10.0.0.230
Mask: 255.255.255.0
Gateway: 10.0.0.254
DNS: 8.8.8.8

So you have 2 interfaces en0 and en1 - en1 looks down, but you sure its not trying to use that and not your en0 that has the IP and is connected?

So your saying it gets an IP via dhcp, but does not work with it?  Can pfsense see that mac in in its arp table, can the apple server see the mac of pfsense interface in that network.  Do these match up.. As mentioned duplicate IP can cause you problems for sure.

Again, going to stress this use of a /8 on a network other than a summary route in a router is completely borked!!!  Maybe your apple server says - what a /8 mask - that makes no sense.. Whoever setting me up is completely clueless.  I will just not work until I get a realistic mask for a interface..  /8 masks routes, ok, firewall rules sure.  Interfaces for hosts in a network - no not so much.  Makes no sense to use such a network..

[KOM]

Well if pfsense interface is with a /8 mask, how would setting the client to /24 work??

What does one have to do with the other, as long as they can see each other?  The client doesn't need to see all of his massive network just to test connectivity with the gateway.  And like you said after perhaps there is some weird Apple thing going on that is choking on the /8.

[johnpoz]

Setting the mask to /24 as long as that network includes the actual gateway IP in the same mask ok that is a good point.  But not normal troubleshooting technique ;)  But guess it would reflect on some ODD issue with apple not liking a /8 without changing the whole network.

I would like to know it gets dhcp or not, and it works with that?  If so then really points to a conflict with the IPs that are not working.

[Derelict]

Because one side's broadcast address would be 10.255.255.255 and the other side would be 10.0.0.255.

Strange things can break in strange ways when you do that. Pick a subnet mask for the interface and stick with it.

There are a couple good reasons not to use 10/8 but it should work fine.

[KOM]

Just to be clear, I'm not advocating running with mismatched subnet masks in general.  It was just to do a quick test while ruling something out without him having to change his network.

[d4t4str34m]

Sorry I haven't gotten back and worked on this issue. I haven't been using those servers to the point they needed an outside connection. I worked on it today and ended up setting a Virtual IP for those IP addresses and they started working. I must have halfway did the mapping to the IP addresses? Just wanted to update you guys on what I did to fix it. Thanks for you help.

[KOM]

You can create a NAT with anything you want as the Destination address, but pfSense has to know to listen for it.  It automatically knows to listen on the WAN IP.  All others must be explicitly set via Virtual IP.