Stuggling with PfSense configuration ESXi
-
Stuggling with PfSense configuration.
Currently
Sky Hub (does wifi, dhcp, firewall-prob NAT etc) => LAN either via wiffi or cable to sky hub.Plan:
I'm building a vmware esxi home lab and bought a managed switch and a 2 boxes for vmware to run VM's onthe box that will have pfsense installed has to physical NICs, the other has box for vm's has one nic.
the box with 2 nic has one nic connected to sky box (and would be WAN connection ) and the other to the switch (LAN connection).
I want vmware servers and all the other servers or pc's connected to the switch use pfsense as a firewall/gateway/dhcp/dns server. So that sky hub would be an upstream server.
Sky hubs is itself is a dhcp server and gives out ip's from address range 192.168.0.0 (sky box local ip 192.168.0.1)
I reserved an ip for pfsense on the box which gets assigned properly 192.168.0.254
pfsense's lan will be 10.7.7.0 and pfsenses ip will be 10.7.7.254. wan configuration will have sky hub as a dns server 192.168.0.1
i followed pfsense instructions for vmware to set up pfsense
so my test laptop (windows 8.1) thats connected to the switch gets an ip from pfsense, but when i try to browse the internet (google.com etc) i get nothing. also when i try to tracert or ping google.com it gets nothing.Any ideas what to check or configure? What have i missed?
-
Did you happen to set a gateway on pfsense lan interface this 10.7.7.254 interface? This seems to be a common issue.
Did you edit the rules on the lan, by default they would be any any. If your wan is on private rfc1918 space, ie your 192.168.0.0/24 then you most likely want to disable the block private network on the wan interface which a default rule.
-
I am pretty sure I did remove the RFC and bogon. I think I did assign a gateway on LAN interface, but I will double check when I get home.
-
You do not want a gateway on LAN interfaces - where would you point it in the first place? If you put a gateway on the lan, pfsense thinks its a wan connection. If you need to route networks in your lan, then you need to create specific routes to those and not put a gateway on the actual interface.
-
Right. I don't have Gateway on my LAN and i have disabled RFC 1918. I can see that it win8 client is opening like google or bing but if i try to open wikipedia for example nothing happens and I get webpage not found.
-
so you can ping out to the internet? So you can ping 4.2.2.2 for example? This is a level 3 public dns that I know answers ping
C:>ping 4.2.2.2
Pinging 4.2.2.2 with 32 bytes of data:
Reply from 4.2.2.2: bytes=32 time=32ms TTL=52
Reply from 4.2.2.2: bytes=32 time=33ms TTL=52Sounds more like a dns issue related problem then if your having issues accessing specific sites.
-
Yes i can ping this fine, but i can't browse for example pfsense forum
-
nslookup?
-
Well you have connectivity then its name resolution - what are you using for DNS?
If you can resolve www.google.com - but not yahoo.com as example and www.google.com opens just fine then its a dns related problem not connectivity.
-
yea yahoo is not working. (via browsing),
But when i ping yahoo it works, and nslookup yahoo works also:
PS C:\Users\Administrator> ping yahoo.com
Pinging yahoo.com [98.138.253.109] with 32 bytes of data:
Reply from 98.138.253.109: bytes=32 time=174ms TTL=50
Reply from 98.138.253.109: bytes=32 time=153ms TTL=50
Reply from 98.138.253.109: bytes=32 time=151ms TTL=50
Reply from 98.138.253.109: bytes=32 time=170ms TTL=50Ping statistics for 98.138.253.109:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 151ms, Maximum = 174ms, Average = 162msThis is odd, i don't have any issues browsing if i connect to sky hub. so there isn't anything on the box stopping.
Maybe some sort of routing issue? -
if it was a routing issue how could you ping ;)
if it resolves - did you change the rules on pfsense from the default any any?
Did you install any packages like squid or snort? Is your browser using any sort of proxy setting? etc. etc..
-
You are correct about the routing. it makes sense.
no i have'nt changed any rules. I did enable just now manual NAT.
I dont have a proxy, no snort or squid.
Its a basic new install. with changes/configurations that i mentioned above.
If its a DNS issue then whats stopping from browsing anything else than google?
-
Sure your box has not been compromised and infect with some sort of redirect for searches and traffic?
Why would you have changed over to manual nat? There is rarely a need to do this, and not suggested unless you fully understand what your doing ;)
If your install is pretty much default it should just work. What I would suggest is do a sniff (packet capture) on pfsense - say the wan and lan at the same time via tcpdump watching the traffic. do you see your dns queries and answers for sites that are not working? Do you see the traffic come back after you do your http get to the site?
Could you have some issue with using ipv6 vs ipv4? Are you using ipv6?
