No LAN Internet Access

kaysersosa

You first need to separate the issue into either DNS or route. From your client, can you ping 8.8.8.8? Can you perform 'nslookup google.com'?

Well, it appears to be working, accessing the internet. I had powered off the pfsense router and the client system. Powered them back on just to respond to both of your comments and it's working. Going to attempt to restore my config from a prior build either later tonight or tomorrow and see what happens.

@Gertjan:

Disable DMZ on your ISP Router.
pfSense obtains an IP from your ISP Router, using DHCP - the "WAN -> v4/DHCP: 192.168.1.101/24", and all will be fine.

Unless my understanding is incorrect, I DMZ so I don't have to enter firewall rules into both routers and I can just pass through the ISP router.

kaysersosa

The issue still persists.

I uploaded a former config and it didn't work again.
I have wiped my pfSense box and it has nothing on it other than a bare bones install of pfSense 2.4.3-RELEASE (amd64).

Console of pfSense shows, below. It grabbed both automatically, but I did set the LAN side
WAN -> v4/DHCP: 192.168.1.101/24
LAN -> v4: 10.0.0.1/25

webConfigurator is set to HTTPS.

I can ping google.com from the pfsense box, but a computer attached to the LAN side of pfsense cannot access google.com.

The DNS pfsense is showing is 127.0.0.1 and 2 of the hard coded DNS addresses from the ISP router.

Still looking for assistance.

KOM

Computer attached to LAN must have an IP address in the 10.0.0.1/25 range, a gateway of 10.0.0.1, and DNS of either 10.0.0.1 or an external DNS like 8.8.8.8.

kaysersosa

@KOM:

Computer attached to LAN must have an IP address in the 10.0.0.1/25 range, a gateway of 10.0.0.1, and DNS of either 10.0.0.1 or an external DNS like 8.8.8.8.

IPv4: 10.0.0.100
Gateway: 10.0.0.1
DNS: 10.0.0.1

johnpoz

"10.0.0.1/25 range"

That is not a network address, that is a host address with a mask.. The network address would be 10.0.0.0/25, once you move the address into an actual possible host address then it no longer is a network address but a host address with mask.

10.0.0.0/25 would be
10.0.0.0 - 10.0.0.127

Where .0 is the wire or network and .127 would be the broadcast..

KOM

OK, now from a DOS box on that client can you do:

nslookup google.com

Have you gone through the Connectivity Troubleshooting guide?

That is not a network address, that is a host address with a mask.

Yes, I know. I figured he would get the point.

kaysersosa

I'm unable to access the internet from the client at all. I can ping from the pfSense box.

Client IP provided by the DHCP of the pfSense box is 10.0.0.100.

Gertjan

@kaysersosa:

I uploaded a former config and it didn't work again.

Proofs something is not good in that config.

@kaysersosa:

Console of pfSense shows, below. It grabbed both automatically, but I did set the LAN side
WAN -> v4/DHCP: 192.168.1.101/24
LAN -> v4: 10.0.0.1/25

/25 ? I would have chosen /24 ;)
Seems fine for the rest.

@kaysersosa:

I can ping google.com from the pfsense box, but a computer attached to the LAN side of pfsense cannot access google.com.

On that PC, what says

ipconfig /all

?

edit : ok, was already asked.
nslookup
test can also show the 'why'.

A PC should obtain a gateway == IP LAN pfSense - and the DNS IP should also be this IP. pfSense will be the 'DNS' for all your network devices.

The firewall rule on LAN is the "default pass all rule", right ?

@kaysersosa:

The DNS pfsense is showing is 127.0.0.1 and 2 of the hard coded DNS addresses from the ISP router.

This is what I have - my Dashboard says the same - I'm using the default Resolver.

@kaysersosa:

Unless my understanding is incorrect, I DMZ so I don't have to enter firewall rules into both routers and I can just pass through the ISP router.

Correct. Activate DMZ or individual firewall later, if every else works.

kaysersosa

Former configs worked without issues under other ISPs. Why I included current ISP info.

No firewall rules have been added to the pfSense box other than was is created by default.

======================
nslookup from the client pc

nslookup google.com

Server: pfSense-router.localdomain
Address: 10.0.0.1

DNS request timed out.
timeout was 2 seconds.
*** Request to pfSense-router.localdomain timed-out

======================
ipconfig from the client pc

ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : ********
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : localdomain

Ethernet adapter Ethernet:

Connection-specific DNS Suffix . : localdomain
Description . . . . . . . . . . . : This Qualcomm Atheros network Controller connects you to the network.
Physical Address. . . . . . . . . : ********
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : ********(Preferred)
IPv4 Address. . . . . . . . . . . : 10.0.0.100(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.128
Lease Obtained. . . . . . . . . . : Thursday, May 3, 2018 8:06:08 AM
Lease Expires . . . . . . . . . . : Thursday, May 3, 2018 10:06:08 AM
Default Gateway . . . . . . . . . : 10.0.0.1
DHCP Server . . . . . . . . . . . : 10.0.0.1
DHCPv6 IAID . . . . . . . . . . . : ********
DHCPv6 Client DUID. . . . . . . . : ********
DNS Servers . . . . . . . . . . . : 10.0.0.1
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Ethernet 3:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : PdaNet Broadband Adapter
Physical Address. . . . . . . . . : ********
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Ethernet 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : TeamViewer VPN Adapter
Physical Address. . . . . . . . . : ********
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

KOM

DNS isn't working. Is forwarder or resolver enabled and running?

kaysersosa

@KOM:

DNS isn't working. Is forwarder or resolver enabled and running?

DNS Resolver is enabled, Forwarder is not.

Gertjan

What says :

sockstat -4l | grep 'unbound'

ps ax | grep 'unbound'

kaysersosa

@Gertjan:

What says :

sockstat -4l | grep 'unbound'

ps ax | grep 'unbound'

Shell Output - sockstat -4l | grep 'unbound'

unbound unbound 22802 5 udp4 *:53 :
unbound unbound 22802 6 tcp4 *:53 :
unbound unbound 22802 7 tcp4 127.0.0.1:953 :
unbound unbound 22802 15 udp4 *:21274 :
unbound unbound 22802 16 udp4 *:5518 :
unbound unbound 22802 17 udp4 *:56616 :
unbound unbound 22802 18 udp4 *:26302 :
unbound unbound 22802 19 udp4 *:7986 :
unbound unbound 22802 20 udp4 *:47597 :
unbound unbound 22802 21 udp4 *:39864 :
unbound unbound 22802 22 udp4 *:25131 :
unbound unbound 22802 23 udp4 *:39016 :
unbound unbound 22802 24 udp4 *:23576 :
unbound unbound 22802 25 udp4 *:54912 :
unbound unbound 22802 27 udp4 *:16242 :
unbound unbound 22802 28 udp4 *:38933 :

Shell Output - ps ax | grep 'unbound'

22802 - Ss 0:21.49 /usr/local/sbin/unbound -c /var/unbound/unbound.conf
88305 - S 0:00.00 sh -c ps ax | grep 'unbound' 2>&1
88692 - S 0:00.00 grep unbound

kaysersosa

Still not resolved, any help out there?

johnpoz

And what does diagnostics, dns lookup show for www.google.com

Validate pfsense can actually resolve..

If it can resolve but clients can not - are they actually using pfsense for dns? Post up your lan rules.

dnslookup.png_thumb

kaysersosa

@johnpoz:

And what does diagnostics, dns lookup show for www.google.com

Validate pfsense can actually resolve..

If it can resolve but clients can not - are they actually using pfsense for dns? Post up your lan rules.

DNS Lookup for www.google.com - attached

LAN Rules - attached (default install, nothing changed by me on them)

![dns lookup.jpg](/public/imported_attachments/1/dns lookup.jpg)
![dns lookup.jpg_thumb](/public/imported_attachments/1/dns lookup.jpg_thumb)
![lan rules.jpg](/public/imported_attachments/1/lan rules.jpg)
![lan rules.jpg_thumb](/public/imported_attachments/1/lan rules.jpg_thumb)

johnpoz

Well from your client do a nslookup.. or better yet dig..

What does it come back?

Why would you be showing CNAME? www.google.com does not have any cname… And where is your AAAA record.. Your isp is dicking with your dns maybe?

Also if you are using resolver, all you should see is the loopback... why do you have those 99.x.x.x ?

fromclient.png_thumb

kaysersosa

I some how magically have internet through the pfSense router now. No clue how or why. I have done nothing other than reboot my IPS modem yesterday, I've done this multiple times with the pfSense router attached. I had lost connection to the internet yesterday for a short time and rebooted the IPS modem.

Attached are a couple of NSLookups. The top one was from yesterday when the pfSense client didn't have any internet. The bottom is from today when I noticed it did have internet.

No clue on the CNAME or AAAA record. The 99's are default DNS from IPS router.

Any thoughts on what is going on? I'm going to leave it alone other than any testing/checks recommended here until next week. Then I'm going to try and set it up. Currently attempting to attach an AP to it and see if that works. Was another issue I had.

nslookup.txt

johnpoz

Your having connectivity problems even talking to pfsense on 10.7.13.1 from that..

Even when say its working you still had timeout for 2 seconds.

How is your client connected to this 10.7.13 network? Or unbound is starting and stopping a lot - look in your log for that.

kaysersosa

When I stated it was working the other day, the hardware setup was (IPS Modem -> AP -> Client PC).

The AP is an old Linksys WRT54GL router with DD-WRT installed and setup as a wireless switch. By working I simply mean the Client PC could get to www.google.com. It was unable at all prior.

Testing again today. The Client PC is no longer able to get to www.google.com. pfSense can still ping www.google.com. I did nothing to the system over the weekend. Left it on untouched.

This morning I changed the network layout to be similar to how it will be when put into use (IPS Modem -> Gigbit Switch -> Client PC / AP / etc.).
Still not working, meaning Client PC unable to get to www.google.com.