No LAN Internet Access
-
"10.0.0.1/25 range"
That is not a network address, that is a host address with a mask.. The network address would be 10.0.0.0/25, once you move the address into an actual possible host address then it no longer is a network address but a host address with mask.
10.0.0.0/25 would be
10.0.0.0 - 10.0.0.127Where .0 is the wire or network and .127 would be the broadcast..
-
OK, now from a DOS box on that client can you do:
nslookup google.com
Have you gone through the Connectivity Troubleshooting guide?
That is not a network address, that is a host address with a mask.
Yes, I know. I figured he would get the point.
-
I'm unable to access the internet from the client at all. I can ping from the pfSense box.
Client IP provided by the DHCP of the pfSense box is 10.0.0.100.
-
I uploaded a former config and it didn't work again.
Proofs something is not good in that config.
Console of pfSense shows, below. It grabbed both automatically, but I did set the LAN side
WAN -> v4/DHCP: 192.168.1.101/24
LAN -> v4: 10.0.0.1/25/25 ? I would have chosen /24 ;)
Seems fine for the rest.I can ping google.com from the pfsense box, but a computer attached to the LAN side of pfsense cannot access google.com.
On that PC, what says
ipconfig /all
?
edit : ok, was already asked.
nslookup
test can also show the 'why'.A PC should obtain a gateway == IP LAN pfSense - and the DNS IP should also be this IP. pfSense will be the 'DNS' for all your network devices.
The firewall rule on LAN is the "default pass all rule", right ?
The DNS pfsense is showing is 127.0.0.1 and 2 of the hard coded DNS addresses from the ISP router.
This is what I have - my Dashboard says the same - I'm using the default Resolver.
Unless my understanding is incorrect, I DMZ so I don't have to enter firewall rules into both routers and I can just pass through the ISP router.
Correct. Activate DMZ or individual firewall later, if every else works.
-
Former configs worked without issues under other ISPs. Why I included current ISP info.
No firewall rules have been added to the pfSense box other than was is created by default.
======================
nslookup from the client pcnslookup google.com
Server: pfSense-router.localdomain
Address: 10.0.0.1DNS request timed out.
timeout was 2 seconds.
*** Request to pfSense-router.localdomain timed-out======================
ipconfig from the client pcipconfig /all
Windows IP Configuration
Host Name . . . . . . . . . . . . : ********
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : localdomainEthernet adapter Ethernet:
Connection-specific DNS Suffix . : localdomain
Description . . . . . . . . . . . : This Qualcomm Atheros network Controller connects you to the network.
Physical Address. . . . . . . . . : ********
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : ********(Preferred)
IPv4 Address. . . . . . . . . . . : 10.0.0.100(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.128
Lease Obtained. . . . . . . . . . : Thursday, May 3, 2018 8:06:08 AM
Lease Expires . . . . . . . . . . : Thursday, May 3, 2018 10:06:08 AM
Default Gateway . . . . . . . . . : 10.0.0.1
DHCP Server . . . . . . . . . . . : 10.0.0.1
DHCPv6 IAID . . . . . . . . . . . : ********
DHCPv6 Client DUID. . . . . . . . : ********
DNS Servers . . . . . . . . . . . : 10.0.0.1
NetBIOS over Tcpip. . . . . . . . : EnabledEthernet adapter Ethernet 3:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : PdaNet Broadband Adapter
Physical Address. . . . . . . . . : ********
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : YesEthernet adapter Ethernet 2:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : TeamViewer VPN Adapter
Physical Address. . . . . . . . . : ********
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes -
DNS isn't working. Is forwarder or resolver enabled and running?
-
@KOM:
DNS isn't working. Is forwarder or resolver enabled and running?
DNS Resolver is enabled, Forwarder is not.
-
What says :
sockstat -4l | grep 'unbound'
ps ax | grep 'unbound'
-
What says :
sockstat -4l | grep 'unbound'
ps ax | grep 'unbound'
Shell Output - sockstat -4l | grep 'unbound'
unbound unbound 22802 5 udp4 *:53 :
unbound unbound 22802 6 tcp4 *:53 :
unbound unbound 22802 7 tcp4 127.0.0.1:953 :
unbound unbound 22802 15 udp4 *:21274 :
unbound unbound 22802 16 udp4 *:5518 :
unbound unbound 22802 17 udp4 *:56616 :
unbound unbound 22802 18 udp4 *:26302 :
unbound unbound 22802 19 udp4 *:7986 :
unbound unbound 22802 20 udp4 *:47597 :
unbound unbound 22802 21 udp4 *:39864 :
unbound unbound 22802 22 udp4 *:25131 :
unbound unbound 22802 23 udp4 *:39016 :
unbound unbound 22802 24 udp4 *:23576 :
unbound unbound 22802 25 udp4 *:54912 :
unbound unbound 22802 27 udp4 *:16242 :
unbound unbound 22802 28 udp4 *:38933 :Shell Output - ps ax | grep 'unbound'
22802 - Ss 0:21.49 /usr/local/sbin/unbound -c /var/unbound/unbound.conf
88305 - S 0:00.00 sh -c ps ax | grep 'unbound' 2>&1
88692 - S 0:00.00 grep unbound -
Still not resolved, any help out there?
-
And what does diagnostics, dns lookup show for www.google.com
Validate pfsense can actually resolve..
If it can resolve but clients can not - are they actually using pfsense for dns? Post up your lan rules.
-
And what does diagnostics, dns lookup show for www.google.com
Validate pfsense can actually resolve..
If it can resolve but clients can not - are they actually using pfsense for dns? Post up your lan rules.
DNS Lookup for www.google.com - attached
LAN Rules - attached (default install, nothing changed by me on them)
![dns lookup.jpg](/public/imported_attachments/1/dns lookup.jpg)
![dns lookup.jpg_thumb](/public/imported_attachments/1/dns lookup.jpg_thumb)
![lan rules.jpg](/public/imported_attachments/1/lan rules.jpg)
![lan rules.jpg_thumb](/public/imported_attachments/1/lan rules.jpg_thumb) -
Well from your client do a nslookup.. or better yet dig..
What does it come back?
Why would you be showing CNAME? www.google.com does not have any cname… And where is your AAAA record.. Your isp is dicking with your dns maybe?
Also if you are using resolver, all you should see is the loopback... why do you have those 99.x.x.x ?
-
I some how magically have internet through the pfSense router now. No clue how or why. I have done nothing other than reboot my IPS modem yesterday, I've done this multiple times with the pfSense router attached. I had lost connection to the internet yesterday for a short time and rebooted the IPS modem.
Attached are a couple of NSLookups. The top one was from yesterday when the pfSense client didn't have any internet. The bottom is from today when I noticed it did have internet.
No clue on the CNAME or AAAA record. The 99's are default DNS from IPS router.
Any thoughts on what is going on? I'm going to leave it alone other than any testing/checks recommended here until next week. Then I'm going to try and set it up. Currently attempting to attach an AP to it and see if that works. Was another issue I had.
-
Your having connectivity problems even talking to pfsense on 10.7.13.1 from that..
Even when say its working you still had timeout for 2 seconds.
How is your client connected to this 10.7.13 network? Or unbound is starting and stopping a lot - look in your log for that.
-
When I stated it was working the other day, the hardware setup was (IPS Modem -> AP -> Client PC).
The AP is an old Linksys WRT54GL router with DD-WRT installed and setup as a wireless switch. By working I simply mean the Client PC could get to www.google.com. It was unable at all prior.
Testing again today. The Client PC is no longer able to get to www.google.com. pfSense can still ping www.google.com. I did nothing to the system over the weekend. Left it on untouched.
This morning I changed the network layout to be similar to how it will be when put into use (IPS Modem -> Gigbit Switch -> Client PC / AP / etc.).
Still not working, meaning Client PC unable to get to www.google.com. -
And are you able to query with nslookup? Your post was timeout even talking to pfsense.
Did you look in the log, is unbound restarting over and over again?
-
nslookup - DNS request timed out on the Client PC.
Attached are the last few DNS Resolver logs.
-
You have a problem there could not fetch dnskey.
I would suggest you up the logging level and then do a few queries for stuff. Quite possible your isp is messing with resolving..
Average 20 sec processing time??
look here
Apr 23 05:43:48 unbound 10564:0 info: average recursion processing time 0.088876 sec
Apr 23 05:43:48 unbound 10564:0 info: server stats for thread 3: requestlist max 32 avg 0.991393 exceeded 0 jostled 0
Apr 23 05:43:48 unbound 10564:0 info: server stats for thread 3: 53901 queries, 49987 answers from cache, 3914 recursions, 10726 prefetch, 0 rejected by ip ratelimitingYour dns is not functioning… See my processing time and how many queries..
I would suggest you install dig and do a trace for something to see why your having problems...
E:\>dig www.google.com +trace ; <<>> DiG 9.11.3 <<>> www.google.com +trace ;; global options: +cmd . 514566 IN NS a.root-servers.net. . 514566 IN NS b.root-servers.net. . 514566 IN NS c.root-servers.net. . 514566 IN NS d.root-servers.net. . 514566 IN NS e.root-servers.net. . 514566 IN NS f.root-servers.net. . 514566 IN NS g.root-servers.net. . 514566 IN NS h.root-servers.net. . 514566 IN NS i.root-servers.net. . 514566 IN NS j.root-servers.net. . 514566 IN NS k.root-servers.net. . 514566 IN NS l.root-servers.net. . 514566 IN NS m.root-servers.net. . 514566 IN RRSIG NS 8 0 518400 20180520050000 20180507040000 39570 . hH/aRa4rRPFYuy0W2RrTkOPFoGuQoyatqK7QbSQWY1D4/iZlZIRR2Zsj MIeG+GYZ+9u3Yq5t4wDrrMmgZQ39NTY1PURh+ZRz7LBZl8ZxlAp89xkS IB6P8/7k2wcAlIcLK7U1ukayR2SyPu3GWFt3z9loY15e++MuRnAtE9vM zjtG/9ioWsQMugMQ/JPH04645E5oKNunHiSyi92h018JS4CKsignxI/T 878CDEm7beFBLe1ouJZJlJoeNvemLJT3rhVZ0w1AzTX8cyGLtTggkNX2 jeQcFgciRfVXEbdnJ3ivvqIYjbKYL0NdVsrkVNdS86cH82Z0vuuJjNFT wiyIGA== ;; Received 525 bytes from 192.168.3.10#53(192.168.3.10) in 1 ms com. 172800 IN NS a.gtld-servers.net. com. 172800 IN NS b.gtld-servers.net. com. 172800 IN NS c.gtld-servers.net. com. 172800 IN NS d.gtld-servers.net. com. 172800 IN NS e.gtld-servers.net. com. 172800 IN NS f.gtld-servers.net. com. 172800 IN NS g.gtld-servers.net. com. 172800 IN NS h.gtld-servers.net. com. 172800 IN NS i.gtld-servers.net. com. 172800 IN NS j.gtld-servers.net. com. 172800 IN NS k.gtld-servers.net. com. 172800 IN NS l.gtld-servers.net. com. 172800 IN NS m.gtld-servers.net. com. 86400 IN DS 30909 8 2 E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CF C41A5766 com. 86400 IN RRSIG DS 8 1 86400 20180520050000 20180507040000 39570 . GiCsdUG5kyf5edT12Gdr/DT6dNUqILHfdqZ2t1vS0VY8YErVjoXRwNlr SoufI39JoZ6ChuMA3wLCo+Q9uTtRoqDKHKJU8MS7MXWyhitbQeL1cdSW insHZZVMltOH4lblQgSSPm4rte4fW+4J9lissWSPNW4d1JnHTTVtDPo+ A6jx6aYpapREv69eE89CfZ8lWBxyr788PDLw/bpwQYX5FuwzpmVZeRCQ G5j/ujt2wGn1NGs/EX3cOXpX4+0RS6fTo4YhTDZ2IIOoMg3ISz55w8Ai FczfOxxW35Gy6dhf6pV1VX943AepsYTUHjDVnK6aHTiwUcrShBtvDmXb Otk2Vg== ;; Received 1174 bytes from 192.58.128.30#53(j.root-servers.net) in 45 ms google.com. 172800 IN NS ns2.google.com. google.com. 172800 IN NS ns1.google.com. google.com. 172800 IN NS ns3.google.com. google.com. 172800 IN NS ns4.google.com. CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN NSEC3 1 1 0 - CK0Q1GIN43N1ARRC9OSM6QPQR81H5M9A NS SOA RRSIG DNSKEY NSEC3PARAM CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN RRSIG NSEC3 8 2 86400 20180512044510 20180505033510 36707 com. ojEZ8Iv1J7vE5QEfjJM1YQSdFLvHhVqppd6HA3cZDZff+TdX5YSsNPf1 gVepdTn0W03LMHSmQhtZJKWE7TzTpQfJUF+UZz/Nj8CPOvRJ+hdDfoPw CIAg5ZVfzfYNSrdsOGFbkxGQ6drlE/Os5tnTcQnrDJktwBilZcohoAkn ioY= S849LHDDSVU9A9N2FIRO5NKMQB321BEP.com. 86400 IN NSEC3 1 1 0 - S84CEFMDU6ABFSN4V0L2VLLOASCD5IV2 NS DS RRSIG S849LHDDSVU9A9N2FIRO5NKMQB321BEP.com. 86400 IN RRSIG NSEC3 8 2 86400 20180513051411 20180506040411 36707 com. kQVTehhrmgeTzalwPVhWotamwKGxGb5VuGsm/T+FGU5pxaSNcutQ+YXI uukidbNumZGDv7p8hKNWy3C+RZ/o6Cm5puaxwslSBXL8jOiXau7uOnIb qFFN2pWrCsQcBUfXDTZg+mpUBk2DFPV7Ny+QZXnAAzfthbmu0L9sD+VA TBs= ;; Received 776 bytes from 192.52.178.30#53(k.gtld-servers.net) in 36 ms www.google.com. 300 IN A 172.217.6.100 ;; Received 48 bytes from 216.239.34.10#53(ns2.google.com) in 24 ms E:\>
That is a full resolve from my client.. lets take pfsense out of the picture for you resolving and do some tests with dig on your client. You can download it here, just install the tools in the bind install.
https://www.isc.org/downloads/
Your dns is not functioning correctly that is for sure.. You could try using forwarding mode vs resolving. But I would be interested in finding the root cause of your problem.
-
Ran DIG from the Client PC, below is the output.
C:\Program Files\ISC BIND 9\bin>dig www.google.com +trace
; <<>> DiG 9.11.3 <<>> www.google.com +trace
;; global options: +cmd
;; Received 12 bytes from 10.7.13.1#53(10.7.13.1) in 1 msC:\Program Files\ISC BIND 9\bin>