Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    No LAN Internet Access

    Scheduled Pinned Locked Moved Problems Installing or Upgrading pfSense Software
    61 Posts 4 Posters 11.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • kaysersosaK
      kaysersosa
      last edited by

      When I stated it was working the other day, the hardware setup was (IPS Modem -> AP -> Client PC).

      The AP is an old Linksys WRT54GL router with DD-WRT installed and setup as a wireless switch.  By working I simply mean the Client PC could get to www.google.com.  It was unable at all prior.

      Testing again today.  The Client PC is no longer able to get to www.google.com.  pfSense can still ping www.google.com.  I did nothing to the system over the weekend.  Left it on untouched.

      This morning I changed the network layout to be similar to how it will be when put into use (IPS Modem -> Gigbit Switch -> Client PC / AP / etc.).
      Still not working, meaning Client PC unable to get to www.google.com.

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        And are you able to query with nslookup?  Your post was timeout even talking to pfsense.

        Did you look in the log, is unbound restarting over and over again?

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • kaysersosaK
          kaysersosa
          last edited by

          nslookup - DNS request timed out on the Client PC.

          Attached are the last few DNS Resolver logs.

          unbound.jpg
          unbound.jpg_thumb

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            You have a problem there could not fetch dnskey.

            I would suggest you up the logging level and then do a few queries for stuff.  Quite possible your isp is messing with resolving..

            Average 20 sec processing time??

            look here
            Apr 23 05:43:48 unbound 10564:0 info: average recursion processing time 0.088876 sec
            Apr 23 05:43:48 unbound 10564:0 info: server stats for thread 3: requestlist max 32 avg 0.991393 exceeded 0 jostled 0
            Apr 23 05:43:48 unbound 10564:0 info: server stats for thread 3: 53901 queries, 49987 answers from cache, 3914 recursions, 10726 prefetch, 0 rejected by ip ratelimiting

            Your dns is not functioning…  See my processing time and how many queries..

            I would suggest you install dig and do a trace for something to see why your having problems...

            
            E:\>dig www.google.com +trace
            
            ; <<>> DiG 9.11.3 <<>> www.google.com +trace
            ;; global options: +cmd
            .                       514566  IN      NS      a.root-servers.net.
            .                       514566  IN      NS      b.root-servers.net.
            .                       514566  IN      NS      c.root-servers.net.
            .                       514566  IN      NS      d.root-servers.net.
            .                       514566  IN      NS      e.root-servers.net.
            .                       514566  IN      NS      f.root-servers.net.
            .                       514566  IN      NS      g.root-servers.net.
            .                       514566  IN      NS      h.root-servers.net.
            .                       514566  IN      NS      i.root-servers.net.
            .                       514566  IN      NS      j.root-servers.net.
            .                       514566  IN      NS      k.root-servers.net.
            .                       514566  IN      NS      l.root-servers.net.
            .                       514566  IN      NS      m.root-servers.net.
            .                       514566  IN      RRSIG   NS 8 0 518400 20180520050000 20180507040000 39570 . hH/aRa4rRPFYuy0W2RrTkOPFoGuQoyatqK7QbSQWY1D4/iZlZIRR2Zsj MIeG+GYZ+9u3Yq5t4wDrrMmgZQ39NTY1PURh+ZRz7LBZl8ZxlAp89xkS IB6P8/7k2wcAlIcLK7U1ukayR2SyPu3GWFt3z9loY15e++MuRnAtE9vM zjtG/9ioWsQMugMQ/JPH04645E5oKNunHiSyi92h018JS4CKsignxI/T 878CDEm7beFBLe1ouJZJlJoeNvemLJT3rhVZ0w1AzTX8cyGLtTggkNX2 jeQcFgciRfVXEbdnJ3ivvqIYjbKYL0NdVsrkVNdS86cH82Z0vuuJjNFT wiyIGA==
            ;; Received 525 bytes from 192.168.3.10#53(192.168.3.10) in 1 ms
            
            com.                    172800  IN      NS      a.gtld-servers.net.
            com.                    172800  IN      NS      b.gtld-servers.net.
            com.                    172800  IN      NS      c.gtld-servers.net.
            com.                    172800  IN      NS      d.gtld-servers.net.
            com.                    172800  IN      NS      e.gtld-servers.net.
            com.                    172800  IN      NS      f.gtld-servers.net.
            com.                    172800  IN      NS      g.gtld-servers.net.
            com.                    172800  IN      NS      h.gtld-servers.net.
            com.                    172800  IN      NS      i.gtld-servers.net.
            com.                    172800  IN      NS      j.gtld-servers.net.
            com.                    172800  IN      NS      k.gtld-servers.net.
            com.                    172800  IN      NS      l.gtld-servers.net.
            com.                    172800  IN      NS      m.gtld-servers.net.
            com.                    86400   IN      DS      30909 8 2 E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CF C41A5766
            com.                    86400   IN      RRSIG   DS 8 1 86400 20180520050000 20180507040000 39570 . GiCsdUG5kyf5edT12Gdr/DT6dNUqILHfdqZ2t1vS0VY8YErVjoXRwNlr SoufI39JoZ6ChuMA3wLCo+Q9uTtRoqDKHKJU8MS7MXWyhitbQeL1cdSW insHZZVMltOH4lblQgSSPm4rte4fW+4J9lissWSPNW4d1JnHTTVtDPo+ A6jx6aYpapREv69eE89CfZ8lWBxyr788PDLw/bpwQYX5FuwzpmVZeRCQ G5j/ujt2wGn1NGs/EX3cOXpX4+0RS6fTo4YhTDZ2IIOoMg3ISz55w8Ai FczfOxxW35Gy6dhf6pV1VX943AepsYTUHjDVnK6aHTiwUcrShBtvDmXb Otk2Vg==
            ;; Received 1174 bytes from 192.58.128.30#53(j.root-servers.net) in 45 ms
            
            google.com.             172800  IN      NS      ns2.google.com.
            google.com.             172800  IN      NS      ns1.google.com.
            google.com.             172800  IN      NS      ns3.google.com.
            google.com.             172800  IN      NS      ns4.google.com.
            CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN NSEC3 1 1 0 - CK0Q1GIN43N1ARRC9OSM6QPQR81H5M9A  NS SOA RRSIG DNSKEY NSEC3PARAM
            CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN RRSIG NSEC3 8 2 86400 20180512044510 20180505033510 36707 com. ojEZ8Iv1J7vE5QEfjJM1YQSdFLvHhVqppd6HA3cZDZff+TdX5YSsNPf1 gVepdTn0W03LMHSmQhtZJKWE7TzTpQfJUF+UZz/Nj8CPOvRJ+hdDfoPw CIAg5ZVfzfYNSrdsOGFbkxGQ6drlE/Os5tnTcQnrDJktwBilZcohoAkn ioY=
            S849LHDDSVU9A9N2FIRO5NKMQB321BEP.com. 86400 IN NSEC3 1 1 0 - S84CEFMDU6ABFSN4V0L2VLLOASCD5IV2  NS DS RRSIG
            S849LHDDSVU9A9N2FIRO5NKMQB321BEP.com. 86400 IN RRSIG NSEC3 8 2 86400 20180513051411 20180506040411 36707 com. kQVTehhrmgeTzalwPVhWotamwKGxGb5VuGsm/T+FGU5pxaSNcutQ+YXI uukidbNumZGDv7p8hKNWy3C+RZ/o6Cm5puaxwslSBXL8jOiXau7uOnIb qFFN2pWrCsQcBUfXDTZg+mpUBk2DFPV7Ny+QZXnAAzfthbmu0L9sD+VA TBs=
            ;; Received 776 bytes from 192.52.178.30#53(k.gtld-servers.net) in 36 ms
            
            www.google.com.         300     IN      A       172.217.6.100
            ;; Received 48 bytes from 216.239.34.10#53(ns2.google.com) in 24 ms
            
            E:\>
            
            

            That is a full resolve from my client.. lets take pfsense out of the picture for you resolving and do some tests with dig on your client.  You can download it here, just install the tools in the bind install.

            https://www.isc.org/downloads/

            Your dns is not functioning correctly that is for sure.. You could try using forwarding mode vs resolving. But I would be interested in finding the root cause of your problem.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • kaysersosaK
              kaysersosa
              last edited by

              Ran DIG from the Client PC, below is the output.

              C:\Program Files\ISC BIND 9\bin>dig www.google.com +trace

              ; <<>> DiG 9.11.3 <<>> www.google.com +trace
              ;; global options: +cmd
              ;; Received 12 bytes from 10.7.13.1#53(10.7.13.1) in 1 ms

              C:\Program Files\ISC BIND 9\bin>

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                that is not a +trace..

                You got back nothing from unbound..  You should of gotten back roots and walked down from there.

                Force getting the roots… do say

                E:>dig @8.8.8.8 www.google.com +trace

                ; <<>> DiG 9.11.3 <<>> @8.8.8.8 www.google.com +trace
                ; (1 server found)
                ;; global options: +cmd
                .                      175855  IN      NS      a.root-servers.net.
                .                      175855  IN      NS      b.root-servers.net.
                .                      175855  IN      NS      c.root-servers.net.
                .                      175855  IN      NS      d.root-servers.net.
                .                      175855  IN      NS      e.root-servers.net.
                .                      175855  IN      NS      f.root-servers.net.
                .                      175855  IN      NS      g.root-servers.net.
                .                      175855  IN      NS      h.root-servers.net.
                .                      175855  IN      NS      i.root-servers.net.
                .                      175855  IN      NS      j.root-servers.net.
                .                      175855  IN      NS      k.root-servers.net.
                .                      175855  IN      NS      l.root-servers.net.
                .                      175855  IN      NS      m.root-servers.net.
                .                      175855  IN      RRSIG  NS 8 0 518400 20180519170000 20180506160000 39570 . l8I2NF/qog7oKasVnbc5E50ay3bAXx+PahYvKlyxf+IpcoJdPrl6LUIO Z7Sfx+GJRaUyNCnBsiBdQqjyGKE/RSv+HtbUlwGb57lwOJsV3GAcCDBw gePDO350Q7kSueVqY+/Xdjyc4BbhhmGe5X4PdMONI8V74k2qMyrNVjzE vi8yL6IWizDPt3K9boWxJHVpE03GRxC9NfxtCrcTzwXdIHUBSnK6ZoYt Bys2S6/mqqeJyqJqpglpZzuvOw03MTplye0HcGZ/w7u5u2Pdhxm7Oghj Kepa0xtQEuT3oPpBFRvZTg5MKCPoeZgy82Wq8heakZztqN/gpvAgrmoL iO2mvA==
                ;; Received 525 bytes from 8.8.8.8#53(8.8.8.8) in 12 ms

                notice I got back the roots from 8.8.8.8

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • kaysersosaK
                  kaysersosa
                  last edited by

                  From the Client PC

                  C:\Program Files\ISC BIND 9\bin>dig @8.8.8.8 www.google.com +trace

                  ; <<>> DiG 9.11.3 <<>> @8.8.8.8 www.google.com +trace
                  ; (1 server found)
                  ;; global options: +cmd
                  .                      115791  IN      NS      a.root-servers.net.
                  .                      115791  IN      NS      b.root-servers.net.
                  .                      115791  IN      NS      c.root-servers.net.
                  .                      115791  IN      NS      d.root-servers.net.
                  .                      115791  IN      NS      e.root-servers.net.
                  .                      115791  IN      NS      f.root-servers.net.
                  .                      115791  IN      NS      g.root-servers.net.
                  .                      115791  IN      NS      h.root-servers.net.
                  .                      115791  IN      NS      i.root-servers.net.
                  .                      115791  IN      NS      j.root-servers.net.
                  .                      115791  IN      NS      k.root-servers.net.
                  .                      115791  IN      NS      l.root-servers.net.
                  .                      115791  IN      NS      m.root-servers.net.
                  .                      115791  IN      RRSIG  NS 8 0 518400 20180518170000 20180505160000 39570 . NEoKyFHHEdXvMg1bip/9XeAQhV22bQa04O5tUH/g2SN/9AcYb0vbkLP/ 1ur6HNU8K57rUWZl94Zmbh7NA4gGQ7SarA9OvG9wz4YrdLkWEV9Up+JI JvvH9d+IlFQdlsV9XGwZ9xJRAnz2KflsOlFO8/vbRIQyLSJXANaNp/NV KYkOaWgjghVzN8x5qbsErU9P5G/UUQ6BZdis03rGLOMkchRggV9y7+/G 5JlPtyXoNBczvDS5j29yTV0F3P3Tf5cmtiK2DfwD4Lk6thTymBcf7qfL Ga9amC4QdfvDUhXVzPOFTARvST7yzIDCqwqbuW8s7imw2Z23Q2TqTqwq 6RDhbQ==
                  couldn't get address for 'a.root-servers.net': not found
                  couldn't get address for 'b.root-servers.net': not found
                  couldn't get address for 'c.root-servers.net': not found
                  couldn't get address for 'd.root-servers.net': not found
                  couldn't get address for 'e.root-servers.net': not found
                  couldn't get address for 'f.root-servers.net': not found
                  couldn't get address for 'g.root-servers.net': not found
                  couldn't get address for 'h.root-servers.net': not found
                  couldn't get address for 'i.root-servers.net': not found
                  couldn't get address for 'j.root-servers.net': not found
                  couldn't get address for 'k.root-servers.net': not found
                  couldn't get address for 'l.root-servers.net': not found
                  couldn't get address for 'm.root-servers.net': not found
                  dig: couldn't get address for 'a.root-servers.net': no more

                  C:\Program Files\ISC BIND 9\bin>

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    dude change your client to use 8.8.8.8 as its dns… Then do you dig..

                    So that allowed you to get the roots, but after that client will use its default dns to get the IP address of roots.  Your case that seems to be broken.

                    If you set your client to use 8.8.8.8 and then do a

                    dig www.google.com +trace

                    it should work

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • kaysersosaK
                      kaysersosa
                      last edited by

                      I think I know where to make that change, see attachment.
                      Added the 8.8.8.8 and the 8.8.4.4 and unchecked DNS Server Override.

                      Run on Client PC after change above.

                      C:\Program Files\ISC BIND 9\bin>dig www.google.com +trace

                      ; <<>> DiG 9.11.3 <<>> www.google.com +trace
                      ;; global options: +cmd
                      ;; Received 12 bytes from 10.7.13.1#53(10.7.13.1) in 0 ms

                      C:\Program Files\ISC BIND 9\bin>

                      ![sys setup.png](/public/imported_attachments/1/sys setup.png)
                      ![sys setup.png_thumb](/public/imported_attachments/1/sys setup.png_thumb)

                      1 Reply Last reply Reply Quote 0
                      • kaysersosaK
                        kaysersosa
                        last edited by

                        Forgot to mention that on the Dashboard page under DNS server(s) I see the following.

                        127.0.0.1
                        8.8.8.8
                        8.8.4.4

                        Prior it was showing
                        127.0.0.1
                        99…from ISP modem
                        99...from ISP modem
                        anything I added

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          all meaning less..

                          Can your client work when pointing directly at 8.8.8.8 and not to pfsense.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • kaysersosaK
                            kaysersosa
                            last edited by

                            Yes, hooked directly up to the ISP modem it can connect to the internet.

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by

                              Dude point your client to 8.8.8.8 leave it behind pfsense..

                              This is not that hard to pin down..

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • kaysersosaK
                                kaysersosa
                                last edited by

                                Sorry miss-understood what you were asking.

                                Network setup
                                ISP Modem -> Gig Switch -> Client PC / AP / etc

                                I hard-set 8.8.8.8 as the DNS on the Client under Network/Properties.

                                The client can now get to the internet.

                                1 Reply Last reply Reply Quote 0
                                • kaysersosaK
                                  kaysersosa
                                  last edited by

                                  So I should be good if I can get rid of the 127.0.0.1 on the pfSense router?

                                  Dashboard page under DNS server(s) I see the following.

                                  127.0.0.1
                                  8.8.8.8
                                  8.8.4.4

                                  Where is this setting at?

                                  1 Reply Last reply Reply Quote 0
                                  • kaysersosaK
                                    kaysersosa
                                    last edited by

                                    Network setup
                                    ISP Modem -> pfSense -> Gig Switch -> Client PC / AP / etc

                                    Forgot to add the pfSense in earlier in the thread.

                                    1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator
                                      last edited by

                                      If client is working fine using 8.8.8.8 then you have 2 choices troubleshoot why pfsense resolving is haivng a problem.

                                      Or just turn off resolving mode and use forwarder mode and point to 8.8.8.8

                                      No you are never going to want to remove loopback, that is pfsense asking itself.  If pfsense doesn't ask itself it will never be able to resolve any of your local host names.  And your clients your going to want to point back to pfsense once pfsense is just forwarding..

                                      But pfsense should be able to just resolve..  So I would be more curious to why it can not resolve?

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      1 Reply Last reply Reply Quote 0
                                      • kaysersosaK
                                        kaysersosa
                                        last edited by

                                        Just for your reference.  The ISP modem has 2 ports on it.  I have my pfSense router in one of the ports and my active DD-WRT router in the other.  DD-WRT is running my home network currently.

                                        Ok, so I removed the hard-set 8.8.8.8 as the DNS on the Client under Network/Properties.  Then on pfSense under Services/DNS Resolver/General Settings - unchecked enable and saved/applied and thn on pfSense under Services/DNS Forwarder I checked enable and saved/applied.  No internet on the Client PC.

                                        Are there any other settings required with the DNS Forwarder?  If not and you are willing to help I'm all for attempting to troubleshoot the DNS Resolver.

                                        1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by

                                          If your using forwarder then it should be forwarding…  It should forward to your isp dns or what it gets via its wan..  Or what you put in the settings.

                                          You sure its running.. Validate that pfsense can resolve using the dns lookup...

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          1 Reply Last reply Reply Quote 0
                                          • kaysersosaK
                                            kaysersosa
                                            last edited by

                                            DNS Lookup - see attached

                                            ipconfig /all  run on Client PC

                                            Ethernet adapter Ethernet:

                                            Connection-specific DNS Suffix  . : localdomain
                                              Description . . . . . . . . . . . : This Qualcomm Atheros network Controller connects you to the network.
                                              Physical Address. . . . . . . . . : MACv4
                                              DHCP Enabled. . . . . . . . . . . : Yes
                                              Autoconfiguration Enabled . . . . : Yes
                                              Link-local IPv6 Address . . . . . : fe80::940d:1541:4e1a:fb26%13(Preferred)
                                              IPv4 Address. . . . . . . . . . . : 10.7.13.100(Preferred)
                                              Subnet Mask . . . . . . . . . . . : 255.255.255.128
                                              Lease Obtained. . . . . . . . . . : Monday, May 7, 2018 2:31:05 PM
                                              Lease Expires . . . . . . . . . . : Monday, May 7, 2018 4:31:05 PM
                                              Default Gateway . . . . . . . . . : 10.7.13.1
                                              DHCP Server . . . . . . . . . . . : 10.7.13.1
                                              DHCPv6 IAID . . . . . . . . . . . : 62676980
                                              DHCPv6 Client DUID. . . . . . . . : MACv6
                                              DNS Servers . . . . . . . . . . . : 10.7.13.1
                                              NetBIOS over Tcpip. . . . . . . . : Enabled

                                            ![dns lookup.jpg](/public/imported_attachments/1/dns lookup.jpg)
                                            ![dns lookup.jpg_thumb](/public/imported_attachments/1/dns lookup.jpg_thumb)

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.