Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    No LAN Internet Access

    Scheduled Pinned Locked Moved Problems Installing or Upgrading pfSense Software
    61 Posts 4 Posters 11.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator
      last edited by

      that is not a +trace..

      You got back nothing from unbound..  You should of gotten back roots and walked down from there.

      Force getting the roots… do say

      E:>dig @8.8.8.8 www.google.com +trace

      ; <<>> DiG 9.11.3 <<>> @8.8.8.8 www.google.com +trace
      ; (1 server found)
      ;; global options: +cmd
      .                      175855  IN      NS      a.root-servers.net.
      .                      175855  IN      NS      b.root-servers.net.
      .                      175855  IN      NS      c.root-servers.net.
      .                      175855  IN      NS      d.root-servers.net.
      .                      175855  IN      NS      e.root-servers.net.
      .                      175855  IN      NS      f.root-servers.net.
      .                      175855  IN      NS      g.root-servers.net.
      .                      175855  IN      NS      h.root-servers.net.
      .                      175855  IN      NS      i.root-servers.net.
      .                      175855  IN      NS      j.root-servers.net.
      .                      175855  IN      NS      k.root-servers.net.
      .                      175855  IN      NS      l.root-servers.net.
      .                      175855  IN      NS      m.root-servers.net.
      .                      175855  IN      RRSIG  NS 8 0 518400 20180519170000 20180506160000 39570 . l8I2NF/qog7oKasVnbc5E50ay3bAXx+PahYvKlyxf+IpcoJdPrl6LUIO Z7Sfx+GJRaUyNCnBsiBdQqjyGKE/RSv+HtbUlwGb57lwOJsV3GAcCDBw gePDO350Q7kSueVqY+/Xdjyc4BbhhmGe5X4PdMONI8V74k2qMyrNVjzE vi8yL6IWizDPt3K9boWxJHVpE03GRxC9NfxtCrcTzwXdIHUBSnK6ZoYt Bys2S6/mqqeJyqJqpglpZzuvOw03MTplye0HcGZ/w7u5u2Pdhxm7Oghj Kepa0xtQEuT3oPpBFRvZTg5MKCPoeZgy82Wq8heakZztqN/gpvAgrmoL iO2mvA==
      ;; Received 525 bytes from 8.8.8.8#53(8.8.8.8) in 12 ms

      notice I got back the roots from 8.8.8.8

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      1 Reply Last reply Reply Quote 0
      • kaysersosaK
        kaysersosa
        last edited by

        From the Client PC

        C:\Program Files\ISC BIND 9\bin>dig @8.8.8.8 www.google.com +trace

        ; <<>> DiG 9.11.3 <<>> @8.8.8.8 www.google.com +trace
        ; (1 server found)
        ;; global options: +cmd
        .                      115791  IN      NS      a.root-servers.net.
        .                      115791  IN      NS      b.root-servers.net.
        .                      115791  IN      NS      c.root-servers.net.
        .                      115791  IN      NS      d.root-servers.net.
        .                      115791  IN      NS      e.root-servers.net.
        .                      115791  IN      NS      f.root-servers.net.
        .                      115791  IN      NS      g.root-servers.net.
        .                      115791  IN      NS      h.root-servers.net.
        .                      115791  IN      NS      i.root-servers.net.
        .                      115791  IN      NS      j.root-servers.net.
        .                      115791  IN      NS      k.root-servers.net.
        .                      115791  IN      NS      l.root-servers.net.
        .                      115791  IN      NS      m.root-servers.net.
        .                      115791  IN      RRSIG  NS 8 0 518400 20180518170000 20180505160000 39570 . NEoKyFHHEdXvMg1bip/9XeAQhV22bQa04O5tUH/g2SN/9AcYb0vbkLP/ 1ur6HNU8K57rUWZl94Zmbh7NA4gGQ7SarA9OvG9wz4YrdLkWEV9Up+JI JvvH9d+IlFQdlsV9XGwZ9xJRAnz2KflsOlFO8/vbRIQyLSJXANaNp/NV KYkOaWgjghVzN8x5qbsErU9P5G/UUQ6BZdis03rGLOMkchRggV9y7+/G 5JlPtyXoNBczvDS5j29yTV0F3P3Tf5cmtiK2DfwD4Lk6thTymBcf7qfL Ga9amC4QdfvDUhXVzPOFTARvST7yzIDCqwqbuW8s7imw2Z23Q2TqTqwq 6RDhbQ==
        couldn't get address for 'a.root-servers.net': not found
        couldn't get address for 'b.root-servers.net': not found
        couldn't get address for 'c.root-servers.net': not found
        couldn't get address for 'd.root-servers.net': not found
        couldn't get address for 'e.root-servers.net': not found
        couldn't get address for 'f.root-servers.net': not found
        couldn't get address for 'g.root-servers.net': not found
        couldn't get address for 'h.root-servers.net': not found
        couldn't get address for 'i.root-servers.net': not found
        couldn't get address for 'j.root-servers.net': not found
        couldn't get address for 'k.root-servers.net': not found
        couldn't get address for 'l.root-servers.net': not found
        couldn't get address for 'm.root-servers.net': not found
        dig: couldn't get address for 'a.root-servers.net': no more

        C:\Program Files\ISC BIND 9\bin>

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by

          dude change your client to use 8.8.8.8 as its dns… Then do you dig..

          So that allowed you to get the roots, but after that client will use its default dns to get the IP address of roots.  Your case that seems to be broken.

          If you set your client to use 8.8.8.8 and then do a

          dig www.google.com +trace

          it should work

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • kaysersosaK
            kaysersosa
            last edited by

            I think I know where to make that change, see attachment.
            Added the 8.8.8.8 and the 8.8.4.4 and unchecked DNS Server Override.

            Run on Client PC after change above.

            C:\Program Files\ISC BIND 9\bin>dig www.google.com +trace

            ; <<>> DiG 9.11.3 <<>> www.google.com +trace
            ;; global options: +cmd
            ;; Received 12 bytes from 10.7.13.1#53(10.7.13.1) in 0 ms

            C:\Program Files\ISC BIND 9\bin>

            ![sys setup.png](/public/imported_attachments/1/sys setup.png)
            ![sys setup.png_thumb](/public/imported_attachments/1/sys setup.png_thumb)

            1 Reply Last reply Reply Quote 0
            • kaysersosaK
              kaysersosa
              last edited by

              Forgot to mention that on the Dashboard page under DNS server(s) I see the following.

              127.0.0.1
              8.8.8.8
              8.8.4.4

              Prior it was showing
              127.0.0.1
              99…from ISP modem
              99...from ISP modem
              anything I added

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                all meaning less..

                Can your client work when pointing directly at 8.8.8.8 and not to pfsense.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • kaysersosaK
                  kaysersosa
                  last edited by

                  Yes, hooked directly up to the ISP modem it can connect to the internet.

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    Dude point your client to 8.8.8.8 leave it behind pfsense..

                    This is not that hard to pin down..

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • kaysersosaK
                      kaysersosa
                      last edited by

                      Sorry miss-understood what you were asking.

                      Network setup
                      ISP Modem -> Gig Switch -> Client PC / AP / etc

                      I hard-set 8.8.8.8 as the DNS on the Client under Network/Properties.

                      The client can now get to the internet.

                      1 Reply Last reply Reply Quote 0
                      • kaysersosaK
                        kaysersosa
                        last edited by

                        So I should be good if I can get rid of the 127.0.0.1 on the pfSense router?

                        Dashboard page under DNS server(s) I see the following.

                        127.0.0.1
                        8.8.8.8
                        8.8.4.4

                        Where is this setting at?

                        1 Reply Last reply Reply Quote 0
                        • kaysersosaK
                          kaysersosa
                          last edited by

                          Network setup
                          ISP Modem -> pfSense -> Gig Switch -> Client PC / AP / etc

                          Forgot to add the pfSense in earlier in the thread.

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by

                            If client is working fine using 8.8.8.8 then you have 2 choices troubleshoot why pfsense resolving is haivng a problem.

                            Or just turn off resolving mode and use forwarder mode and point to 8.8.8.8

                            No you are never going to want to remove loopback, that is pfsense asking itself.  If pfsense doesn't ask itself it will never be able to resolve any of your local host names.  And your clients your going to want to point back to pfsense once pfsense is just forwarding..

                            But pfsense should be able to just resolve..  So I would be more curious to why it can not resolve?

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            1 Reply Last reply Reply Quote 0
                            • kaysersosaK
                              kaysersosa
                              last edited by

                              Just for your reference.  The ISP modem has 2 ports on it.  I have my pfSense router in one of the ports and my active DD-WRT router in the other.  DD-WRT is running my home network currently.

                              Ok, so I removed the hard-set 8.8.8.8 as the DNS on the Client under Network/Properties.  Then on pfSense under Services/DNS Resolver/General Settings - unchecked enable and saved/applied and thn on pfSense under Services/DNS Forwarder I checked enable and saved/applied.  No internet on the Client PC.

                              Are there any other settings required with the DNS Forwarder?  If not and you are willing to help I'm all for attempting to troubleshoot the DNS Resolver.

                              1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator
                                last edited by

                                If your using forwarder then it should be forwarding…  It should forward to your isp dns or what it gets via its wan..  Or what you put in the settings.

                                You sure its running.. Validate that pfsense can resolve using the dns lookup...

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                1 Reply Last reply Reply Quote 0
                                • kaysersosaK
                                  kaysersosa
                                  last edited by

                                  DNS Lookup - see attached

                                  ipconfig /all  run on Client PC

                                  Ethernet adapter Ethernet:

                                  Connection-specific DNS Suffix  . : localdomain
                                    Description . . . . . . . . . . . : This Qualcomm Atheros network Controller connects you to the network.
                                    Physical Address. . . . . . . . . : MACv4
                                    DHCP Enabled. . . . . . . . . . . : Yes
                                    Autoconfiguration Enabled . . . . : Yes
                                    Link-local IPv6 Address . . . . . : fe80::940d:1541:4e1a:fb26%13(Preferred)
                                    IPv4 Address. . . . . . . . . . . : 10.7.13.100(Preferred)
                                    Subnet Mask . . . . . . . . . . . : 255.255.255.128
                                    Lease Obtained. . . . . . . . . . : Monday, May 7, 2018 2:31:05 PM
                                    Lease Expires . . . . . . . . . . : Monday, May 7, 2018 4:31:05 PM
                                    Default Gateway . . . . . . . . . : 10.7.13.1
                                    DHCP Server . . . . . . . . . . . : 10.7.13.1
                                    DHCPv6 IAID . . . . . . . . . . . : 62676980
                                    DHCPv6 Client DUID. . . . . . . . : MACv6
                                    DNS Servers . . . . . . . . . . . : 10.7.13.1
                                    NetBIOS over Tcpip. . . . . . . . : Enabled

                                  ![dns lookup.jpg](/public/imported_attachments/1/dns lookup.jpg)
                                  ![dns lookup.jpg_thumb](/public/imported_attachments/1/dns lookup.jpg_thumb)

                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by

                                    Ok dude loopback didn't respond… So yeah that is PROBLEM..

                                    Also 600+ms for google to answer?  Yeah that is a problem..

                                    Are you on some sort of sat connection or something?  I would not think it possible for 8.8.8.8 to take that long to respond from anywhere on the planet with it being a anycast address and located in regions all over the planet.

                                    Here I just did a query to google... 11ms

                                    ;; ANSWER SECTION:
                                    www.google.com.        213    IN      A      172.217.1.36

                                    ;; Query time: 11 msec
                                    ;; SERVER: 8.8.8.8#53(8.8.8.8)
                                    ;; WHEN: Mon May 07 15:00:48 Central Daylight Time 2018
                                    ;; MSG SIZE  rcvd: 59

                                    If you are seeing over 100ms to 8.8.8.8 I would say something is wrong.  You are seeing 600+ms..

                                    I can ping China from Chicago and get less than 300ms.. ;)

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    1 Reply Last reply Reply Quote 0
                                    • kaysersosaK
                                      kaysersosa
                                      last edited by

                                      Yes, I was forced to use a satellite internet so I know response times suck.  First post in this thread has details on my ISP modem.

                                      Where to next?

                                      1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by

                                        Oh wow, not sure how I missed that ;)

                                        If your on SAT… your going to have to use their DNS... You are not going to be able to resolve or use other public dns... Use of the SAT isp dns is going to be your really only viable option..  Anything else is going to be horrible.

                                        And you sure can not resolve on such a high latency connection.

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        1 Reply Last reply Reply Quote 0
                                        • kaysersosaK
                                          kaysersosa
                                          last edited by

                                          That would explain why my old pfSense configs wouldn't work, didn't have Sat internet for them.

                                          So what do I need to config on pfSense to get it working for Sat internet?

                                          1 Reply Last reply Reply Quote 0
                                          • kaysersosaK
                                            kaysersosa
                                            last edited by

                                            So this is what I have done and internet appears to be working right now on the Client PC.

                                            on pfSense
                                            Under System/General Setup - I removed the DNS Servers and checked DNS Server Override.

                                            Under Services/DNS Forwarder - checked enabled and saved/applied

                                            Under Services/DNS Resolver - unchecked enabled and saved/applied

                                            on Dashboard the DNS Servers listed are the 127.0.0.1, and the pair of 99's that come from the ISP modem.

                                            Client PC is also getting everything sent to it, nothing is hard-set.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.