No LAN Internet Access

kaysersosa

Forgot to mention that on the Dashboard page under DNS server(s) I see the following.

127.0.0.1
8.8.8.8
8.8.4.4

Prior it was showing
127.0.0.1
99…from ISP modem
99...from ISP modem
anything I added

johnpoz

all meaning less..

Can your client work when pointing directly at 8.8.8.8 and not to pfsense.

kaysersosa

Yes, hooked directly up to the ISP modem it can connect to the internet.

johnpoz

Dude point your client to 8.8.8.8 leave it behind pfsense..

This is not that hard to pin down..

kaysersosa

Sorry miss-understood what you were asking.

Network setup
ISP Modem -> Gig Switch -> Client PC / AP / etc

I hard-set 8.8.8.8 as the DNS on the Client under Network/Properties.

The client can now get to the internet.

kaysersosa

So I should be good if I can get rid of the 127.0.0.1 on the pfSense router?

Dashboard page under DNS server(s) I see the following.

127.0.0.1
8.8.8.8
8.8.4.4

Where is this setting at?

kaysersosa

Network setup
ISP Modem -> pfSense -> Gig Switch -> Client PC / AP / etc

Forgot to add the pfSense in earlier in the thread.

johnpoz

If client is working fine using 8.8.8.8 then you have 2 choices troubleshoot why pfsense resolving is haivng a problem.

Or just turn off resolving mode and use forwarder mode and point to 8.8.8.8

No you are never going to want to remove loopback, that is pfsense asking itself. If pfsense doesn't ask itself it will never be able to resolve any of your local host names. And your clients your going to want to point back to pfsense once pfsense is just forwarding..

But pfsense should be able to just resolve.. So I would be more curious to why it can not resolve?

kaysersosa

Just for your reference. The ISP modem has 2 ports on it. I have my pfSense router in one of the ports and my active DD-WRT router in the other. DD-WRT is running my home network currently.

Ok, so I removed the hard-set 8.8.8.8 as the DNS on the Client under Network/Properties. Then on pfSense under Services/DNS Resolver/General Settings - unchecked enable and saved/applied and thn on pfSense under Services/DNS Forwarder I checked enable and saved/applied. No internet on the Client PC.

Are there any other settings required with the DNS Forwarder? If not and you are willing to help I'm all for attempting to troubleshoot the DNS Resolver.

johnpoz

If your using forwarder then it should be forwarding… It should forward to your isp dns or what it gets via its wan.. Or what you put in the settings.

You sure its running.. Validate that pfsense can resolve using the dns lookup...

kaysersosa

DNS Lookup - see attached

ipconfig /all run on Client PC

Ethernet adapter Ethernet:

Connection-specific DNS Suffix . : localdomain
Description . . . . . . . . . . . : This Qualcomm Atheros network Controller connects you to the network.
Physical Address. . . . . . . . . : MACv4
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::940d:1541:4e1a:fb26%13(Preferred)
IPv4 Address. . . . . . . . . . . : 10.7.13.100(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.128
Lease Obtained. . . . . . . . . . : Monday, May 7, 2018 2:31:05 PM
Lease Expires . . . . . . . . . . : Monday, May 7, 2018 4:31:05 PM
Default Gateway . . . . . . . . . : 10.7.13.1
DHCP Server . . . . . . . . . . . : 10.7.13.1
DHCPv6 IAID . . . . . . . . . . . : 62676980
DHCPv6 Client DUID. . . . . . . . : MACv6
DNS Servers . . . . . . . . . . . : 10.7.13.1
NetBIOS over Tcpip. . . . . . . . : Enabled

![dns lookup.jpg](/public/imported_attachments/1/dns lookup.jpg)
![dns lookup.jpg_thumb](/public/imported_attachments/1/dns lookup.jpg_thumb)

johnpoz

Ok dude loopback didn't respond… So yeah that is PROBLEM..

Also 600+ms for google to answer? Yeah that is a problem..

Are you on some sort of sat connection or something? I would not think it possible for 8.8.8.8 to take that long to respond from anywhere on the planet with it being a anycast address and located in regions all over the planet.

Here I just did a query to google... 11ms

;; ANSWER SECTION:
www.google.com. 213 IN A 172.217.1.36

;; Query time: 11 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Mon May 07 15:00:48 Central Daylight Time 2018
;; MSG SIZE rcvd: 59

If you are seeing over 100ms to 8.8.8.8 I would say something is wrong. You are seeing 600+ms..

I can ping China from Chicago and get less than 300ms.. ;)

kaysersosa

Yes, I was forced to use a satellite internet so I know response times suck. First post in this thread has details on my ISP modem.

Where to next?

johnpoz

Oh wow, not sure how I missed that ;)

If your on SAT… your going to have to use their DNS... You are not going to be able to resolve or use other public dns... Use of the SAT isp dns is going to be your really only viable option.. Anything else is going to be horrible.

And you sure can not resolve on such a high latency connection.

kaysersosa

That would explain why my old pfSense configs wouldn't work, didn't have Sat internet for them.

So what do I need to config on pfSense to get it working for Sat internet?

kaysersosa

So this is what I have done and internet appears to be working right now on the Client PC.

on pfSense
Under System/General Setup - I removed the DNS Servers and checked DNS Server Override.

Under Services/DNS Forwarder - checked enabled and saved/applied

Under Services/DNS Resolver - unchecked enabled and saved/applied

on Dashboard the DNS Servers listed are the 127.0.0.1, and the pair of 99's that come from the ISP modem.

Client PC is also getting everything sent to it, nothing is hard-set.

johnpoz

yeah pfsense will ask it self, which will get forwarded to those 99.x.x

Now do a dns lookup for google… on pfsense dns lookup What is the response time now.

Clients will ask pfsense..

kaysersosa

127.0.0.1 is 589ms
99's are 6 & 4ms

Is there anything else I need to do other than setup pfSense how I want it? Any settings I should look at avoiding. All I really plan on do is to setup some firewall rules for some local servers and games and setup DHCP static mapping so all my systems have a specific IP every time.

johnpoz

127.0.0.1 should not be that long… It should just be the say 1ms longer than what the forwards answer in.

Your clients are talking to pfsense IP for dns. What are the response times for lookups.

kaysersosa

I think I may have typed www.google.com in wrong the last time. Just noticed it and the 127.0.0.1 was still 600+ms, changed it and got responses below.

the DNS Lookup on pfSense for www.google.com comes back with…

127.0.0.1 - 4ms
99's are 6ms