Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Everything works except loading a webpage

    Scheduled Pinned Locked Moved Firewalling
    28 Posts 4 Posters 4.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      kimyeti @KOM
      last edited by

      @kom

      I've already tried the "Reset to factory defaults" and that does not solve the issue unfortunately. I guess I'll try installing it again and hope it will reformat the drive or something.

      1 Reply Last reply Reply Quote 0
      • KOMK
        KOM
        last edited by

        I can't see what else it could be at this point. You have connectivity and DNS. It should work.

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by johnpoz

          did you mess with your outbound nat?

          Post your outbound nat tab

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

          K 1 Reply Last reply Reply Quote 0
          • K
            kimyeti @johnpoz
            last edited by kimyeti

            Hi @johnpoz

            I've done a complete reinstall of the pfsense system. I haven't touched anything at all.
            I have the same issue. Here are the nat settings:

            Here are the nat settings

            I can ping and nslookup just fine again except load a webpage.

            1 Reply Last reply Reply Quote 0
            • A
              akuma1x
              last edited by

              I didn't see it in your troubleshooting steps, but did you reboot your ISP modem? And by that I mean, unplug it for at least 10 minutes.

              Sometimes ISP modems lock onto an internal MAC address and won't send traffic to anything but that address until you reboot it.

              Jeff

              K 1 Reply Last reply Reply Quote 0
              • K
                kimyeti @akuma1x
                last edited by

                @akuma1x

                Hi John.

                I've unplugged the modem for 15 min with no power. The issue still persists.
                I'm starting to believe me and pfsense are just not meant to be.

                A 1 Reply Last reply Reply Quote 0
                • A
                  akuma1x @kimyeti
                  last edited by

                  @kimyeti said in Everything works except loading a webpage:

                  I'm starting to believe me and pfsense are just not meant to be.

                  Do you have another router/firewall you could try?

                  Jeff

                  1 Reply Last reply Reply Quote 0
                  • K
                    kimyeti
                    last edited by

                    Unfortunately I do not. I have no problem buying a new router, but I'm afraid that I would get home and get the exact same issue. Then I would have two perfectly fine routers and still a broken network :(

                    A 1 Reply Last reply Reply Quote 0
                    • A
                      akuma1x @kimyeti
                      last edited by

                      @kimyeti said in Everything works except loading a webpage:

                      Unfortunately I do not. I have no problem buying a new router, but I'm afraid that I would get home and get the exact same issue. Then I would have two perfectly fine routers and still a broken network :(

                      How about your ISP modem? Does it have LAN ethernet ports on the back? If it does, there's a router you could try...

                      Jeff

                      K 1 Reply Last reply Reply Quote 0
                      • K
                        kimyeti @akuma1x
                        last edited by kimyeti

                        @akuma1x

                        I do not understand. Do you want to disable bridged mode on the ISP Router/modem? I know that would work because I've used that for 2 years.

                        But I would have to call my ISP again to switch the MAC address from the WAN interface on the pfsense to the ISP router.

                        I cannot install pfsense on their equipment.

                        A 1 Reply Last reply Reply Quote 0
                        • A
                          akuma1x @kimyeti
                          last edited by

                          @kimyeti said in Everything works except loading a webpage:

                          @akuma1x

                          Do you want to disable bridged mode on the ISP Router/modem?

                          No, you don't have to do that.

                          Are you sure you're supposed to set your WAN interface to get an IP address via DHCP? On most (and I could count the number of times on one hand) of the bridged WAN connections I've had, they were always static IP addresses, with an upstream gateway manually typed in.

                          You mention calling the ISP to switch MAC addresses. Did you do that to get the pfsense box online? Did you give them the correct MAC address for the pfsense box? Can they help you with pinging the pfsense box, or verifying that it is even on their network?

                          I know you can't install pfsense on the ISP equipment. My point in asking about switching back to it was that would tell you if your pfsense box was truly malfunctioning, or if the problem lies somewhere with your ISP. By swapping another router with default configs, if that worked and got you online, your pfsense box would be bad. Get it? :)

                          Jeff

                          K 1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by

                            Simple test... sniff on pfsense wan... Have a client try and open a website... Do you see the SYN go out? Do you see the syn,ack come back?

                            The traffic outbound should be changed to your public IP via the outbound nat, and the source port changed... What does your state table show for the website you tried to access.

                            In the cable world - when you have place the ISP gateway device in bridge mode wan of pfsense would always be dhcp... And yes in the cable world you always have to powercycle the modem/gateway to free up the mac binding when you change devices.

                            It could be the isp is preventing access to the mac that is pfsense wan... The can happen when you get a new cable modem... Where you get access but you can not go anywhere other than the registration page of the ISP.. Possible if your resolving vs using the isp dns that your not getting some sort of dns redirect that your ISP does to say hey new device do you want to register it or call 1234, etc. etc..

                            But if you see the syn go out of pfsense with the correct public IP and you get no answer then the problem is UPSTREAM...

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                            K 2 Replies Last reply Reply Quote 0
                            • K
                              kimyeti @akuma1x
                              last edited by kimyeti

                              @akuma1x

                              "Are you sure you're supposed to set your WAN interface to get an IP address via DHCP?"
                              According to the ISP guy I spoke with that's how they do it.

                              " Did you give them the correct MAC address for the pfsense box?"
                              The guy repeated it back to me, so I'm 99% sure.

                              "Can they help you with pinging the pfsense box, or verifying that it is even on their network?"
                              We can ping each other just fine.

                              "By swapping another router with default configs, if that worked and got you online, your pfsense box would be bad. Get it? :)"
                              True, but the reason why I got confused is because I would need another router to test with which I don't have at the moment. But it's a good idea and I will buy a cheap pre-configured router and see if that works. If I get the same error then we know for sure It's either the ISP's modem or something else in their end :)

                              1 Reply Last reply Reply Quote 0
                              • K
                                kimyeti @johnpoz
                                last edited by kimyeti

                                @johnpoz

                                "Simple test... sniff on pfsense wan... Have a client try and open a website... Do you see the SYN go out? Do you see the syn,ack come back?"

                                Do you mean sniff with the diagnostic tool "packet capture" in pfsense or maybe Wireshark? I already did a few tests before I reinstalled pfSense where I started the capture tool while trying to load websites on the client machine.

                                WAN IP = 80.162.60.53
                                Reddit.com = 151.101.193.140
                                Google.com = 216.58.207.227

                                Unfortunately I can't do more tests right now because my brother needs to be able to do work from home. I've reversed it back at the moment to get internet.

                                alt text

                                "And yes in the cable world you always have to powercycle the modem/gateway to free up the mac binding when you change devices."

                                I've definitely done that to the full extent in pure frustration ;)

                                "Where you get access but you can not go anywhere other than the registration page of the ISP"

                                That is a possibility and if that's correct then my ISP has horrible customer service if they fail to mention such crucial details. I'm gonna go for @akuma1x advice first by purchasing a cheap pre-configured router and see if the same issue occurs. Whatever happens from there will rule out a lot. Even though it's not solved yet I just want to say thank you to everybody in the thread for trying to help me.

                                If you want I'll keep you posted on this thread :)

                                1 Reply Last reply Reply Quote 0
                                • K
                                  kimyeti @johnpoz
                                  last edited by

                                  @johnpoz @akuma1x @KOM

                                  I found the solution to the issue and I just wanted to share what it was.

                                  Short Story: pfSense rocks - my ISP sucks

                                  Long Story:

                                  After connecting a new cheap router I experinced the same issue. The fault must be at the ISP then, but they repeatedly told me that there were no issues in their end. I found the solution by reading a bunch of forum posts on their forum and someone posted if you had port forwards on their router, then it would block those ports in bridge mode. It's a bug in the system. The solution was to reset the router/modem to factory settings and shutdown all power for 10 min. Boom !

                                  Everything worked after that. I appreciate all the help that I got here, cheers.

                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by johnpoz

                                    So just to clarify.. You had say tcp 80 forwarded to 192.168.1.100 on their device.

                                    Now you put their device in bridge mode, and you get public IP on pfsense 1.2.3.4 wan... But inbound traffic to your public IP so that pfsense would see it is blocked for tcp 80 and pfsense would never get syn to its wan on tcp 80.

                                    How would that be a problem with accessing websites? Unless you for example ALL ports forwarded in say a DMZ host.. So now when you talk outbound from pfsense to 80 from source port lets say 50452, the return syn,ack to 50452 was being blocked?

                                    You could of clearly seen that with packet capture on pfsense.. You would of seen your syn go out, but no syn,ack back.

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                    K 1 Reply Last reply Reply Quote 0
                                    • K
                                      kimyeti @johnpoz
                                      last edited by

                                      @johnpoz

                                      You're right that you should be able to see it with a packet capture where the syn acknowledge wouldn't come back.
                                      Multiple people had the same issue and they all had port forwarding. I don't know if that was truly the cause or perhaps people just came to that conclusion. Maybe it just needed a factory reset for some reason - I don't know.

                                      1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by

                                        did you have a port forward for all ports, ie many of those shitty routers call it dmz or dmz host? Or did you have specific port forwards only?

                                        Maybe its just if you had "any" port forwards moving to bridge mode is broken and needs a clear or reset before you move it to bridge mode.

                                        Whatever is was - glad you got it sorted.

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                        K 1 Reply Last reply Reply Quote 0
                                        • K
                                          kimyeti @johnpoz
                                          last edited by

                                          @johnpoz

                                          All the ports were not open - the ones I had was 80, 443, 22 and 21.

                                          I could very well be that if you just had "any" port forward it would then break the system of their shitty router. I do not want to dig any deeper though - just glad it finally works. Good weekend :)

                                          1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator
                                            last edited by

                                            You too and have fun with your now fully functional pfsense...

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.