Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Resolved - New pfSense installation is blocking everything

    Scheduled Pinned Locked Moved Firewalling
    19 Posts 4 Posters 2.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      sarmad
      last edited by sarmad

      hello,
      i have installed pfsense 2.4.4 on a pc with 3 NIC Gigabit Ethernet with these configurations
      WAN - Static Public IP /25 with gateway specified
      LAN - 192.168.1.200 /16 no DHCP - no gateway
      OP1 - Not configured
      after complete the installation, i can't ping anything on a pc in the same LAN network and can't open any website.
      i didn't change anything of the default firewall rules, and i can access the pfSense Web GUI normally. The status of the gateway is always OFFLINE.
      i have tested my static public ip in a normal pc and the internet is working perfectly.
      The firewall log have a lot of blocked packets by Default deny rule IPv4.
      i have tried to change the wan interface with no luck.
      what could be the problem?
      thanks,

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        @sarmad said in New pfSense installation is blocking everything:

        after complete the installation, i can't ping anything on a pc in the same LAN network and can't open any website.

        If you cannot ping anything on the local LAN from the local LAN it's not the firewall.

        If you did not change the default LAN firewall rule and only changed to /16 (why?) then hosts on LAN should at least be able to ping 192.168.1.200. If they cannot, apply basic network troubleshooting techniques working from Layer 1 on up.

        https://www.netgate.com/docs/pfsense/routing/connectivity-troubleshooting.html

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • S
          sarmad
          last edited by

          sorry, i can ping the LAN interface of pfsense. And about /16, i have tried /24 too

          1 Reply Last reply Reply Quote 0
          • S
            sarmad
            last edited by sarmad

            when i tried to test the static public ip in a normal pc, i can ping google and i can ping the default gateway, but in pfsense gui can't ping gateway because it's status is offline

            1 Reply Last reply Reply Quote 0
            • DerelictD
              Derelict LAYER 8 Netgate
              last edited by

              Pretty much impossible to say what you did wrong based on what we have

              https://www.netgate.com/docs/pfsense/routing/connectivity-troubleshooting.html

              You can't just change netmasks. Everything on the segment has to match. It is either /16 or /24. Set it to the correct value. Only you know what that is.

              1. Is pfSense's address the test client's default gateway
              2. Are there firewall rules on the LAN interface that pass the desired traffic
              3. Is the WAN gateway the firewall's default route
              4. Is proper outbound NAT in place for the LAN subnet

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • S
                sarmad
                last edited by

                thank you for reply,
                I am testing the new installation on just one pc, so my lan is just one pc connected directly to pfsense lan interface.
                the pc is always in the same segment with pfsense and pfsense is the default gateway of the testing pc and always i can access pfsense gui without any problem.
                The firewall has the default lan rule that allow everything from lan to outside. thw wan interface has no rules.
                yes, the wan gateway is the default route.
                The outbound NAT is Automatic outbound NAT (default).

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  Then it would be working. Check it all again.

                  Start posting screenshots of everything already mentioned from the test PC out to the WAN, Rules, Outbound NAT, etc.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • S
                    sarmad
                    last edited by

                    After finishing a new installation and set the correct IPs for wan and lan, pfsense allow everything from LAN to outside right?

                    1 Reply Last reply Reply Quote 0
                    • S
                      sarmad
                      last edited by

                      0_1541296181123_pf01.jpg

                      0_1541296195143_pf02.jpg

                      0_1541296211244_pf03.jpg

                      0_1541296220657_pf04.jpg

                      0_1541296226152_pf05.jpg

                      0_1541296231960_pf06.jpg

                      0_1541296239959_pf07.jpg

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        OK that should be working fine. If not check your WAN connection.

                        Can pfSense ping the gateway address from Diagnostics > Ping? How about pinging from there setting the source address as LAN? Pinging 8.8.8.8? Resolving names using Diagnostics > DNS Lookup?

                        Again: https://www.netgate.com/docs/pfsense/routing/connectivity-troubleshooting.html

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • S
                          sarmad
                          last edited by

                          no, pfsense can't ping neither gateway nor 8.8.8.8
                          in System > General, i have added the 4 DNSs, two that is provided from ISP and the other two are google's DNS 8.8.8.8 and 8.8.4.4
                          i can't try Diagnostics > DNS Lookup now because the firewall isn't near me now, i will give it a try ASAP.
                          But, could be a hardware problem?

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by Derelict

                            Then you need to figure out why your WAN is not working.

                            could be a hardware problem?

                            Really hard to tell from here. What does Status > Interfaces say for WAN?

                            Please look at the things in that connectivity troubleshooting document. We can't see your network. You can.

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • S
                              sarmad
                              last edited by

                              the WAN connection should be a cross cable? because i am using the same straight CAT5e cable for testing the internet directly using a normal PC and is working fine

                              1 Reply Last reply Reply Quote 0
                              • DerelictD
                                Derelict LAYER 8 Netgate
                                last edited by Derelict

                                Depends on what it is connected to. If you don't have auto-mdix then maybe you will need a crossover cable.

                                I was assuming this whole time, since I forwarded that connectivity troubleshooting document to you several times, that you had verified you at least had link up on all of your interfaces.

                                Chattanooga, Tennessee, USA
                                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                1 Reply Last reply Reply Quote 0
                                • S
                                  sarmad
                                  last edited by

                                  thank you,
                                  the NIC lights of WAN are on normally, but i will try a crossover cable ASAP and try to check all steps in that connectivity document link.
                                  So the problem isn't the configuration, it is the hardware or the cable assuming that pfSense working fine with NIC Gigabit

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    You should be able to see in Status > Interfaces exactly what state the WAN is in.

                                    Steve

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      sarmad
                                      last edited by

                                      i changed the hardware of pfsense and now it is working
                                      thanks,

                                      A 1 Reply Last reply Reply Quote 0
                                      • A
                                        akuma1x @sarmad
                                        last edited by

                                        @sarmad said in Resolved - New pfSense installation is blocking everything:

                                        i changed the hardware of pfsense and now it is working
                                        thanks,

                                        That's cheating! LOL

                                        Jeff

                                        1 Reply Last reply Reply Quote 0
                                        • S
                                          sarmad
                                          last edited by

                                          i discovered, it was the external NIC

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.