Guest LAN cannot access internet
-
I'm trying to do something that seems like it should be simple but I can't get anywhere. I've tried searching the forums/using Google and am stumped. I'm fairly knowledgeable with basic networking.
I have a pfSense box (2.3.2 p1) with 4 onboard Intel adapters. Until just recently I was only using the LAN & WAN interfaces. I have been trying to setup 1 of the other interfaces (OPT1) as an isolation network for testing but it isn't working. If I miss some information that you need to help me please be kind and tell my explicitly what you need to know.
LAN: 192.168.0.1 // fd6d:d21f:890b:547:1::1 (DHCP/DNS handled by Windows server)
OPT1: 192.168.25.1 // fd6d:d21f:890b:547:25::1 (DHCP/DNS handled by pfSense)The 1 client on the OPT1 is getting an IP address but is unable to connect to anything outside of the OPT1 network. DNS lookups fail as do attempts to connect to an IP address directly. I initially tried to copy the default LAN firewall rules without any success. Here is the current set of rules I have tried.
I don't know what to do to get the OPT1 interface connected to the internet. Thanks for your help.
-
What are your outbound NAT Settings? Set to Automatic? If not, is your subnet included in the rules you've written?
What are your DNS Resolver settings? Have you selected All network interfaces, if not have you included OPT1?
What are your settings under Interfaces / OPT1?
What is the output for OPT1 under Status / Interfaces?
-
In addition, a client that gets what looks like a valid IPv6 configuration is generally going to try to do everything via IPv6 before falling back to IPv4 (if you're lucky - pretty much up to the client what it does in that case.)
I don't know what you're trying to do with those ULA addresses but you might try just setting IPv6 to None on OPT1 and getting IPv4 working first.
And after IPv4 is working there is no reason to mess around like that when www.tunnelbroker.net is so generous. Just get a /48 from them and set up a GIF tunnel.
https://doc.pfsense.org/index.php/Using_IPv6_with_a_Tunnel_Broker
-
What are your outbound NAT Settings? Set to Automatic? If not, is your subnet included in the rules you've written?
What are your DNS Resolver settings? Have you selected All network interfaces, if not have you included OPT1?
What are your settings under Interfaces / OPT1?
What is the output for OPT1 under Status / Interfaces?
Outbound NAT is automatic
DNS Resolver is set to All on the network interfaces
OPT1 is static with the addresses listed before (192.168.25.1/24 & fd6d:d21f:890b:547:25::1/80), MTU/MSS defaults, reserved networks unchecked
Status: up
MAC Address: 0c:c4:7a:45:e2:c2 - Super Micro Computer
IPv4 Address: 192.168.25.1
Subnet mask IPv4: 255.255.255.0
IPv6 Link Local: fe80::ec4:7aff:fe45:e2c2%igb2
IPv6 Address: fd6d:d21f:890b:547:25::1
Subnet mask IPv6: 80
MTU: 1500
Media: 100baseTX <full-duplex>In/out packets: 43654/180308 (2.97 MiB/25.77 MiB)
In/out packets (pass): 43654/180308 (2.97 MiB/25.77 MiB)
In/out packets (block): 521875/0 (38.65 MiB/0 B)
In/out errors: 0/0
Collisions: 0</full-duplex>
-
In addition, a client that gets what looks like a valid IPv6 configuration is generally going to try to do everything via IPv6 before falling back to IPv4 (if you're lucky - pretty much up to the client what it does in that case.)
I don't know what you're trying to do with those ULA addresses but you might try just setting IPv6 to None on OPT1 and getting IPv4 working first.
And after IPv4 is working there is no reason to mess around like that when www.tunnelbroker.net is so generous. Just get a /48 from them and set up a GIF tunnel.
https://doc.pfsense.org/index.php/Using_IPv6_with_a_Tunnel_Broker
I have disabled IPv6 for now as you suggested.
-
Did it fix your issue?
-
Negative.
-
I'm pretty new to all of this myself, but all of your settings look like they should work great.
I'm assuming no upstream gateway on your interface?
Anything helpful in the system logs?
Have you tried using a different client on the network to see if the client is the issue?
-
I'm pretty new to all of this myself, but all of your settings look like they should work great.
I'm assuming no upstream gateway on your interface?
Anything helpful in the system logs?
Have you tried using a different client on the network to see if the client is the issue?
Nothing upstream on my equipment.
I haven't looked in the logs so I'll check there.
I've tried different OSs on the same system without any luck. I was initially concerned about some kind of virus on the system.
-
Can you connect any other device to the network and test it?
It could be a hardware issue on the client you're using.
-
So this client can ping pfsense opt1 interface IP 192.168.25.1 ?? If he could then dns wouldn't fail, since your just asking pfsense for dns which has zero to do with going anywhere other than talking to pfsense. The default out of the box is resolver listening on all interfaces..
You sure your getting the correct IP and gateway? And that you can ping pfsense? And that your automatic outbound nat now includes your 192.168.25/24 network
-
The issue has been fixed. When I tried pinging the firewall from the one host all packets were lost. I went back searching and found a post saying that allowing access to the wan net would not allow access to the whole internet. I then changed my rules as follows:
1. Deny access from opt1 to lan
2. Deny access from opt1 to opt2
3. Allow access from opt1 to allThank you for your help!
-
That's pretty much what you posted in your first post. So that wasn't what was wrong. It was something else.
-
No real difference in those rules - your last rule is an any any.. So either you didn't post up what your rules actually were the first time, or yeah something else.
