Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Guest LAN cannot access internet

    Scheduled Pinned Locked Moved Firewalling
    14 Posts 4 Posters 1.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • W
      WesleysHuman
      last edited by

      I'm trying to do something that seems like it should be simple but I can't get anywhere.  I've tried searching the forums/using Google and am stumped.  I'm fairly knowledgeable with basic networking.

      I have a pfSense box (2.3.2 p1) with 4 onboard Intel adapters.  Until just recently I was only using the LAN & WAN interfaces.  I have been trying to setup 1 of the other interfaces (OPT1) as an isolation network for testing but it isn't working.  If I miss some information that you need to help me please be kind and tell my explicitly what you need to know.

      LAN:  192.168.0.1 // fd6d:d21f:890b:547:1::1 (DHCP/DNS handled by Windows server)
      OPT1:  192.168.25.1 // fd6d:d21f:890b:547:25::1 (DHCP/DNS handled by pfSense)

      The 1 client on the OPT1 is getting an IP address but is unable to connect to anything outside of the OPT1 network.  DNS lookups fail as do attempts to connect to an IP address directly.  I initially tried to copy the default LAN firewall rules without any success.  Here is the current set of rules I have tried.

      I don't know what to do to get the OPT1 interface connected to the internet.  Thanks for your help.
      Rules.png
      Rules.png_thumb

      1 Reply Last reply Reply Quote 0
      • P
        pfBasic Banned
        last edited by

        What are your outbound NAT Settings? Set to Automatic? If not, is your subnet included in the rules you've written?

        What are your DNS Resolver settings? Have you selected All network interfaces, if not have you included OPT1?

        What are your settings under Interfaces / OPT1?

        What is the output for OPT1 under Status / Interfaces?

        1 Reply Last reply Reply Quote 0
        • DerelictD
          Derelict LAYER 8 Netgate
          last edited by

          In addition, a client that gets what looks like a valid IPv6 configuration is generally going to try to do everything via IPv6 before falling back to IPv4 (if you're lucky - pretty much up to the client what it does in that case.)

          I don't know what you're trying to do with those ULA addresses but you might try just setting IPv6 to None on OPT1 and getting IPv4 working first.

          And after IPv4 is working there is no reason to mess around like that when www.tunnelbroker.net is so generous. Just get a /48 from them and set up a GIF tunnel.

          https://doc.pfsense.org/index.php/Using_IPv6_with_a_Tunnel_Broker

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 0
          • W
            WesleysHuman
            last edited by

            @pfBasic:

            What are your outbound NAT Settings? Set to Automatic? If not, is your subnet included in the rules you've written?

            What are your DNS Resolver settings? Have you selected All network interfaces, if not have you included OPT1?

            What are your settings under Interfaces / OPT1?

            What is the output for OPT1 under Status / Interfaces?

            Outbound NAT is automatic

            DNS Resolver is set to All on the network interfaces

            OPT1 is static with the addresses listed before (192.168.25.1/24 & fd6d:d21f:890b:547:25::1/80), MTU/MSS defaults, reserved networks unchecked

            Status:                              up
            MAC Address:                    0c:c4:7a:45:e2:c2 - Super Micro Computer
            IPv4 Address:                  192.168.25.1
            Subnet mask IPv4:            255.255.255.0
            IPv6 Link Local:                  fe80::ec4:7aff:fe45:e2c2%igb2
            IPv6 Address:                    fd6d:d21f:890b:547:25::1
            Subnet mask IPv6:            80
            MTU:                                  1500
            Media:                                100baseTX <full-duplex>In/out packets:                  43654/180308 (2.97 MiB/25.77 MiB)
            In/out packets (pass):      43654/180308 (2.97 MiB/25.77 MiB)
            In/out packets (block):      521875/0 (38.65 MiB/0 B)
            In/out errors:                    0/0
            Collisions:                          0</full-duplex>

            1 Reply Last reply Reply Quote 0
            • W
              WesleysHuman
              last edited by

              @Derelict:

              In addition, a client that gets what looks like a valid IPv6 configuration is generally going to try to do everything via IPv6 before falling back to IPv4 (if you're lucky - pretty much up to the client what it does in that case.)

              I don't know what you're trying to do with those ULA addresses but you might try just setting IPv6 to None on OPT1 and getting IPv4 working first.

              And after IPv4 is working there is no reason to mess around like that when www.tunnelbroker.net is so generous. Just get a /48 from them and set up a GIF tunnel.

              https://doc.pfsense.org/index.php/Using_IPv6_with_a_Tunnel_Broker

              I have disabled IPv6 for now as you suggested.

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                Did it fix your issue?

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • W
                  WesleysHuman
                  last edited by

                  Negative.

                  1 Reply Last reply Reply Quote 0
                  • P
                    pfBasic Banned
                    last edited by

                    I'm pretty new to all of this myself, but all of your settings look like they should work great.

                    I'm assuming no upstream gateway on your interface?

                    Anything helpful in the system logs?

                    Have you tried using a different client on the network to see if the client is the issue?

                    1 Reply Last reply Reply Quote 0
                    • W
                      WesleysHuman
                      last edited by

                      @pfBasic:

                      I'm pretty new to all of this myself, but all of your settings look like they should work great.

                      I'm assuming no upstream gateway on your interface?

                      Anything helpful in the system logs?

                      Have you tried using a different client on the network to see if the client is the issue?

                      Nothing upstream on my equipment.

                      I haven't looked in the logs so I'll check there.

                      I've tried different OSs on the same system without any luck.  I was initially concerned about some kind of virus on the system.

                      1 Reply Last reply Reply Quote 0
                      • P
                        pfBasic Banned
                        last edited by

                        Can you connect any other device to the network and test it?

                        It could be a hardware issue on the client you're using.

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          So this client can ping pfsense opt1 interface IP 192.168.25.1 ??  If he could then dns wouldn't fail, since your just asking pfsense for dns which has zero to do with going anywhere other than talking to pfsense.  The default out of the box is resolver listening on all interfaces..

                          You sure your getting the correct IP and gateway?  And that you can ping pfsense?  And that your automatic outbound nat now includes your 192.168.25/24 network

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • W
                            WesleysHuman
                            last edited by

                            The issue has been fixed.  When I tried pinging the firewall from the one host all packets were lost.  I went back searching and found a post saying that allowing access to the wan net would not allow access to the whole internet.  I then changed my rules as follows:

                            1.  Deny access from opt1 to lan
                            2.  Deny access from opt1 to opt2
                            3.  Allow access from opt1 to all

                            Thank you for your help!

                            2017-02-22_04-18-57.png
                            2017-02-22_04-18-57.png_thumb

                            1 Reply Last reply Reply Quote 0
                            • DerelictD
                              Derelict LAYER 8 Netgate
                              last edited by

                              That's pretty much what you posted in your first post. So that wasn't what was wrong. It was something else.

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator
                                last edited by

                                No real difference in those rules - your last rule is an any any.. So either you didn't post up what your rules actually were the first time, or yeah something else.

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.