Unable to access Internet from WIFI AP

mdahal · Feb 1, 2018, 11:58 AM

Hello everyone,

I have been unable to get my wifi AP to get to the internet.

It is connected to the different interface. DHCP works and I am able to get DHCP on the subnet. However, I cannot connect to the internet. Cannot ping subnet IP.

So far, I have LAN as 192.168.2.1
WIFI as 192.168.3.1
IPMI which I am planning to use for all my server management interface set as 192.168.4.1

I have set up rules for wifi to allow for any to any connection.

I have set up my outband NAT as automatic.

I cannot see anything getting blocked in firewall either.

My AP is the router provided by my ISP and DHCP has been turned off and Ethernet is connected to LAN.

Really appreciate if you could advise what to check for.

Cheers,

NogBadTheBad · Feb 1, 2018, 12:15 PM

What happens if you connect a PC to the port you connect the ISP WiFi router to, does the PC work ?

Could be a default gateway / subnet mask issue, what does an ipconfig show ?

Jackish · Feb 1, 2018, 12:29 PM

@mdahal:

Hello everyone,

I have been unable to get my wifi AP to get to the internet.

It is connected to the different interface. DHCP works and I am able to get DHCP on the subnet. However, I cannot connect to the internet. Cannot ping subnet IP.

So far, I have LAN as 192.168.2.1
WIFI as 192.168.3.1
IPMI which I am planning to use for all my server management interface set as 192.168.4.1

I have set up rules for wifi to allow for any to any connection.

I have set up my outband NAT as automatic.

I cannot see anything getting blocked in firewall either.

My AP is the router provided by my ISP and DHCP has been turned off and Ethernet is connected to LAN.

Really appreciate if you could advise what to check for.

Cheers,

Ethernet should be connected to WAN on your AP, or do you mean that Ethernet is conencted from LAN on pfsense?

mdahal · Feb 1, 2018, 12:35 PM

@NogBadTheBad I have tried connecting the cable directly to my laptop(Macbook Air). Still same issue ifconfig gives me

inet 192.168.3.7 netmask 0xffffff00 broadcast 192.168.3.255
nd6 options=201 <performnud,dad>media: autoselect (1000baseT <full-duplex,flow-control,energy-efficient-ethernet>)
status: active

Furthermore, in the interface assignment IP is selected as 192.168.2.3/24 So, the subnet mask is correct. Using the same gateway I am able to get to the internet in "LAN" interface. Just not in "WIFI"

@Jackish Ethernet should be connected to LAN port so I can use it as a wireless switch I believe. Since, above is failing I think the issue is with pfsense interface somewhere. Unable to find exactly where.</full-duplex,flow-control,energy-efficient-ethernet></performnud,dad>

NogBadTheBad · Feb 1, 2018, 1:00 PM

@Jackish:

@mdahal:

Hello everyone,

I have been unable to get my wifi AP to get to the internet.

It is connected to the different interface. DHCP works and I am able to get DHCP on the subnet. However, I cannot connect to the internet. Cannot ping subnet IP.

So far, I have LAN as 192.168.2.1
WIFI as 192.168.3.1
IPMI which I am planning to use for all my server management interface set as 192.168.4.1

I have set up rules for wifi to allow for any to any connection.

I have set up my outband NAT as automatic.

I cannot see anything getting blocked in firewall either.

My AP is the router provided by my ISP and DHCP has been turned off and Ethernet is connected to LAN.

Really appreciate if you could advise what to check for.

Cheers,

Ethernet should be connected to WAN on your AP, or do you mean that Ethernet is conencted from LAN on pfsense?

No it shouldn't you'll get a double NAT if you use the WAN port, use one of the LAN port.

NogBadTheBad · Feb 1, 2018, 1:01 PM

@mdahal:

@NogBadTheBad I have tried connecting the cable directly to my laptop(Macbook Air). Still same issue ifconfig gives me

So your laptop can't access the internet when connected to the port the ISP router connects to then ?

If this is the case it's an issue with your config on the pfsense router.

What's the output from netstat -rn when you connect the laptop to the wifi lan port ?

mdahal · Feb 1, 2018, 1:33 PM

@NogBadTheBad:

@mdahal:

@NogBadTheBad I have tried connecting the cable directly to my laptop(Macbook Air). Still same issue ifconfig gives me

So your laptop can't access the internet when connected to the port the ISP router connects to then ?

If this is the case it's an issue with your config on the pfsense router.

What's the output from netstat -rn when you connect the laptop to the wifi lan port ?

Just so that we are on the same page want to clear something.

I have 4 interface in my pfsense.

WAN, LAN, WIFI, IPMI

LAN is connected to switch which has multiple computers connected which is connecting to internet fine. LAN interface has subnet 192.168.1.1/24

WIFI has ISP provided router connected as AP with DHCP disabled in LAN port with subnet 192.168.3.1/24. Wifi is on, I am able to connect devices to it get IP address assigned but unable to get internet access. Unable to ping 192.168.3.1 (WIFI interface IP). I have tried connecting my laptop instead of wifi AP and I wasn't able to get to the internet so same issue.

IPMI is not physically connected at the moment.

Furthermore, I also have two VPN client running which has selective routing enabled with two interface VPNIN and VPNUS, One VPN Server which is running perfectly fine.

The output of netstat is as follows:

Internet:
Destination Gateway Flags Refs Use Netif Expire
default 192.168.3.1 UGSc 6 0 en0
127 127.0.0.1 UCS 0 0 lo0
127.0.0.1 127.0.0.1 UH 1 530 lo0
169.254 link#4 UCS 0 0 en0
192.168.3 link#4 UCS 0 0 en0
192.168.3.1/32 link#4 UCS 2 0 en0
192.168.3.1 ac:1f:6b:10:cf:e5 UHLWIir 29 71 en0 1191
192.168.3.3/32 link#4 UCS 1 0 en0
224.0.0/4 link#4 UmCS 2 0 en0
224.0.0.251 1:0:5e:0:0:fb UHmLWI 0 0 en0
239.255.255.250 1:0:5e:7f:ff:fa UHmLWI 0 4 en0
255.255.255.255/32 link#4 UCS 0 0 en0

This is with Wifi connected via AP.

Really appreciate your input so far.

NogBadTheBad · Feb 1, 2018, 1:38 PM

Internet:
Destination Gateway Flags Refs Use Netif Expire
default 192.168.3.1 UGSc 6 0 en0
127 127.0.0.1 UCS 0 0 lo0

Default gateway is fine too.

Gertjan · Feb 1, 2018, 1:42 PM

@mdahal:

So far, I have LAN as 192.168.2.1

Because your WAN is 192.168.1.x ?

@mdahal:

WIFI as 192.168.3.1

Why ???
Make it's LAN IP 192.168.2.2/24 and you'll be fine

@mdahal:

My AP is the router provided by my ISP and DHCP has been turned off and Ethernet is connected to LAN.

You should be able to stop all "router" functions. Your AP should be a dumb "electrical wire signal" to "radio signal" converter.
DHCP off - DNS off - gateway to IP pfSense LAN = 192.168.2.1 - DNS server set to 192.168.2.1 - mask /24

mdahal · Feb 1, 2018, 2:00 PM

@Gertjan

No for WAN I get DHCP from my ISP. And I had all my machines setup for 192.168.2.1/24 from long time ago that is why I have it set up as 2.1 no real reason.

WIFI is 192.168.3.1 because it I want it to be in different subnet. Unable to set IP as 192.168.2.2/24 as that would overlap with "LAN" interface.

My AP is definately a dump AP with all function turned off. (Apologies on using the term "router")

Appreciate your help.

mdahal · Feb 1, 2018, 2:02 PM

@NogBadTheBad:

Internet:
Destination Gateway Flags Refs Use Netif Expire
default 192.168.3.1 UGSc 6 0 en0
127 127.0.0.1 UCS 0 0 lo0

Default gateway is fine too.

Yeah, really pulling my hair out here. I have been using pfsense for a while the only difference is I had these interface bridged before. I want to setup different subnet so my wifi connection cannot talk to my LAN and IPMI subnets.

johnpoz · Feb 1, 2018, 3:25 PM

that is the outbound of your laptiop netstat? Why do you have /32 bit mask set

"192.168.3.1/32"

And then this?

"192.168.3.3/32"

And you have that set on a wired interface en0

NogBadTheBad · Feb 1, 2018, 4:25 PM

@johnpoz:

that is the outbound of your laptiop netstat? Why do you have /32 bit mask set

"192.168.3.1/32"

And then this?

"192.168.3.3/32"

And you have that set on a wired interface en0

The two /32's seem to be a MacOS thing, I see them on my Mac one is the default gateway the other the actual device.

mac-pro:~ andy$ netstat -rn
Routing tables

Internet:
Destination Gateway Flags Refs Use Netif Expire
default 172.16.2.1 UGSc 50 6 en0
127 127.0.0.1 UCS 0 0 lo0
127.0.0.1 127.0.0.1 UH 8 3282 lo0
169.254 link#6 UCS 0 0 en0
172.16.2/24 link#6 UCS 4 0 en0
172.16.2.1/32 link#6 UCS 1 0 en0
172.16.2.1 0:8:a29d:cb UHLWIir 7 1 en0 286
172.16.2.6 6c:70:9f:d8:3b:4e UHLWI 0 0 en0 1074
172.16.2.20/32 link#6 UCS 0 0 en0
172.16.2.23 a8:20:66:10:fc:b7 UHLWI 0 0 en0 1075
172.16.2.40 40:9c:28:a2:e0:7e UHLWI 0 6 en0 1060
172.16.2.41 d0:4f:7e:85:d9:be UHLWI 0 41 en0 449
192.168.12 link#19 UC 1 0 vmnet1
192.168.33 link#20 UC 1 0 vmnet8
224.0.0/4 link#6 UmCS 1 0 en0
224.0.0.251 1:0:5e:0:0:fb UHmLWI 0 0 en0
255.255.255.255/32 link#6 UCS 0 0 en0

What I see but don't in the OPs netstat is a /24 like my entry in green.

Gertjan · Feb 1, 2018, 7:12 PM

@mdahal:

…..
WIFI is 192.168.3.1 because it I want it to be in different subnet. Unable to set IP as 192.168.2.2/24 as that would overlap with "LAN" interface.

All my AP's have IP's like 192.168.1.2 - 192.168.1.3 etc (LAN being 192.168.1.1/24) , because they are 'dumb' converters **.
On your Wifi network you mus have a DHCP server, is this pfSense ? So it hand out IPs from pool like 192.168.2.[x-y] == LAN ? Or is your AP handing out IPs from 192.168.3.[x-y] (and in that case your AP IS a router … not a dumb device anymore)

** and I want my AP's using pfSense as a gateway for their internal domestic services like NTP, DNS etc. If the IP of a AP is not in the network where it is situated, your in trouble.

mdahal · Feb 1, 2018, 7:52 PM

@Gertjan:

All my AP's have IP's like 192.168.1.2 - 192.168.1.3 etc (LAN being 192.168.1.1/24) , because they are 'dumb' converters **.
On your Wifi network you mus have a DHCP server, is this pfSense ? So it hand out IPs from pool like 192.168.2.[x-y] == LAN ? Or is your AP handing out IPs from 192.168.3.[x-y] (and in that case your AP IS a router … not a dumb device anymore)

** and I want my AP's using pfSense as a gateway for their internal domestic services like NTP, DNS etc. If the IP of a AP is not in the network where it is situated, your in trouble.

This is exactly the case. NTP and DNS is definitely handled by pfsense. My AP is wireless switch in different subnet. If you have a look at my OP you can see the pfsense getting DNS request. As discussed before even without the converted AP laptop getting connected to the pfsense port/interface directly I am having same issue. That rules out this as an issue with AP I believe.

NogBadTheBad · Feb 1, 2018, 8:42 PM

@mdahal:

@Gertjan:

All my AP's have IP's like 192.168.1.2 - 192.168.1.3 etc (LAN being 192.168.1.1/24) , because they are 'dumb' converters **.
On your Wifi network you mus have a DHCP server, is this pfSense ? So it hand out IPs from pool like 192.168.2.[x-y] == LAN ? Or is your AP handing out IPs from 192.168.3.[x-y] (and in that case your AP IS a router … not a dumb device anymore)

** and I want my AP's using pfSense as a gateway for their internal domestic services like NTP, DNS etc. If the IP of a AP is not in the network where it is situated, your in trouble.

This is exactly the case. NTP and DNS is definitely handled by pfsense. My AP is wireless switch in different subnet. If you have a look at my OP you can see the pfsense getting DNS request. As discussed before even without the converted AP laptop getting connected to the pfsense port/interface directly I am having same issue. That rules out this as an issue with AP I believe.

All the AP is doing is bridging the LAN to Wi-Fi.

If it doesn't work when connecting directly to the ethernet port it's not an issue with the AP.

Run the command in red to verify what is providing DHCP.

Last login: Thu Feb 1 20:22:19 on console
mac-pro:~ andy$ ipconfig getoption en0 server_identifier
172.16.2.1
mac-pro:~ andy$

I think you might need to start doing packet captures on the pfSense interfaces.

NogBadTheBad · Feb 1, 2018, 8:47 PM

Just a thought, you mentioned you'd once had the interfaces bridged.

You have changed back the following :-

net.link.bridge.pfil_member
net.link.bridge.pfil_bridge

As these would cause filtering on the bridge only.

https://doc.pfsense.org/index.php/Interface_Bridges

mdahal · Feb 1, 2018, 10:12 PM

@NogBadTheBad At work so just vpnd home and checked
net.link.bridge.pfil_member
net.link.bridge.pfil_bridge as suggested and it appears to be off.

Please see attached screenshot.

Looks like I will have to run packet capture tonight.

Jackish · Feb 2, 2018, 8:12 AM

@NogBadTheBad:

@Jackish:

@mdahal:

Hello everyone,

I have been unable to get my wifi AP to get to the internet.

It is connected to the different interface. DHCP works and I am able to get DHCP on the subnet. However, I cannot connect to the internet. Cannot ping subnet IP.

So far, I have LAN as 192.168.2.1
WIFI as 192.168.3.1
IPMI which I am planning to use for all my server management interface set as 192.168.4.1

I have set up rules for wifi to allow for any to any connection.

I have set up my outband NAT as automatic.

I cannot see anything getting blocked in firewall either.

My AP is the router provided by my ISP and DHCP has been turned off and Ethernet is connected to LAN.

Really appreciate if you could advise what to check for.

Cheers,

Ethernet should be connected to WAN on your AP, or do you mean that Ethernet is conencted from LAN on pfsense?

No it shouldn't you'll get a double NAT if you use the WAN port, use one of the LAN port.

That is not necessarily true. If you set the router to AP mode, DHCP will not be enabled and there will not be double NAT. Hell, I use the very same setup myself, i.e Pfsense (LAN) -> switch -> (WAN) Asus router -> Wifi clients.

If I switch the cable from WAN to LAN on the Asus router (when in AP mode), it doesn't work. And why would it, any simple consumer router expects upstream connection on the WAN port, not the LAN port.

NogBadTheBad · Feb 2, 2018, 8:19 AM

If you use the wan interface on a ADSL or cable Wi-Fi router you'll be routing between its wan interface and the lan & Wi-Fi interface.

There will be a NAT of your public IP address on the pfSense router then another on your ADSL or cable Wi-Fi router.

Many here will agree.