No LAN Internet Access

kaysersosa

I recently had to get Satellite Internet from Viasat/Exede and have been having nothing but issues with pfsense. I've search and have not found the issue.

Initially, I couldn't get my Wireless side working. I have a Linksys E3000 setup as an AP that connects into the Computers/Etc section below, pfSense worked, but nothing connecting into the AP or the wireless off of it could access the internet. I could connect to the LAN but not WAN. So I backed up my pfsense box and wiped it, unsure if the issue was due to corruption as I was seeing many errors appearing.

Normal Network layout is:
ISP Modem -> pfSense -> Switch -> Computers/Etc.

I'm putting my ISP info here, in case it is causing the issue. My ISP router/modem can work as wifi and router. Most of these settings are defaults.
Wifi
disabled

LAN Setup
IP Address: 192.168.1.1
Subnet: 255.255.255.0
DHCP Server enabled
Starting IP: 192.168.1.100
Max Users: 50
Static DNSs are blank, WINs is blank and lease time is 1 day

Internet Setup
Connection Type: Automatic Config - DHCP
(can't make any changes)

Firewall
SPI Protection = enabled
Internet Filter
Checked = Filter anonymous Internet Requests, Filter IDENT (Port 113)
Unchecked = Filter Multicast, Filter Internet NAT Redirection for IPv4 Internet Only

VPN Passthrough
All enabled (IPSEC, PPTP, L2TP)

UPNP
Enabled = UPNP, User Configuration
Disabled = User Disabled Internet Access

Bridge Mode
disabled

Port Forwarding & Triggering
all empty

DMZ
Enabled
Source IP: Any IP (can set it at a range)
Destination: set to MAC of pfsense WAN port (can set to an IP) – currently have a ddwrt router as my primary router until pfsense is up this doesnt affect it

QoS
Enabled = WMM Support
Disabled = No Acknowledgement, Internet Access Policy
Nothing else set

I have wiped my pfSense box and it has nothing on it other than a bare bones install of pfSense 2.4.3-RELEASE (amd64).

Console of pfSense shows, below. It grabbed both automatically, but I did set the LAN side
WAN -> v4/DHCP: 192.168.1.101/24
LAN -> v4: 10.0.0.1/24

I can ping google.com from the pfsense box, but a computer attached to the LAN side of pfsense cannot access google.com.

The DNS pfsense is showing is 127.0.0.1 and 2 of the hard coded DNS addresses from the ISP router.

Anytime I restore from one of my old configurations, no LAN internet access. I can't figure out what the issue is.

KOM

You first need to separate the issue into either DNS or route. From your client, can you ping 8.8.8.8? Can you perform 'nslookup google.com'?

Gertjan

@kaysersosa:

DMZ
Enabled
Source IP: Any IP (can set it at a range)
Destination: set to MAC of pfsense WAN port (can set to an IP) – currently have a ddwrt router as my primary router until pfsense is up this doesnt affect it

Disable DMZ on your ISP Router.
pfSense obtains an IP from your ISP Router, using DHCP - the "WAN -> v4/DHCP: 192.168.1.101/24", and all will be fine.

kaysersosa

@KOM:

You first need to separate the issue into either DNS or route. From your client, can you ping 8.8.8.8? Can you perform 'nslookup google.com'?

Well, it appears to be working, accessing the internet. I had powered off the pfsense router and the client system. Powered them back on just to respond to both of your comments and it's working. Going to attempt to restore my config from a prior build either later tonight or tomorrow and see what happens.

@Gertjan:

Disable DMZ on your ISP Router.
pfSense obtains an IP from your ISP Router, using DHCP - the "WAN -> v4/DHCP: 192.168.1.101/24", and all will be fine.

Unless my understanding is incorrect, I DMZ so I don't have to enter firewall rules into both routers and I can just pass through the ISP router.

kaysersosa

The issue still persists.

I uploaded a former config and it didn't work again.
I have wiped my pfSense box and it has nothing on it other than a bare bones install of pfSense 2.4.3-RELEASE (amd64).

Console of pfSense shows, below. It grabbed both automatically, but I did set the LAN side
WAN -> v4/DHCP: 192.168.1.101/24
LAN -> v4: 10.0.0.1/25

webConfigurator is set to HTTPS.

I can ping google.com from the pfsense box, but a computer attached to the LAN side of pfsense cannot access google.com.

The DNS pfsense is showing is 127.0.0.1 and 2 of the hard coded DNS addresses from the ISP router.

Still looking for assistance.

KOM

Computer attached to LAN must have an IP address in the 10.0.0.1/25 range, a gateway of 10.0.0.1, and DNS of either 10.0.0.1 or an external DNS like 8.8.8.8.

kaysersosa

@KOM:

Computer attached to LAN must have an IP address in the 10.0.0.1/25 range, a gateway of 10.0.0.1, and DNS of either 10.0.0.1 or an external DNS like 8.8.8.8.

IPv4: 10.0.0.100
Gateway: 10.0.0.1
DNS: 10.0.0.1

johnpoz

"10.0.0.1/25 range"

That is not a network address, that is a host address with a mask.. The network address would be 10.0.0.0/25, once you move the address into an actual possible host address then it no longer is a network address but a host address with mask.

10.0.0.0/25 would be
10.0.0.0 - 10.0.0.127

Where .0 is the wire or network and .127 would be the broadcast..

KOM

OK, now from a DOS box on that client can you do:

nslookup google.com

Have you gone through the Connectivity Troubleshooting guide?

That is not a network address, that is a host address with a mask.

Yes, I know. I figured he would get the point.

kaysersosa

I'm unable to access the internet from the client at all. I can ping from the pfSense box.

Client IP provided by the DHCP of the pfSense box is 10.0.0.100.

Gertjan

@kaysersosa:

I uploaded a former config and it didn't work again.

Proofs something is not good in that config.

@kaysersosa:

Console of pfSense shows, below. It grabbed both automatically, but I did set the LAN side
WAN -> v4/DHCP: 192.168.1.101/24
LAN -> v4: 10.0.0.1/25

/25 ? I would have chosen /24 ;)
Seems fine for the rest.

@kaysersosa:

I can ping google.com from the pfsense box, but a computer attached to the LAN side of pfsense cannot access google.com.

On that PC, what says

ipconfig /all

?

edit : ok, was already asked.
nslookup
test can also show the 'why'.

A PC should obtain a gateway == IP LAN pfSense - and the DNS IP should also be this IP. pfSense will be the 'DNS' for all your network devices.

The firewall rule on LAN is the "default pass all rule", right ?

@kaysersosa:

The DNS pfsense is showing is 127.0.0.1 and 2 of the hard coded DNS addresses from the ISP router.

This is what I have - my Dashboard says the same - I'm using the default Resolver.

@kaysersosa:

Unless my understanding is incorrect, I DMZ so I don't have to enter firewall rules into both routers and I can just pass through the ISP router.

Correct. Activate DMZ or individual firewall later, if every else works.

kaysersosa

Former configs worked without issues under other ISPs. Why I included current ISP info.

No firewall rules have been added to the pfSense box other than was is created by default.

======================
nslookup from the client pc

nslookup google.com

Server: pfSense-router.localdomain
Address: 10.0.0.1

DNS request timed out.
timeout was 2 seconds.
*** Request to pfSense-router.localdomain timed-out

======================
ipconfig from the client pc

ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : ********
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : localdomain

Ethernet adapter Ethernet:

Connection-specific DNS Suffix . : localdomain
Description . . . . . . . . . . . : This Qualcomm Atheros network Controller connects you to the network.
Physical Address. . . . . . . . . : ********
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : ********(Preferred)
IPv4 Address. . . . . . . . . . . : 10.0.0.100(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.128
Lease Obtained. . . . . . . . . . : Thursday, May 3, 2018 8:06:08 AM
Lease Expires . . . . . . . . . . : Thursday, May 3, 2018 10:06:08 AM
Default Gateway . . . . . . . . . : 10.0.0.1
DHCP Server . . . . . . . . . . . : 10.0.0.1
DHCPv6 IAID . . . . . . . . . . . : ********
DHCPv6 Client DUID. . . . . . . . : ********
DNS Servers . . . . . . . . . . . : 10.0.0.1
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Ethernet 3:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : PdaNet Broadband Adapter
Physical Address. . . . . . . . . : ********
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Ethernet 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : TeamViewer VPN Adapter
Physical Address. . . . . . . . . : ********
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

KOM

DNS isn't working. Is forwarder or resolver enabled and running?

kaysersosa

@KOM:

DNS isn't working. Is forwarder or resolver enabled and running?

DNS Resolver is enabled, Forwarder is not.

Gertjan

What says :

sockstat -4l | grep 'unbound'

ps ax | grep 'unbound'

kaysersosa

@Gertjan:

What says :

sockstat -4l | grep 'unbound'

ps ax | grep 'unbound'

Shell Output - sockstat -4l | grep 'unbound'

unbound unbound 22802 5 udp4 *:53 :
unbound unbound 22802 6 tcp4 *:53 :
unbound unbound 22802 7 tcp4 127.0.0.1:953 :
unbound unbound 22802 15 udp4 *:21274 :
unbound unbound 22802 16 udp4 *:5518 :
unbound unbound 22802 17 udp4 *:56616 :
unbound unbound 22802 18 udp4 *:26302 :
unbound unbound 22802 19 udp4 *:7986 :
unbound unbound 22802 20 udp4 *:47597 :
unbound unbound 22802 21 udp4 *:39864 :
unbound unbound 22802 22 udp4 *:25131 :
unbound unbound 22802 23 udp4 *:39016 :
unbound unbound 22802 24 udp4 *:23576 :
unbound unbound 22802 25 udp4 *:54912 :
unbound unbound 22802 27 udp4 *:16242 :
unbound unbound 22802 28 udp4 *:38933 :

Shell Output - ps ax | grep 'unbound'

22802 - Ss 0:21.49 /usr/local/sbin/unbound -c /var/unbound/unbound.conf
88305 - S 0:00.00 sh -c ps ax | grep 'unbound' 2>&1
88692 - S 0:00.00 grep unbound

kaysersosa

Still not resolved, any help out there?

johnpoz

And what does diagnostics, dns lookup show for www.google.com

Validate pfsense can actually resolve..

If it can resolve but clients can not - are they actually using pfsense for dns? Post up your lan rules.

dnslookup.png_thumb

kaysersosa

@johnpoz:

And what does diagnostics, dns lookup show for www.google.com

Validate pfsense can actually resolve..

If it can resolve but clients can not - are they actually using pfsense for dns? Post up your lan rules.

DNS Lookup for www.google.com - attached

LAN Rules - attached (default install, nothing changed by me on them)

![dns lookup.jpg](/public/imported_attachments/1/dns lookup.jpg)
![dns lookup.jpg_thumb](/public/imported_attachments/1/dns lookup.jpg_thumb)
![lan rules.jpg](/public/imported_attachments/1/lan rules.jpg)
![lan rules.jpg_thumb](/public/imported_attachments/1/lan rules.jpg_thumb)

johnpoz

Well from your client do a nslookup.. or better yet dig..

What does it come back?

Why would you be showing CNAME? www.google.com does not have any cname… And where is your AAAA record.. Your isp is dicking with your dns maybe?

Also if you are using resolver, all you should see is the loopback... why do you have those 99.x.x.x ?

fromclient.png_thumb