Static IP on WAN results in no connectivity

dominicm · Aug 27, 2018, 3:19 PM

I have configured the mandatory isp router to work with pfsense. The issue is that it seems there is no way to disable the unnecessary isp router's dhcp server without loosing internet connectivity. I tried setting up static IP on the wan interface but I loose internet and the isp router's ip starts serving pfsense web ui. Why does this happen?
All I changed was dhcp to static and entered ipv4 address (isp router = 192.168.2.1). Other settings are all default including subnet mask (/32). I am not sure if I need to set a gateway. I did not disable dhcp server on the isp router because if I do I loose access to the router and have to reset to factory settings. I did RTFM. What is the proper way to get this working?

johnpoz · Aug 27, 2018, 4:09 PM

/32 is not a proper mask.. That is a host only mask, used for loopback address types or firewall rules. It is not a mask that contains more than 1 address since the mask is all 32 bits of the address which is what the /32 means

What does it matter if the isp routers dhcp server is on or not? Just setup a reservation for pfsense wan interface in your isp routers dhcp server so pfsense will get its IP via dhcp and always be the same address. Which to be honest should never change anyway even without reservation since pfsense would always be on and renew its address, etc.

Lets call this network 192.168.2.0/24 Your ips router could be 192.168.2.1, if you want to set it static then pfsense wan IP would be
192.168.2.2
mask /24 or 255.255.255.0 (same thing)
gateway 192.168.2.1

BTW - a /30 is the normal mask used for when you need to address on transit network since it gives valid host address 192.168.2.0/32 where .0 is the wire/network .1 and .2 is host addresses and .3 would be the broadcast address for that network.

beremonavabi · Aug 27, 2018, 4:21 PM

@dominicm said in Static IP on WAN results in no connectivity:

... I did not disable dhcp server on the isp router because if I do I loose access to the router and have to reset to factory settings....

You could try adding that unwanted DHCP server's address to the "Reject leases from" field of Interfaces > WAN > DHCP Client Configuration to stop pfSense from getting a lease from the cable modems DHCP server.

dominicm · Aug 28, 2018, 9:23 AM

@johnpoz

Thanks for the response. I do find this quite confusing. The reason I picked /32 was because it was the default setting and also provides 1 address which made sense since I only needed 1 device on this network. Why is it default if it's the wrong setting?

DHCP on/off on isp router doesn't really matter, just annoying not to be able to turn it off when it shouldn't be necessary. Every resource seems to say you can turn it off and set static ip on pfsenses which makes sense. I would like to know why/how this works in general.

My isp router is currently set to 192.168.2.1/24 and accessible via the web interface (behind pfsense). Why do I need dhcp on at all when I both isp router and pfsense(wan port) have static static ips?

Your suggested setting worked. I also tried with gateway set to none, why does it still work?

Derelict · Aug 28, 2018, 9:34 AM

@dominicm said in Static IP on WAN results in no connectivity:

Why is it default if it's the wrong setting?

Because there is absolutely no way to know what netmask a static WAN is going to require. None. You get the provisioning from the ISP and configure accordingly.

johnpoz · Aug 28, 2018, 9:57 AM

@dominicm said in Static IP on WAN results in no connectivity:

I also tried with gateway set to none, why does it still work?

Where did you set gateway to none?

dominicm · Aug 28, 2018, 4:09 PM

@johnpoz said in Static IP on WAN results in no connectivity:

@dominicm said in Static IP on WAN results in no connectivity:

I also tried with gateway set to none, why does it still work?

Where did you set gateway to none?

Wan interface -> Static IPv4 Configuration -> IPv4 Upstream gateway

I don't see any other gateway option.

johnpoz · Aug 28, 2018, 10:30 AM

post up a picture of

System / Routing / Gateways

it not going to work if you do not have a gateway set on your wan..

dominicm · Aug 28, 2018, 10:39 AM

@johnpoz

It's literally only one entry I added (this is a clean pfsense install):

Sky (default)	WAN	192.168.2.1	192.168.2.1

Both "Sky" and "None" seems to work in WAN settings.

johnpoz · Aug 28, 2018, 10:46 AM

that is your default route - so yeah its going to work with that.. its your "default"

If you remove that then no its not going to work..

JKnott · Aug 28, 2018, 10:56 AM

@dominicm said in Static IP on WAN results in no connectivity:

Why is it default if it's the wrong setting?

A /32 is used to denote a specific address. On a network, you need at least 2 devices to be useful. That means a mask no longer than a /31, as might be used on point to point links. You need at least as many addresses as possible devices, which is why we often see /24 on local networks. That provides room for 256 addresses, of which 254 are usable.

dominicm · Aug 28, 2018, 10:59 AM

@johnpoz said in Static IP on WAN results in no connectivity:

that is your default route - so yeah its going to work with that.. its your "default"

If you remove that then no its not going to work..

I did think that default might do that so I tried disabling it before I posted and it's still working fine. It looks like it didn't apply until I rebooted after an update. I only got connectivity back after I enabled the gateway and set it in WAN page.

dominicm · Aug 28, 2018, 4:14 PM

@jknott

From what you said it seems like /32 would never be usable in WAN settings so why would it be the default I do not understand. I would expect a default to be the most common config or something similar.

johnpoz · Aug 28, 2018, 11:22 AM

Its the end of the the dropdown list nothing more.. ANYONE setting a static IP should KNOW what the mask means - or they shouldn't be freaking setting it static in the first place. Or they would be following directions given to them with what mask to use..

And /32 for sure could be used in some configurations.. Where the gateway is different L3 network, but same L2.. So yeah it does have viable setups where it would and could be used. But those are not very common.

Why does my TV when it turn on default to channel 3, there is nothing on channel 3 in my area - is the same sort of question your asking about why does it default to /32

Derelict · Aug 28, 2018, 4:09 PM

@dominicm

@dominicm said in Static IP on WAN results in no connectivity:

Where did you set gateway to none?

Wan interface -> Static IPv4 Configuration -> IPv4 Upstream gateway
I don't see any other gateway option.

In that case you would still have a default route to that gateway in the routing table. You just would not have route-to/reply-to on the states. With one WAN it would probably still work fine. With multi-wan you would hit all kinds of problems. Automatic NAT would also break because it would not consider WAN to be a WAN without a gateway set on the interface configuration. Probably other things too but those are the two biggies.

Derelict · Aug 28, 2018, 4:14 PM

@dominicm said in Static IP on WAN results in no connectivity:

@jknott

From what you said it seems like /32 would never be usable in WAN settings so why would it be the default I do not understand. I would expect a default to be the most common config or something similar.

Probably best to just set the correct netmask and move on. I have brought this up several times. It is not going to change. No matter what the default is set to it will be wrong for most people.

It is incumbent upon the administrator to set the proper interface address and netmask on a new interface.

jimp · Aug 30, 2018, 2:25 PM

There are some backwoods providers out there that give customers a /32 WAN IP Address with a gateway outside of what would otherwise be their subnet. It's ugly, but it happens.

As @Derelict said, no matter what we pick as the default it will be wrong more often than it is right. Using /32 as the default is less likely to break something than using /1 as the default, and any value in the middle is a wild guess.