Virgin Media SuperHub3 - Internet accessible from WAN interface of pfSense, but not from LAN

  • Hi. Ive got pfSense on ESXi VM running on a construction site - so the whole system - ESXi machine, switches, cable modem, etc is often switched on and off at same time from a fuse board.
    Sometimes when the power is switched on, everything works out of the box, but on average every second time the system starts, im getting no routing between WAN and LAN/OVPN interfaces in pfSense. PfSense gets a correct ip addresses from DHCP server, i can ping from WAN interface in pfSense, i can even VPN to pfSense network from outside location, but there's no outbound traffic from internal network to the Internet. Usually it can be fixed by restarting pfSense and/or ESXi a couple of times. Anyone can advise how to troubleshoot this?

    0_1548184967627_Screenshot 2019-01-22 at 08.20.25.png

    0_1548184986541_Screenshot 2019-01-22 at 19.08.13.png

    1_1548185027435_Screenshot 2019-01-22 at 19.10.26.png 0_1548185027435_Screenshot 2019-01-22 at 19.10.15.png

    0_1548185072032_Screenshot 2019-01-22 at 19.09.08.png

  • LAYER 8 Global Moderator

    Why is your outbound nat in Hybrid? And why do you have outbound nat for your LAN address?

  • I believe that all those rules were auto generated when I was setting up pfSense.
    I changed from automatic to hybrid when I was setting up OVPN and assumed that i will need hybrid if additional Nat rules are added

    Kind regards

  • LAYER 8 Global Moderator

    Well you have NO added rules... And NO you should not have outbound nat rules on your LAN... Did you set a gateway on your lan interface??? Which it tells you like 100 times during setup not to do..

    Do you have the same network on your wan and lan?

    Why do you have on your em1? And you understand your tunnel network is overlapping with that pfblocker vip which created a route for 10.10/16 out em1??

    Yeah you have a gateway set on your lan this Why would you set that? Its no longer a lan network when you do that but another wan interface..

    Im surprised it works at all!!

    I would start over ;)

  • @johnpoz said in No routing (?) LAN<>WAN every 2nd-3rd restart:

    Do you have the same network on your wan and lan?

    No, WAN interface is connected to a Virgin Media cable model running in "semi-bridge" mode.

    Did you set a gateway on your lan interface???

    I believe i only have one gateway.
    0_1548191205270_Screenshot 2019-01-22 at 21.05.46.png

    Why do you have on your em1?

    That's something pfBlockerNG automatically set up. is the virtual IP address it uses (i have chosen it, because documentation says that vIP should be outside of the ip range which is 10.10.x.x for me)

    Yeah you have a gateway set on your lan this

    10.10.255.x is range for OVPN clients, was probably my machine when i've been making those screenshots.

  • After around 20 restarts i believe i found the problem - which surprisingly doesn't lay in pfSense configuration at all.
    Ive got a Virgin Media UK SuperHub 3 router/modem set up in "modem mode", which in reality is not a real bridge mode, but a "semi-bridge mode". When a computer connects to modem WAN interface it receives two DHCP leases - one from Virgin Media's network and one from the modem itself. Only the first one is correct thought, the second one is meant only for modem management. I read about this issue before and i had "Reject leases from" set up in my WAN interface.

    Now, when i was comparing screenshots from pfSense made when it's working with ones made when only WAN interface has internet connectivity i noticed that "Reject leases" option is not always working:
    When everything is ok, WAN gateway IP is "dynamic".
    When only WAN interface has internet connectivity, WAN Gateway IP is "".

    So i still dont have an idea how to fix it, but it's definitely a SuperHub 3 problem.

  • Netgate Administrator

    It looks like you have no default route. I would resave the WAN as your default gateway and recheck the routing table to make sure a default route is present.


Log in to reply