Netgate SG-1100 LAN in bridge mode with a router no internet

mike_broxt

Hi folks,

I'm new here and have some limited knowledge of network, please don't judge

Recently I purchased SG-1100 netgate, and it worked out of box. I set it up without any problems. Recently I traveled for a month and switched off electricity in my home. When I came back and switched it back on, little netgate blocked my internet connection. I'll try to explain shortly my set up that worked before:

ISP modem/router (LAN connected to WAN port of Netgate )
Netgate ( from LAN port to a WAN port of another router TP LINK ARCER C2300 )

Basically Netgate sits between ISP router and my router.

If I connect ISP router with my router it works well. If I connect ISP router with Netgate ( WAN port ) I can ping from Netgate any IP address. It means all devices are working properly. However it looks like Netgate is blocking outgoing traffic to WAN port of my router so I can't use wi-fi.

I assume it's IP conflict somewhere but can't solve this problem. I hope you can help me.

Thanking you in advance,

Mike

flowermoron

i had that same problem too, my entire wifi network, and ONLY my wifi network is blocked from accessing the net for some reason when i plug my pfsense to my network.

but everything connected by ethernet cable runs fine, gaming, netflix, etc.

mike_broxt

@flowermoron Have you found the way to fix it?

flowermoron

Yes, unplug it

im new to pfsense, sorry.

mike_broxt

@flowermoron Aahaha I won't give up

stephenw10

There are a number of things that could be happening here but, yes, a subnet conflict is most likely.
What subnets are you using here on the LAN of each of your three routers?

You are probably triple NATing unless you have set either of the other devices into bridge or access point mode which is generally bad but should not prevent outgoing connections.

Ideally the router you're using for WIFI should be set in access point mode. If it doesn't have one then you can do this: https://docs.netgate.com/pfsense/en/latest/recipes/external-wireless-router.html#turning-a-wireless-router-into-an-access-point

And the ISP router should be in bridge or modem mode so that the public IP is passed to the pfSense WAN directly. Many ISP devices do not allow that however.

Steve

flowermoron

@stephenw10 said in Netgate SG-1100 LAN in bridge mode with a router no internet:

https://docs.netgate.com/pfsense/en/latest/recipes/external-wireless-router.html#turning-a-wireless-router-into-an-access-point

this is where i can set my pfsense into an access point? but i dont need / have wifi.
seems the instructions are not easy to follow & made for experts, can anyone else explain some of the steps?

stephenw10

@flowermoron said in Netgate SG-1100 LAN in bridge mode with a router no internet:

this is where i can set my pfsense into an access point? but i dont need / have wifi.

No. You need wifi hardware to use pfSense as a wifi access point. But it makes a bad access point anyway.
But if you don't need wifi why are you trying to make pfSense into an AP?

This seems unrelated to your issue in which you're trying to use pfSense as a VPN router.

Steve

flowermoron

@stephenw10 said in Netgate SG-1100 LAN in bridge mode with a router no internet:

You need wifi hardware to use pfSense as a wifi access point. But it makes a bad access point anyway.

thanks, that's all i needed to know.

mike_broxt

@stephenw10 Thanks Steve for your reply. Please see below:

ISP modem/router (xDSL using PPPoE with username and password)
192.168.2.1
255.255.255.0

Netgate SG-1100
192.168.1.1/24

TP-Link
192.168.0.1
255.255.255.0

I can reset and configure TP-link and Netgate but I'm not sure if I can re-configure my ISP modem. As you mentioned often they don't allow it.

Any idea how the above-mentioned set up can be configured differently? I can assign different IP addresses and subnet masks in all 3 devices. It's awful design I'm completely aware of, but just trying to make it work :)

Thanks for your support,

Mike

mike_broxt

@stephenw10 Forgot to mention that my TP-Link can be set in AP mode if that helps

stephenw10

NATing at each router is ugly but should work fine for almost everything.

So if the 1100 itself can ping out to any site but things behind it cannot that implies an outbound NAT issue. Check the config in Firewall > NAT > Outbound. It should be in automatic mode (the default) and you should see automatic rules on the WAN interface shown.

Steve

stephenw10

Yeah the ideal scenario is only one NAT between clients and the internet. So that would mean the TP-link in AP mode and the ISP router in modem mode with the 1100 running the PPPoE session. But that can wait until you have it running as it is.

mike_broxt

@stephenw10 said in Netgate SG-1100 LAN in bridge mode with a router no internet:

Check the config in Firewall > NAT > Outbound. It should be in automatic mode (the default) and you should see automatic rules on the WAN interface shown.

I have checked and indeed it's set in automatic mode. I have reset both Tp-link & Netgate to default factory settings. To start off from there. Funny thing is that I can communicate with Netgate through TP-link ( using Wi-fi )

stephenw10

But do you see the expected automatically created rules there for WAN?

mike_broxt

@stephenw10 I see two rules automatically created. One thing that puzzles me is that when I reset the Netgate to factory settings, it still says:"current date and time 23rd of December 2021". That is really strange. That was the date I left my home for holidays.

stephenw10

Are you running a 22.01 Beta version?

The 1100 does not have a battery backed RTC so if it been de-powered and cannot connect to ntp it will show the build date.

Go to Diag > Ping. Try to ping netgate.com from the default source.
Now set the source to LAN and try again.

If it can ping from default or WAN but not LAN check Diag > Routes for a default route.

Steve

mike_broxt

@stephenw10 No Beta. It's running on 21.05.2-RELEASE. I have pinged netgate.com successfully from WAN & LAN as well. I have switched my TP Link to AP mode and connected LAN from the Netgate to LAN of TP LInk. No change.

mike_broxt

@stephenw10 some logs if it helps:

System logs → gateways:
dpinger
58371
WAN_DHCP 192.168.2.1: sendto error: 65

System logs → routing:

radvd
64557
sendmsg: Permission denied

System logs → DNS resolver

unbound
79031
[79031:0] info: failed to prime trust anchor -- DNSKEY rrset is not secure . DNSKEY IN

mike_broxt

@stephenw10 When I run a wizard after resetting the Netgate, do I need to leave DHCP as it is ( checkbox ticked something like override DHCP or something like that) Does empty DHCP fields need to remain empty by default? I saw in some tutorials ppl adding 8.8.8.8 and 8.8.4.4 with checkbox ticked override DHCP.