Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    I can't get Internet access on the LAN side

    Scheduled Pinned Locked Moved
    General pfSense Questions
    6
    15
    1.3k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • I
      ibrahim1989
      last edited by

      Hi ,
      Just configured my PfSense into a VirtualBox along side with Kali Linux.
      I have configured the IP address for WAN and enabled dhcp for LAN (range 192.168.10.10-192.168.10.100)
      Other virtual machines can get an IP address from the PfSense, but cannot ping or access internet!
      Tried to ping google from PfSense:
      WAN interface can ping google successfully.
      LAN interface can not ping google or any other page(ip)!

      Could you help please to solve this issue?
      Thank you,

      p.s.: Attached find my Firewall rules!
      Firewall Rules.PNG

      V GertjanG 3 Replies Last reply Reply Quote 0
      • V
        viragomann @ibrahim1989
        last edited by

        @ibrahim1989 said in I can't get Internet access on the LAN side:

        I have configured the IP address for WAN

        In the WAN interface settings you need to state an upstream gateway. Are you missing it?

        I 1 Reply Last reply Reply Quote 0
        • jimpJ jimp moved this topic from Forum Feedback on
        • GertjanG
          Gertjan @ibrahim1989
          last edited by

          @ibrahim1989 :

          8bfbd7fa-dcd1-4787-a262-670b43ac41ff-image.png

          So you disabled the default firewall rule (position 5 & 6) you've found on your LAN interface, and created a couple of your your own.
          Good initiative.

          But, be ready, you'll be laughing in 10 seconds from now.

          Here we go :

          @ibrahim1989 said in I can't get Internet access on the LAN side:

          Tried to ping google from PfSense:
          WAN interface can ping google successfully.
          LAN interface can not ping google or any other page(ip)!

          When you use the ping command, you transmit 'Ethernet' packets to the destination.
          I'm pretty sure that you know that these packets are not TCP, not UDP, they are ICMP packets.
          Right ?
          Look at your rules : do you permit ICMP packets to go through ?

          ...... (just to round up to 10 seconds)

          😊 👍

          Btw : while straighten up info in your head, hunt down also this one "DNS is only UDP". Change it for "DNS is TCP and UDP".
          And adapt that firewall rule.

          No "help me" PM's please. Use the forum, the community will thank you.
          Edit : and where are the logs ??

          I 1 Reply Last reply Reply Quote 0
          • I
            ibrahim1989 @viragomann
            last edited by

            @viragomann yes I have done that , and everything is ok with the WAN accessing internet.

            1 Reply Last reply Reply Quote 0
            • I
              ibrahim1989 @Gertjan
              last edited by

              @gertjan I have previously created ICMP rules ( not UDP or TCP ) , but still the same problem . (sorry didnt include in the screenshot)
              Also disabled default rules to check step by step what could be wrong.
              For the DNS I have tried to configure as TCP and UDP, only UDP or TCP , but still the same problem.
              The screenshot I've posted is just to get an idea :)

              p.s. : Is good to laugh but after connecting LAN with Internet :p

              Thanks!

              KOMK 1 Reply Last reply Reply Quote 0
              • KOMK
                KOM @ibrahim1989
                last edited by

                @ibrahim1989 Add an ICMP Echo Request allow rule, edit your DNS rule to add TCP as well as UDP.

                I 1 Reply Last reply Reply Quote 0
                • I
                  ibrahim1989 @KOM
                  last edited by

                  @kom said in I can't get Internet access on the LAN side:

                  @ibrahim1989 Add an ICMP Echo Request allow rule, edit your DNS rule to add TCP as well as UDP.

                  I have tried that but didnt work .

                  1 Reply Last reply Reply Quote 0
                  • V
                    viragomann @ibrahim1989
                    last edited by

                    @ibrahim1989 said in I can't get Internet access on the LAN side:

                    WAN interface can ping google successfully.
                    LAN interface can not ping google or any other page(ip)!

                    I assume you're meaning the source in the ping tool here.

                    The ping from pfSense itself doesn't require any firewall rule. Hence, there should be something wrong with the routing.

                    The only one thing on pfSense, which can be responsible for such behavior, I can think of, is the outbound NAT. But this should work if the proper gateway is set in the WAN interface settings.
                    So I suspect an issue with the hypervisor.

                    But do a further check:
                    Run a packet capture on WAN with a filter for ICMP packets and the destination host, while you try to ping to the internet with a LAN source address, and check if the NAT works properly.
                    You should see outgoing packets from the WAN address then.

                    1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by

                      I think you have a gateway defined in the WAN subnet but it's not actually on the WAN interface dircetly.
                      When you define the WAN as a static IP you need to add that.

                      I 1 Reply Last reply Reply Quote 0
                      • I
                        ibrahim1989 @stephenw10
                        last edited by

                        @stephenw10 said in I can't get Internet access on the LAN side:

                        I think you have a gateway defined in the WAN subnet but it's not actually on the WAN interface dircetly.
                        When you define the WAN as a static IP you need to add that.

                        I have assigned a static IP for the WAN Gateway , (IPv4 Upstream Gateway ) , if you are talking about that.

                        @stephenw10 said in I can't get Internet access on the LAN side:

                        I think you have a gateway defined in the WAN subnet but it's not actually on the WAN interface dircetly.
                        When you define the WAN as a static IP you need to add that.

                        GertjanG 1 Reply Last reply Reply Quote 0
                        • GertjanG
                          Gertjan @ibrahim1989
                          last edited by

                          @ibrahim1989 said in I can't get Internet access on the LAN side:

                          I have assigned a static IP for the WAN Gateway , (IPv4 Upstream Gateway ) , if you are talking about that

                          This one :

                          e7479c61-2c21-4323-9553-99b19dcace3b-image.png

                          should be set to None, as shown. The default setting will do fine.

                          No "help me" PM's please. Use the forum, the community will thank you.
                          Edit : and where are the logs ??

                          I 1 Reply Last reply Reply Quote 1
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            It should be set to None for a LAN interface but must be set as a gateway there for a WAN. Otherwise you will get no auto outbound NAT rules.

                            Check in Firewall > NAT > Oubound NAT. Do you see auto rules added for 192.168.10.0/24 on the WAN?

                            Steve

                            I 1 Reply Last reply Reply Quote 1
                            • I
                              ibrahim1989 @stephenw10
                              last edited by

                              @stephenw10 said in I can't get Internet access on the LAN side:

                              It should be set to None for a LAN interface but must be set as a gateway there for a WAN. Otherwise you will get no auto outbound NAT rules.

                              Check in Firewall > NAT > Oubound NAT. Do you see auto rules added for 192.168.10.0/24 on the WAN?

                              Steve

                              Thanks a lot! Finally Solved . LAN gateway must be set to none , and WAN must have the Gateway. Really appreciate your help and to other friends!

                              Best regards!
                              Ibrahim!

                              1 Reply Last reply Reply Quote 0
                              • I
                                ibrahim1989 @Gertjan
                                last edited by

                                @gertjan Hello Gertjan , finally solved
                                WAN was ok, but I had to change the LAN gateway to none. Thanks a lot!

                                R 1 Reply Last reply Reply Quote 0
                                • R
                                  rcoleman-netgate Netgate @ibrahim1989
                                  last edited by

                                  @ibrahim1989 said in I can't get Internet access on the LAN side:

                                  WAN was ok, but I had to change the LAN gateway to none. Thanks a lot!

                                  Yes, if the pfSense is routing that specific network do not set a gateway.

                                  Ryan
                                  Repeat, after me: MESH IS THE DEVIL! MESH IS THE DEVIL!
                                  Requesting firmware for your Netgate device? https://go.netgate.com
                                  Switching: Mikrotik, Netgear, Extreme
                                  Wireless: Aruba, Ubiquiti

                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post