Clientlan not able to reach WAN Gateway
-
Hi,
I have a strange issue and need some haelp to narrow down what the cause could be.
My Pfsense has a client Lan 192.168.178.0/24 and WAN 192.168.99.0/24 . Upstream gateway is my Router from cable provider ( Fritzbox cable). Today my provider told me to reset the Fritz Box. So I did. Afterwards I set up everything as before, like IP address of the Fritz ( 192.168.99.1) Pfsense also got the same WAN ip ( 192.168.99.100). From Pfsense I can ping into the internet. Even my Wireguard connection to datacenter is working, but from Clientlan I do not get any connection to the Internet, I cannot even ping 192.168.99.1. Ping to WAN IP (192.168.99.100) works.
Actually I have no clue what is going wrong and I am not able to debug that issue. Any hints are appriciated. Thanks.
-
@toddehb
Is your Outbound NAT running in automatic mode? -
@viragomann said in Clientlan not able to reach WAN Gateway:
@toddehb
Is your Outbound NAT running in automatic mode?You are my hero ;-) Created NAT rule and everything ist fine again. Thanks.
-
@toddehb said in Clientlan not able to reach WAN Gateway:
Created NAT rule and everything ist fine again
There should of been no reason to have create outbound nat rules.. Even if you had manual rules, you said the IP of pfsense wan was the same.. Did it change to a different interface than before?
Are you using automatic, manual, hybrid for your nat rules - there is rarely any reason to change them from automatic. If you do have a specific need to do something different than just natting to your wan address, like vpn connection or vip or something on your wan - that can be accomplished with hybrid mode.
Manual mode would only be required on very specific use cases, etc.
-
It is set to manual mode. Don't ask me why
IP did not change. WAN is on DHCP. After Reset of Fritz Box the Wan interface could have gotten a different IP, cause the default Net of the Fritz Box is not what I am using. Could that make pfsense to forget about NAT entries? -
@toddehb if it didn't get the same IP as before that could of been issue sure. So did you switch back to automatic?
The most common reason people are manual is they followed some vpn guide that said to do that - when its not needed at all, all that is needed for a vpn is hybrid and set a outbound nat for your vpn.
-
you are right, I read a Wireguard guide suggesting to switch to manual. Is it save to go back to auto or maybe hybrid without loosing current settings?
-
@toddehb switch to auto, make sure normal works. Then switch to hybrid create whatever nat you want/need for wireguard in the hybrid
Delete all your settings, switch back to auto normally leaves them
https://docs.netgate.com/pfsense/en/latest/recipes/wireguard-client.html#outbound-nat
That looks to be instructions for wireguard..
-
thanks. I will do so.
-
@toddehb said in Clientlan not able to reach WAN Gateway:
you are right, I read a Wireguard guide suggesting to switch to manual
I'm wondering, why this stupid tuts are suggesting to set the outbound NAT to manual again and again over the years.
I bet, the writer even cannot answer this question. -
@viragomann most of those of guides are clearly written by someone that doesn't actually understand what they are doing..
from the nord 2.5 pfsense guide
That is the default web cert that pfsense creates for self signed for you to access the web gui... It sure and F is not a client cert you should use to connect to a vpn.. So clearly they are not using client certs - so the guide should say set that to none
This is from my client connection to a vps of mine I run for demo purposes in helping people here with client vpn setups, etc. I use the ns1 cert that is the actual client cert. But if your not going to actually use a cert to auth, which clearly your web gui self signed cert is not going to auth to some vpn service on the internet - then it should be set to none.
Every single guide I have read over by these vpn services are pretty lame to be honest..
-
@johnpoz
Omg. That's really bad!So clearly they are not using client certs - so the guide should say set that to none
Agree. If they would check the certs you would never get a connection. ^^
-
@viragomann Eveyone I have ever looked horrible.. I would never in a million years send traffic to any of these services - they can't even write a doc that makes any sense.. They hand it off to the intern most likely who copies it from somewhere else not understanding what any of it does..
-
J jimp moved this topic from Problems Installing or Upgrading pfSense Software on
-
@viragomann said in Clientlan not able to reach WAN Gateway:
I'm wondering, why this stupid tuts are suggesting to set the outbound NAT to manual again and again over the years.
They do that specifically to prevent LAN traffic leaving the WAN outside the VPN. Because persuading users that unencrypted traffic there is somehow unsafe and must all be sent via them is their business model. It also gets me that they use the term 'kill switch' for that.
-
@stephenw10 but it doesn't look at the stupid nord guide, it has you switch to manual and create nord output nat, but it doesn't have you delete the normal wan nats.. So it wouldn't stop normal traffic from leaving out your normal wan..
If they had you delete all the outbound other than the nord, ok that could be their business model or goal. But from the guides I havve seen they just don't have a clue what hybrid does, etc.
And they say to delete all the IPv6 outbound nat rules - WTF???
Why anyone would actually trust moving data through these people is beyond me..
maybe typo with ipv6 and they meant all rules? But then they show you what your outbound nat should look like
They are all bad - have looked at all the so called major players in this vpn space - they are just horrible without a clue to what the F they are trying to even accomplish..
-
I mean.... I'm pretty sure that's what they are trying to do. But that doesn't rule out ineptitude!
Hanlon's razor may apply.
