Cant acces internet.



  • Hi there,

    i have a fresh installed pfsens 1.2.2 box witch woulnt connect to the internet.

    this is what i am trying to achieve. but without any succes.

    10.1.1.0 <=> pfsense <=> 192.168.1.0 <=> modem/router <=> internet

    [pfsens config:]
    WAN 192.168.1.65(DHCP)
    LAN 10.1.1.123 (STATIC)
    DHCP server enabled
    DNS 192.168.1.254 <– de speedtouch router/modem

    tracert 192.168.1.254 (speedtouch.lan)

    1   <1 ms   <1 ms   <1 ms  pfSense.local [10.1.1.123]
    2     1 ms   <1 ms   <1 ms  speedtouch.lan [192.168.1.254]
    

    tracert google.nl

    1   <1 ms   <1 ms   <1 ms  pfSense.local [10.1.1.123]
    2     *        *        *     Time-out bij opdracht.
    

    nslookup naar google.nl:

    
    Name:    google.nl
    Addresses:  216.239.59.104, 74.125.77.104, 209.85.229.104
    
    

    nslookup works so its nog a DNS problem.
    tracert wornt work. zo i hope there is a firewall problem. but in the log (firewall) there is nothing blocked

    Thanx in advance



  • Under your WAN interface, there is a checkbox at the bottom that says "Block private networks".  This should be checked by default.  If your WAN IP is a private IP, you need (I think) to uncheck this.



  • Yeah i saw that. but it isnt working. even when its enabled i can ping/tracert to 192.168.. witch if i am correct should be blocked by the first option!

    Block private networks
    When set, this option blocks traffic from IP addresses that are reserved for private
    networks as per RFC 1918 (10/8, 172.16/12, 192.168/16) as well as loopback addresses
    (127/8). You should generally leave this option turned on, unless your WAN network
    lies in such a private address space, too.

    Block bogon networks
    When set, this option blocks traffic from IP addresses that are reserved (but not RFC 1918) or not yet assigned by IANA.
    Bogons are prefixes that should never appear in the Internet routing table, and obviously should not appear as the source address in any packets you receive.

    so i tryed every option with this 2 checkboxes :P nothing seems to help.

    maybe for your information. i have no WAN firewall rules added.
    and only the default LAN rule



  • what does 'netstat -rn' say?



  • Internet:
    Destination        Gateway            Flags    Refs      Use  Netif Expire
    default            link#2             UCS         0        0    xl1
    127.0.0.1          127.0.0.1          UH          1        0    lo0
    10.1.1.0/24      link#3             UC          0        0    xl2
    10.1.1.42        00:21:5a:61:1e:2c  UHLW        1     4615    xl2   1198
    192.168.1.0/24     link#2             UC          0        0    xl1
    192.168.1.65       127.0.0.1          UGHS        0       63    lo0
    192.168.1.254      00:14:7f:de:b9:b7  UHLW        1       20    xl1   1196
    
    Internet6:
    Destination                       Gateway                       Flags      Netif Expire
    ::1                               ::1                           UHL         lo0
    fe80::%xl1/64                     link#2                        UC          xl1
    fe80::210:4bff:fe45:2256%xl1      00:10:4b:45:22:56             UHL         lo0
    fe80::%xl2/64                     link#3                        UC          xl2
    fe80::20a:5eff:fe1d:e1d0%xl2      00:0a:5e:1d:e1:d0             UHL         lo0
    fe80::%lo0/64                     fe80::1%lo0                   U           lo0
    fe80::1%lo0                       link#7                        UHL         lo0
    ff01:2::/32                       link#2                        UC          xl1
    ff01:3::/32                       link#3                        UC          xl2
    ff01:7::/32                       ::1                           UC          lo0
    ff02::%xl1/32                     link#2                        UC          xl1
    ff02::%xl2/32                     link#3                        UC          xl2
    ff02::%lo0/32                     ::1                           UC          lo0
    #
    


  • hmmm, that looks okay, i didn't think it was an issue, just wanted to check.  it's odd that dns works, but not traceroute.  does anything other than dns work?  question: since you have pfsense that can be a good firewall, why do you have the modem in router mode?  can you switch it to bridging mode at all and avoid all this?



  • thats because the ADSL line is used at the moment by other users that need it for work :P

    we have multiple ADSL lines. with each a very old cisco firewall. witch need to replace.
    now i want to loadbalans those 2 ADSL lines with 2 pfsense servers witch replace the cisco's

    so i installed the pfsens behind one adsl line to try it. but i cant get on the Internet. so thats not very promising



  • can you be more specific about what you have tried?  you said traceroute doesn't work, but you didn't answer if anything else did.



  • oke im sorry,

    1)changed the dns from the general page to my providers dsn (dint work - so i changed it back)
    2)when i go to the firewall rules (WAN) the is a message

    No rules are currently defined for this interface.
    All incoming connections on this interface will be blocked until you add pass rules.

    so i thought aha that must be the problem.

    i added a rule

       	   	Proto  	Source  	Port  	Destination  	Port  	Gateway  	Schedule  	Description  	
    	 permit	* 	* 	* 	* 	* 	* 
    

    so everything is allowed but when i tracert 192.168.1.254 i doesn't work anymore
    so changed that back again.

    3)added a static route. dint work also
    4)used other network cards as well
    5)checked the option -> Disable Firewall    Disable all packet filtering. (oke the program is almost useless with this option on but oke) still not able to acces the internet

    proberly i  tryed more but without succes

    properly there i am doing something wrong with the firewall rules. but i dont know what



  • well, now you are just flailing, trying a 100 different things - this is a recipe for failure :(  question: it looks like some kind of multiwan setup?  if so, this should really be posted in the multiwan forum, as there may be some multiwan complexity.  if not, i would just reinstall the pfsense, since it seems like it is all buggered up now.  set the WAN up for a simple default setup, where you get the DNS server from the IP provider (in this case, the modem should be passing the DNS server IPs with the DHCP info).



  • @danswartz:

    well, now you are just flailing, trying a 100 different things - this is a recipe for failure :(  question: it looks like some kind of multiwan setup?  if so, this should really be posted in the multiwan forum, as there may be some multiwan complexity.  if not, i would just reinstall the pfsense, since it seems like it is all buggered up now.  set the WAN up for a simple default setup, where you get the DNS server from the IP provider (in this case, the modem should be passing the DNS server IPs with the DHCP info).

    i know, thats why i changed only 1 thing at a time. and changed it back when it not worked.

    at the moment every thing is just like a fresh install. (and i did like 10 factory defaults between)
    about the multi lan. you mean this ?

    a pfsense box with 4nics 1x lan 3x wan ?

    or

    a pfsense box with 2nics 1x lan 1x wan behind a modem/router ?
    this one aplys to me.



  • ah, okay, so you don't have more than one WAN?  for some reason, i thought you did.  do the other users of the ADSL modem have routers or whatever in between their LANs  and the modem?



  • oke this is the setup.

    oww im good with paint :P



  • One question I thought I asked before (but you haven't said?): is it just traceroute broken?  Can you surf to remote servers and such?



  • ow sorry danswartz, no i cant acces the internet in anyway.

    traceroute
    ping
    http
    ftp
    or anything else

    only nslookup witch seems to be oke

    U:\>nslookup google.com
    Server:  pfsense.local
    Address:  172.16.1.123
    
    Non-authoritative answer:
    Name:    google.com
    Addresses:  74.125.45.100, 74.125.67.100, 74.125.53.100
    

    maybe i need to enter a firewall rule for wan or lan it seems to be the firewall that blocks the respons

    –------------



  • aha, that makes sense.  your windows client is using the pfsense as the dns forwarder, so the requests for DNS are coming from pfsense itself, not the client.  can you post your firewall rules?



  • just the factory default rule

    [LAN]
    Lan -> any
    [WAN]
    nothing

    –--
    before i tried different things but all ended up with nothing.
    i tryed. on the wan side permit any to any protocol any. but that did not work
    so im back at square one :)



  • yeah, you don't want/need wan rules.  the lan rules should be fine and you are able to tracert to the modem so that is okay.  can you do 'ifconfig' command and post results?  also, from a pfsense shell, do 'tcpdump -i xl1 -lnnvv' and then try going to a website from the windows box and post tcpdump output?



  • ifconfig from the pfsense:

    xl0: flags=8802 <broadcast,simplex,multicast>metric 0 mtu 1500
            options=9 <rxcsum,vlan_mtu>ether 00:10:4b:45:22:c4
            media: Ethernet autoselect (none)
            status: no carrier
    xl1: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
            options=9 <rxcsum,vlan_mtu>ether 00:10:4b:45:22:56
            inet6 fe80::210:4bff:fe45:2256%xl1 prefixlen 64 scopeid 0x2
            inet 0.0.0.0 netmask 0xff000000 broadcast 255.255.255.255
            media: Ethernet autoselect (100baseTX <full-duplex>)
            status: active
    xl2: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
            options=9 <rxcsum,vlan_mtu>ether 00:0a:5e:1d:e1:d0
            inet6 fe80::20a:5eff:fe1d:e1d0%xl2 prefixlen 64 scopeid 0x3
            inet 172.16.1.123 netmask 0xffffff00 broadcast 172.16.1.255
            media: Ethernet autoselect (100baseTX <full-duplex>)
            status: active
    plip0: flags=108810 <pointopoint,simplex,multicast,needsgiant>metric 0 mtu 1500
    pflog0: flags=100 <promisc>metric 0 mtu 33204
    pfsync0: flags=41 <up,running>metric 0 mtu 1460
            pfsync: syncdev: lo0 syncpeer: 224.0.0.240 maxupd: 128
    lo0: flags=8049 <up,loopback,running,multicast>metric 0 mtu 16384
            inet 127.0.0.1 netmask 0xff000000
            inet6 ::1 prefixlen 128
            inet6 fe80::1%lo0 prefixlen 64 scopeid 0x7
    enc0: flags=0<> metric 0 mtu 1536</up,loopback,running,multicast></up,running></promisc></pointopoint,simplex,multicast,needsgiant></full-duplex></rxcsum,vlan_mtu></up,broadcast,running,simplex,multicast></full-duplex></rxcsum,vlan_mtu></up,broadcast,running,simplex,multicast></rxcsum,vlan_mtu></broadcast,simplex,multicast>
    

    ipconfig /all (on my windows test box)

    Ethernet-adapter LAN-verbinding:
    
            Verbindingsspec. DNS-achtervoegsel:
            Beschrijving . . . . . . . . . . .:
              Broadcom NetXtreme Gigabit Ethernet
            Fysiek adres. . . . . . . . . . . : 00-21-5A-61-1E-2C
            DHCP ingeschakeld:. . . . . . . . : nee
            IP-adres. . . . . . . . . . . . . : 172.16.1.42
            Subnetmasker. . . . . . . . . . . : 255.255.255.0
            Standaardgateway. . . . . . . . . : 172.16.1.123
            DNS-servers . . . . . . . . . . . : 172.16.1.123
    

    tcpdump -i xl1 -lnnvv

    # tcpdump -i xl1 -lnnvv
    tcpdump: listening on xl1, link-type EN10MB (Ethernet), capture size 96 bytes
    15:26:19.085134 IP (tos 0x0, ttl 64, id 46412, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.9652 > 192.168.1.254.53: [udp sum ok] 26724+ PTR? 110.1.16.172.in-addr.arpa. (43)
    15:26:19.098981 IP (tos 0x0, ttl 64, id 48691, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.9652: 26724 NXDomain q: PTR? 110.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:19.131815 IP (tos 0x0, ttl 64, id 19248, offset 0, flags [none], proto UDP (17), length 70) 192.168.1.65.27403 > 192.168.1.254.53: [udp sum ok] 53750+ PTR? 41.1.16.172.in-addr.arpa. (42)
    15:26:19.146110 IP (tos 0x0, ttl 64, id 48695, offset 0, flags [none], proto UDP (17), length 118) 192.168.1.254.53 > 192.168.1.65.27403: 53750 NXDomain* q: PTR? 41.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. SOA[|domain]
    15:26:19.226273 IP (tos 0x0, ttl 64, id 11284, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.19414 > 192.168.1.254.53: [udp sum ok] 5510+ PTR? 112.1.16.172.in-addr.arpa. (43)
    15:26:19.239950 IP (tos 0x0, ttl 64, id 48699, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.19414: 5510 NXDomain q: PTR? 112.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:19.464444 IP (tos 0x0, ttl 64, id 29489, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.55621 > 192.168.1.254.53: [udp sum ok] 62440+ PTR? 113.1.16.172.in-addr.arpa. (43)
    15:26:19.478081 IP (tos 0x0, ttl 64, id 48703, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.55621: 62440 NXDomain q: PTR? 113.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:19.629630 IP (tos 0x0, ttl 64, id 54818, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.39242 > 192.168.1.254.53: [udp sum ok] 43566+ PTR? 117.1.16.172.in-addr.arpa. (43)
    15:26:19.642528 IP (tos 0x0, ttl 64, id 48707, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.39242: 43566 NXDomain q: PTR? 117.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:19.722555 IP (tos 0x0, ttl 64, id 32522, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.26576 > 192.168.1.254.53: [udp sum ok] 3743+ PTR? 120.1.16.172.in-addr.arpa. (43)
    15:26:19.735889 IP (tos 0x0, ttl 64, id 48710, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.26576: 3743 NXDomain q: PTR? 120.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:19.917091 IP (tos 0x0, ttl 64, id 49016, offset 0, flags [none], proto UDP (17), length 68) 192.168.1.65.17590 > 192.168.1.254.53: [udp sum ok] 26628+ A? 0.pfsense.pool.ntp.org. (40)
    15:26:19.930075 IP (tos 0x0, ttl 64, id 48715, offset 0, flags [none], proto UDP (17), length 164) 192.168.1.254.53 > 192.168.1.65.17590: 26628 q: A? 0.pfsense.pool.ntp.org. 6/0/0 0.pfsense.pool.ntp.org. CNAME[|domain]
    15:26:19.930560 IP (tos 0x0, ttl 64, id 60704, offset 0, flags [none], proto UDP (17), length 68) 192.168.1.65.11264 > 192.168.1.254.53: [udp sum ok] 26629+ AAAA? 0.pfsense.pool.ntp.org. (40)
    15:26:19.944516 IP (tos 0x0, ttl 64, id 48719, offset 0, flags [none], proto UDP (17), length 148) 192.168.1.254.53 > 192.168.1.65.11264: 26629 q: AAAA? 0.pfsense.pool.ntp.org. 1/1/0 0.pfsense.pool.ntp.org. CNAME[|domain]
    15:26:20.017123 IP (tos 0x0, ttl 64, id 24928, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.8116 > 192.168.1.254.53: [udp sum ok] 22243+ PTR? 119.1.16.172.in-addr.arpa. (43)
    15:26:20.031065 IP (tos 0x0, ttl 64, id 48722, offset 0, flags [none], proto UDP (17), length 119) 192.168.1.254.53 > 192.168.1.65.8116: 22243 NXDomain* q: PTR? 119.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (91)
    15:26:20.054431 arp who-has 145.24.129.5 tell 192.168.1.65
    15:26:20.255325 arp who-has 87.251.35.240 tell 192.168.1.65
    15:26:20.317957 IP (tos 0x0, ttl 64, id 45677, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.46411 > 192.168.1.254.53: [udp sum ok] 17070+ PTR? 122.1.16.172.in-addr.arpa. (43)
    15:26:20.330855 IP (tos 0x0, ttl 64, id 48727, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.46411: 17070 NXDomain q: PTR? 122.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:20.455346 arp who-has 131.211.84.189 tell 192.168.1.65
    15:26:20.655324 arp who-has 87.238.168.24 tell 192.168.1.65
    15:26:20.722692 IP (tos 0x0, ttl 64, id 5501, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.57709 > 192.168.1.254.53: [udp sum ok] 39617+ PTR? 125.1.16.172.in-addr.arpa. (43)
    15:26:20.737382 IP (tos 0x0, ttl 64, id 48731, offset 0, flags [none], proto UDP (17), length 119) 192.168.1.254.53 > 192.168.1.65.57709: 39617 NXDomain* q: PTR? 125.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (91)
    15:26:20.796077 IP (tos 0x0, ttl 64, id 34592, offset 0, flags [none], proto UDP (17), length 59) 192.168.1.65.30593 > 192.168.1.254.53: [udp sum ok] 18569+ A? www.google.nl. (31)
    15:26:20.810083 IP (tos 0x0, ttl 64, id 48734, offset 0, flags [none], proto UDP (17), length 203) 192.168.1.254.53 > 192.168.1.65.30593: 18569 q: A? www.google.nl. 8/0/0 www.google.nl. CNAME[|domain]
    15:26:20.812239 arp who-has 74.125.77.106 tell 192.168.1.65
    15:26:20.855284 arp who-has 80.85.129.103 tell 192.168.1.65
    15:26:21.046655 IP (tos 0x0, ttl 64, id 52782, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.65378 > 192.168.1.254.53: [udp sum ok] 21105+ PTR? 130.1.16.172.in-addr.arpa. (43)
    15:26:21.055261 arp who-has 145.24.129.5 tell 192.168.1.65
    15:26:21.060113 IP (tos 0x0, ttl 64, id 48739, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.65378: 21105 NXDomain q: PTR? 130.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:21.255193 arp who-has 87.251.35.240 tell 192.168.1.65
    15:26:21.455302 arp who-has 131.211.84.189 tell 192.168.1.65
    15:26:21.499526 IP (tos 0x0, ttl 64, id 12601, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.61633 > 192.168.1.254.53: [udp sum ok] 50841+ PTR? 132.1.16.172.in-addr.arpa. (43)
    15:26:21.514417 IP (tos 0x0, ttl 64, id 48743, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.61633: 50841 NXDomain q: PTR? 132.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:21.654478 IP (tos 0x0, ttl 64, id 14382, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.31893 > 192.168.1.254.53: [udp sum ok] 33603+ PTR? 131.1.16.172.in-addr.arpa. (43)
    15:26:21.655175 arp who-has 87.238.168.24 tell 192.168.1.65
    15:26:21.669169 IP (tos 0x0, ttl 64, id 48747, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.31893: 33603 NXDomain q: PTR? 131.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:21.797285 IP (tos 0x0, ttl 64, id 13904, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.42929 > 192.168.1.254.53: [udp sum ok] 65070+ PTR? 133.1.16.172.in-addr.arpa. (43)
    15:26:21.810578 IP (tos 0x0, ttl 64, id 48751, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.42929: 65070 NXDomain q: PTR? 133.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:21.855110 arp who-has 80.85.129.103 tell 192.168.1.65
    15:26:22.030405 IP (tos 0x0, ttl 64, id 36450, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.2075 > 192.168.1.254.53: [udp sum ok] 29501+ PTR? 140.1.16.172.in-addr.arpa. (43)
    15:26:22.043635 IP (tos 0x0, ttl 64, id 48755, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.2075: 29501 NXDomain q: PTR? 140.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:22.055089 arp who-has 145.24.129.5 tell 192.168.1.65
    15:26:22.255035 arp who-has 87.251.35.240 tell 192.168.1.65
    15:26:22.324829 IP (tos 0x0, ttl 64, id 42772, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.62927 > 192.168.1.254.53: [udp sum ok] 7241+ PTR? 142.1.16.172.in-addr.arpa. (43)
    15:26:22.338520 IP (tos 0x0, ttl 64, id 48759, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.62927: 7241 NXDomain q: PTR? 142.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:22.455110 arp who-has 131.211.84.189 tell 192.168.1.65
    15:26:22.592448 IP (tos 0x0, ttl 64, id 22839, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.6707 > 192.168.1.254.53: [udp sum ok] 53460+ PTR? 141.1.16.172.in-addr.arpa. (43)
    15:26:22.606304 IP (tos 0x0, ttl 64, id 48762, offset 0, flags [none], proto UDP (17), length 119) 192.168.1.254.53 > 192.168.1.65.6707: 53460 NXDomain* q: PTR? 141.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (91)
    15:26:22.654996 arp who-has 87.238.168.24 tell 192.168.1.65
    15:26:22.854935 arp who-has 80.85.129.103 tell 192.168.1.65
    15:26:22.944143 IP (tos 0x0, ttl 64, id 13183, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.52172 > 192.168.1.254.53: [udp sum ok] 44205+ PTR? 143.1.16.172.in-addr.arpa. (43)
    15:26:22.958246 IP (tos 0x0, ttl 64, id 48765, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.52172: 44205 NXDomain q: PTR? 143.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:23.054960 arp who-has 145.24.129.5 tell 192.168.1.65
    15:26:23.254869 arp who-has 87.251.35.240 tell 192.168.1.65
    15:26:23.346812 IP (tos 0x0, ttl 64, id 63354, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.35754 > 192.168.1.254.53: [udp sum ok] 39883+ PTR? 144.1.16.172.in-addr.arpa. (43)
    15:26:23.361250 IP (tos 0x0, ttl 64, id 48769, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.35754: 39883 NXDomain q: PTR? 144.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:23.454876 arp who-has 131.211.84.189 tell 192.168.1.65
    15:26:23.531753 IP (tos 0x0, ttl 64, id 53884, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.22740 > 192.168.1.254.53: [udp sum ok] 49876+ PTR? 145.1.16.172.in-addr.arpa. (43)
    15:26:23.545472 IP (tos 0x0, ttl 64, id 48772, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.22740: 49876 NXDomain q: PTR? 145.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:23.654841 arp who-has 87.238.168.24 tell 192.168.1.65
    15:26:23.671687 IP (tos 0x0, ttl 64, id 33050, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.13972 > 192.168.1.254.53: [udp sum ok] 17784+ PTR? 147.1.16.172.in-addr.arpa. (43)
    15:26:23.684923 IP (tos 0x0, ttl 64, id 48776, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.13972: 17784 NXDomain q: PTR? 147.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:23.830369 arp who-has 74.125.77.106 tell 192.168.1.65
    15:26:23.854815 arp who-has 80.85.129.103 tell 192.168.1.65
    15:26:23.985802 IP (tos 0x0, ttl 64, id 52769, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.42403 > 192.168.1.254.53: [udp sum ok] 13884+ PTR? 146.1.16.172.in-addr.arpa. (43)
    15:26:23.999766 IP (tos 0x0, ttl 64, id 48780, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.42403: 13884 NXDomain q: PTR? 146.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:24.008380 IP (tos 0x0, ttl 64, id 13331, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.47964 > 192.168.1.254.53: [udp sum ok] 57061+ PTR? 150.1.16.172.in-addr.arpa. (43)
    15:26:24.021422 IP (tos 0x0, ttl 64, id 48783, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.47964: 57061 NXDomain q: PTR? 150.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:24.194968 IP (tos 0x0, ttl 64, id 29038, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.51749 > 192.168.1.254.53: [udp sum ok] 10229+ PTR? 148.1.16.172.in-addr.arpa. (43)
    15:26:24.208280 IP (tos 0x0, ttl 64, id 48788, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.51749: 10229 NXDomain q: PTR? 148.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:24.621783 IP (tos 0x0, ttl 64, id 18194, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.15842 > 192.168.1.254.53: [udp sum ok] 28377+ PTR? 134.1.16.172.in-addr.arpa. (43)
    15:26:24.636054 IP (tos 0x0, ttl 64, id 48792, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.15842: 28377 NXDomain q: PTR? 134.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:24.740772 IP (tos 0x0, ttl 64, id 52256, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.2204 > 192.168.1.254.53: [udp sum ok] 8730+ PTR? 161.1.16.172.in-addr.arpa. (43)
    15:26:24.754153 IP (tos 0x0, ttl 64, id 48796, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.2204: 8730 NXDomain q: PTR? 161.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:24.883571 IP (tos 0x0, ttl 64, id 45326, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.19590 > 192.168.1.254.53: [udp sum ok] 35124+ PTR? 162.1.16.172.in-addr.arpa. (43)
    15:26:24.897093 IP (tos 0x0, ttl 64, id 48800, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.19590: 35124 NXDomain q: PTR? 162.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.081683 IP (tos 0x0, ttl 64, id 28977, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.53561 > 192.168.1.254.53: [udp sum ok] 34616+ PTR? 163.1.16.172.in-addr.arpa. (43)
    15:26:25.095590 IP (tos 0x0, ttl 64, id 48804, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.53561: 34616 NXDomain q: PTR? 163.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.210095 IP (tos 0x0, ttl 64, id 23659, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.41990 > 192.168.1.254.53: [udp sum ok] 37591+ PTR? 164.1.16.172.in-addr.arpa. (43)
    15:26:25.216291 IP (tos 0x0, ttl 64, id 43110, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.26743 > 192.168.1.254.53: [udp sum ok] 9956+ PTR? 174.1.16.172.in-addr.arpa. (43)
    15:26:25.219243 IP (tos 0x0, ttl 64, id 4928, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.25228 > 192.168.1.254.53: [udp sum ok] 62432+ PTR? 181.1.16.172.in-addr.arpa. (43)
    15:26:25.220254 IP (tos 0x0, ttl 64, id 64564, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.4515 > 192.168.1.254.53: [udp sum ok] 3015+ PTR? 166.1.16.172.in-addr.arpa. (43)
    15:26:25.222091 IP (tos 0x0, ttl 64, id 14358, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.7391 > 192.168.1.254.53: [udp sum ok] 13138+ PTR? 184.1.16.172.in-addr.arpa. (43)
    15:26:25.225029 IP (tos 0x0, ttl 64, id 60483, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.29043 > 192.168.1.254.53: [udp sum ok] 14471+ PTR? 185.1.16.172.in-addr.arpa. (43)
    15:26:25.226911 IP (tos 0x0, ttl 64, id 48814, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.41990: 37591 NXDomain q: PTR? 164.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.228047 IP (tos 0x0, ttl 64, id 29302, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.24951 > 192.168.1.254.53: [udp sum ok] 11948+ PTR? 186.1.16.172.in-addr.arpa. (43)
    15:26:25.230929 IP (tos 0x0, ttl 64, id 28201, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.59024 > 192.168.1.254.53: [udp sum ok] 30438+ PTR? 188.1.16.172.in-addr.arpa. (43)
    15:26:25.232799 IP (tos 0x0, ttl 64, id 48819, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.26743: 9956 NXDomain q: PTR? 174.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.234340 IP (tos 0x0, ttl 64, id 61250, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.28950 > 192.168.1.254.53: [udp sum ok] 1420+ PTR? 201.1.16.172.in-addr.arpa. (43)
    15:26:25.238066 IP (tos 0x0, ttl 64, id 48824, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.25228: 62432 NXDomain q: PTR? 181.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.241271 IP (tos 0x0, ttl 64, id 48827, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.4515: 3015 NXDomain q: PTR? 166.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.242163 IP (tos 0x0, ttl 64, id 48828, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.7391: 13138 NXDomain q: PTR? 184.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.246907 IP (tos 0x0, ttl 64, id 48829, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.29043: 14471 NXDomain q: PTR? 185.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.248153 IP (tos 0x0, ttl 64, id 48830, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.24951: 11948 NXDomain q: PTR? 186.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.254192 IP (tos 0x0, ttl 64, id 48831, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.59024: 30438 NXDomain q: PTR? 188.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.255031 IP (tos 0x0, ttl 64, id 48832, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.28950: 1420 NXDomain q: PTR? 201.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.330273 IP (tos 0x0, ttl 64, id 33289, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.63988 > 192.168.1.254.53: [udp sum ok] 11706+ PTR? 204.1.16.172.in-addr.arpa. (43)
    15:26:25.330905 IP (tos 0x0, ttl 64, id 50187, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.2668 > 192.168.1.254.53: [udp sum ok] 14374+ PTR? 203.1.16.172.in-addr.arpa. (43)
    15:26:25.331285 IP (tos 0x0, ttl 64, id 54570, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.8470 > 192.168.1.254.53: [udp sum ok] 17793+ PTR? 200.1.16.172.in-addr.arpa. (43)
    15:26:25.345157 IP (tos 0x0, ttl 64, id 48839, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.63988: 11706 NXDomain q: PTR? 204.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.347429 IP (tos 0x0, ttl 64, id 48840, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.2668: 14374 NXDomain q: PTR? 203.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.354185 IP (tos 0x0, ttl 64, id 48841, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.8470: 17793 NXDomain q: PTR? 200.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.355004 IP (tos 0x0, ttl 64, id 14655, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.57768 > 192.168.1.254.53: [udp sum ok] 10962+ PTR? 205.1.16.172.in-addr.arpa. (43)
    15:26:25.355434 IP (tos 0x0, ttl 64, id 48254, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.45995 > 192.168.1.254.53: [udp sum ok] 15193+ PTR? 207.1.16.172.in-addr.arpa. (43)
    15:26:25.370081 IP (tos 0x0, ttl 64, id 48846, offset 0, flags [none], proto UDP (17), length 119) 192.168.1.254.53 > 192.168.1.65.57768: 10962 NXDomain* q: PTR? 205.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (91)
    15:26:25.374260 IP (tos 0x0, ttl 64, id 48847, offset 0, flags [none], proto UDP (17), length 119) 192.168.1.254.53 > 192.168.1.65.45995: 15193 NXDomain* q: PTR? 207.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (91)
    15:26:25.426957 IP (tos 0x0, ttl 64, id 13613, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.19113 > 192.168.1.254.53: [udp sum ok] 23378+ PTR? 206.1.16.172.in-addr.arpa. (43)
    15:26:25.427606 IP (tos 0x0, ttl 64, id 46174, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.61486 > 192.168.1.254.53: [udp sum ok] 60638+ PTR? 210.1.16.172.in-addr.arpa. (43)
    15:26:25.429121 IP (tos 0x0, ttl 64, id 31827, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.52876 > 192.168.1.254.53: [udp sum ok] 294+ PTR? 193.1.16.172.in-addr.arpa. (43)
    15:26:25.435228 IP (tos 0x0, ttl 64, id 8239, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.64151 > 192.168.1.254.53: [udp sum ok] 21120+ PTR? 214.1.16.172.in-addr.arpa. (43)
    15:26:25.437796 IP (tos 0x0, ttl 64, id 26423, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.33020 > 192.168.1.254.53: [udp sum ok] 49482+ PTR? 216.1.16.172.in-addr.arpa. (43)
    15:26:25.438818 IP (tos 0x0, ttl 64, id 6657, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.7002 > 192.168.1.254.53: [udp sum ok] 36044+ PTR? 213.1.16.172.in-addr.arpa. (43)
    15:26:25.440801 IP (tos 0x0, ttl 64, id 2645, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.49809 > 192.168.1.254.53: [udp sum ok] 53401+ PTR? 215.1.16.172.in-addr.arpa. (43)
    15:26:25.443675 IP (tos 0x0, ttl 64, id 12579, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.16246 > 192.168.1.254.53: [udp sum ok] 16554+ PTR? 227.1.16.172.in-addr.arpa. (43)
    15:26:25.446598 IP (tos 0x0, ttl 64, id 14959, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.15833 > 192.168.1.254.53: [udp sum ok] 8696+ PTR? 222.1.16.172.in-addr.arpa. (43)
    15:26:25.448647 IP (tos 0x0, ttl 64, id 48862, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.19113: 23378 NXDomain q: PTR? 206.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.449758 IP (tos 0x0, ttl 64, id 33640, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.54114 > 192.168.1.254.53: [udp sum ok] 55908+ PTR? 229.1.16.172.in-addr.arpa. (43)
    15:26:25.452720 IP (tos 0x0, ttl 64, id 17715, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.33579 > 192.168.1.254.53: [udp sum ok] 17142+ PTR? 230.1.16.172.in-addr.arpa. (43)
    15:26:25.454883 IP (tos 0x0, ttl 64, id 48867, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.61486: 60638 NXDomain q: PTR? 210.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.455857 IP (tos 0x0, ttl 64, id 3454, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.62710 > 192.168.1.254.53: [udp sum ok] 58340+ PTR? 232.1.16.172.in-addr.arpa. (43)
    15:26:25.458323 IP (tos 0x0, ttl 64, id 42504, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.50461 > 192.168.1.254.53: [udp sum ok] 20738+ PTR? 238.1.16.172.in-addr.arpa. (43)
    15:26:25.461223 IP (tos 0x0, ttl 64, id 48872, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.52876: 294 NXDomain q: PTR? 193.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.461701 IP (tos 0x0, ttl 64, id 42309, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.47666 > 192.168.1.254.53: [udp sum ok] 41761+ PTR? 240.1.16.172.in-addr.arpa. (43)
    15:26:25.464313 IP (tos 0x0, ttl 64, id 34639, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.22595 > 192.168.1.254.53: [udp sum ok] 44356+ PTR? 242.1.16.172.in-addr.arpa. (43)
    15:26:25.467469 IP (tos 0x0, ttl 64, id 22100, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.44074 > 192.168.1.254.53: [udp sum ok] 59313+ PTR? 243.1.16.172.in-addr.arpa. (43)
    15:26:25.467488 IP (tos 0x0, ttl 64, id 48877, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.64151: 21120 NXDomain q: PTR? 214.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.470177 IP (tos 0x0, ttl 64, id 1905, offset 0, flags [none], proto UDP (17), length 71) 192.168.1.65.54184 > 192.168.1.254.53: [udp sum ok] 6206+ PTR? 247.1.16.172.in-addr.arpa. (43)
    15:26:25.472851 IP (tos 0x0, ttl 64, id 48882, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.33020: 49482 NXDomain q: PTR? 216.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.473533 IP (tos 0x0, ttl 64, id 44591, offset 0, flags [none], proto UDP (17), length 70) 192.168.1.65.4056 > 192.168.1.254.53: [udp sum ok] 61175+ PTR? 25.1.16.172.in-addr.arpa. (42)
    15:26:25.475912 IP (tos 0x0, ttl 64, id 65307, offset 0, flags [none], proto UDP (17), length 70) 192.168.1.65.4006 > 192.168.1.254.53: [udp sum ok] 33131+ PTR? 50.1.16.172.in-addr.arpa. (42)
    15:26:25.479108 IP (tos 0x0, ttl 64, id 48887, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.7002: 36044 NXDomain q: PTR? 213.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.484054 IP (tos 0x0, ttl 64, id 48892, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.49809: 53401 NXDomain q: PTR? 215.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.484877 IP (tos 0x0, ttl 64, id 48893, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.16246: 16554 NXDomain q: PTR? 227.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.485702 IP (tos 0x0, ttl 64, id 48894, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.15833: 8696 NXDomain q: PTR? 222.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.487398 IP (tos 0x0, ttl 64, id 48895, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.54114: 55908 NXDomain q: PTR? 229.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.488652 IP (tos 0x0, ttl 64, id 48896, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.33579: 17142 NXDomain q: PTR? 230.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.489480 IP (tos 0x0, ttl 64, id 48897, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.62710: 58340 NXDomain q: PTR? 232.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.490347 IP (tos 0x0, ttl 64, id 48898, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.50461: 20738 NXDomain q: PTR? 238.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.491157 IP (tos 0x0, ttl 64, id 48899, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.47666: 41761 NXDomain q: PTR? 240.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.491981 IP (tos 0x0, ttl 64, id 48900, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.22595: 44356 NXDomain q: PTR? 242.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.492832 IP (tos 0x0, ttl 64, id 48901, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.44074: 59313 NXDomain q: PTR? 243.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.494775 IP (tos 0x0, ttl 64, id 48902, offset 0, flags [none], proto UDP (17), length 120) 192.168.1.254.53 > 192.168.1.65.54184: 6206 NXDomain q: PTR? 247.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. (92)
    15:26:25.495592 IP (tos 0x0, ttl 64, id 48903, offset 0, flags [none], proto UDP (17), length 119) 192.168.1.254.53 > 192.168.1.65.4056: 61175 NXDomain q: PTR? 25.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. SOA[|domain]
    15:26:25.496416 IP (tos 0x0, ttl 64, id 48904, offset 0, flags [none], proto UDP (17), length 119) 192.168.1.254.53 > 192.168.1.65.4006: 33131 NXDomain q: PTR? 50.1.16.172.in-addr.arpa. 0/1/0 ns: 16.172.in-addr.arpa. SOA[|domain]
    15:26:29.864438 arp who-has 74.125.77.106 tell 192.168.1.65
    15:26:29.868927 IP (tos 0x0, ttl 64, id 25145, offset 0, flags [none], proto UDP (17), length 68) 192.168.1.65.10547 > 192.168.1.254.53: [udp sum ok] 44132+ A? 0.pfsense.pool.ntp.org. (40)
    15:26:29.882039 IP (tos 0x0, ttl 64, id 48908, offset 0, flags [none], proto UDP (17), length 164) 192.168.1.254.53 > 192.168.1.65.10547: 44132 q: A? 0.pfsense.pool.ntp.org. 6/0/0 0.pfsense.pool.ntp.org. CNAME[|domain]
    15:26:29.882516 IP (tos 0x0, ttl 64, id 12669, offset 0, flags [none], proto UDP (17), length 68) 192.168.1.65.43317 > 192.168.1.254.53: [udp sum ok] 44133+ AAAA? 0.pfsense.pool.ntp.org. (40)
    15:26:29.896293 IP (tos 0x0, ttl 64, id 48911, offset 0, flags [none], proto UDP (17), length 148) 192.168.1.254.53 > 192.168.1.65.43317: 44133 q: AAAA? 0.pfsense.pool.ntp.org. 1/1/0 0.pfsense.pool.ntp.org. CNAME[|domain]
    15:26:30.005911 arp who-has 213.206.97.167 tell 192.168.1.65
    15:26:30.206806 arp who-has 87.238.168.24 tell 192.168.1.65
    15:26:30.406870 arp who-has 87.251.35.240 tell 192.168.1.65
    15:26:30.606753 arp who-has 145.24.129.5 tell 192.168.1.65
    15:26:30.806742 arp who-has 82.94.245.2 tell 192.168.1.65
    15:26:31.006716 arp who-has 213.206.97.167 tell 192.168.1.65
    15:26:31.206686 arp who-has 87.238.168.24 tell 192.168.1.65
    15:26:31.406705 arp who-has 87.251.35.240 tell 192.168.1.65
    15:26:31.606612 arp who-has 145.24.129.5 tell 192.168.1.65
    15:26:31.806607 arp who-has 82.94.245.2 tell 192.168.1.65
    15:26:32.006593 arp who-has 213.206.97.167 tell 192.168.1.65
    15:26:32.206515 arp who-has 87.238.168.24 tell 192.168.1.65
    15:26:32.406579 arp who-has 87.251.35.240 tell 192.168.1.65
    15:26:32.606488 arp who-has 145.24.129.5 tell 192.168.1.65
    15:26:32.806413 arp who-has 82.94.245.2 tell 192.168.1.65
    15:26:33.006420 arp who-has 213.206.97.167 tell 192.168.1.65
    15:26:33.206360 arp who-has 87.238.168.24 tell 192.168.1.65
    15:26:33.406413 arp who-has 87.251.35.240 tell 192.168.1.65
    15:26:33.606317 arp who-has 145.24.129.5 tell 192.168.1.65
    15:26:33.806290 arp who-has 82.94.245.2 tell 192.168.1.65
    

    Firewall log

    
    	Oct 29 15:23:30 	LAN 	172.16.1.42:26686 	74.125.77.164:80 	TCP:A
    	Oct 29 15:23:31 	LAN 	172.16.1.42:26685 	74.125.77.164:80 	TCP:A
    	Oct 29 15:23:31 	LAN 	172.16.1.42:26955 	74.125.10.81:80 	TCP:A
    	Oct 29 15:23:32 	LAN 	172.16.1.42:26682 	74.125.77.154:80 	TCP:F
    	Oct 29 15:23:32 	LAN 	172.16.1.42:26955 	74.125.10.81:80 	TCP:F
    	Oct 29 15:23:32 	LAN 	172.16.1.42:26683 	74.125.77.164:80 	TCP:F
    	Oct 29 15:23:32 	LAN 	172.16.1.42:25681 	74.125.79.113:80 	TCP:F
    	Oct 29 15:23:32 	LAN 	172.16.1.42:26684 	74.125.77.164:80 	TCP:A
    	Oct 29 15:23:33 	LAN 	172.16.1.42:26955 	74.125.10.81:80 	TCP:A
    	Oct 29 15:23:33 	LAN 	172.16.1.42:26683 	74.125.77.164:80 	TCP:A
    	Oct 29 15:23:33 	LAN 	172.16.1.42:26683 	74.125.77.164:80 	TCP:F
    	Oct 29 15:23:34 	LAN 	172.16.1.42:26955 	74.125.10.81:80 	TCP:F
    	Oct 29 15:23:35 	LAN 	172.16.1.42:26955 	74.125.10.81:80 	TCP:A
    	Oct 29 15:23:36 	LAN 	172.16.1.42:26683 	74.125.77.164:80 	TCP:F
    	Oct 29 15:23:39 	LAN 	172.16.1.42:26955 	74.125.10.81:80 	TCP:F
    	Oct 29 15:23:39 	LAN 	172.16.1.42:26955 	74.125.10.81:80 	TCP:A
    	Oct 29 15:23:40 	LAN 	172.16.1.42:25681 	74.125.79.113:80 	TCP:A
    	Oct 29 15:23:41 	LAN 	172.16.1.42:26683 	74.125.77.164:80 	TCP:F
    	Oct 29 15:23:42 	LAN 	172.16.1.42:26683 	74.125.77.164:80 	TCP:A
    	Oct 29 15:23:45 	LAN 	172.16.1.42:26684 	74.125.77.164:80 	TCP:F
    	Oct 29 15:23:45 	LAN 	172.16.1.42:26685 	74.125.77.164:80 	TCP:F
    	Oct 29 15:23:45 	LAN 	172.16.1.42:26686 	74.125.77.164:80 	TCP:F
    	Oct 29 15:23:46 	LAN 	172.16.1.42:26682 	74.125.77.154:80 	TCP:A
    	Oct 29 15:23:46 	LAN 	172.16.1.42:26686 	74.125.77.164:80 	TCP:A
    	Oct 29 15:23:48 	LAN 	172.16.1.42:26682 	74.125.77.154:80 	TCP:F
    	Oct 29 15:23:48 	LAN 	172.16.1.42:26685 	74.125.77.164:80 	TCP:A
    


  • I see why nothing is working - all references to outside hosts are trying to ARP for their MAC addresses, which is insane.  BTW, you did not provide 'ifconfig' output.



  • ifconfig from the pfsense:

    xl0: flags=8802 <broadcast,simplex,multicast>metric 0 mtu 1500
            options=9 <rxcsum,vlan_mtu>ether 00:10:4b:45:22:c4
            media: Ethernet autoselect (none)
            status: no carrier
    xl1: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
            options=9 <rxcsum,vlan_mtu>ether 00:10:4b:45:22:56
            inet6 fe80::210:4bff:fe45:2256%xl1 prefixlen 64 scopeid 0x2
            inet 0.0.0.0 netmask 0xff000000 broadcast 255.255.255.255
            media: Ethernet autoselect (100baseTX <full-duplex>)
            status: active
    xl2: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
            options=9 <rxcsum,vlan_mtu>ether 00:0a:5e:1d:e1:d0
            inet6 fe80::20a:5eff:fe1d:e1d0%xl2 prefixlen 64 scopeid 0x3
            inet 172.16.1.123 netmask 0xffffff00 broadcast 172.16.1.255
            media: Ethernet autoselect (100baseTX <full-duplex>)
            status: active
    plip0: flags=108810 <pointopoint,simplex,multicast,needsgiant>metric 0 mtu 1500
    pflog0: flags=100 <promisc>metric 0 mtu 33204
    pfsync0: flags=41 <up,running>metric 0 mtu 1460
            pfsync: syncdev: lo0 syncpeer: 224.0.0.240 maxupd: 128
    lo0: flags=8049 <up,loopback,running,multicast>metric 0 mtu 16384
            inet 127.0.0.1 netmask 0xff000000
            inet6 ::1 prefixlen 128
            inet6 fe80::1%lo0 prefixlen 64 scopeid 0x7
    enc0: flags=0<> metric 0 mtu 1536</up,loopback,running,multicast></up,running></promisc></pointopoint,simplex,multicast,needsgiant></full-duplex></rxcsum,vlan_mtu></up,broadcast,running,simplex,multicast></full-duplex></rxcsum,vlan_mtu></up,broadcast,running,simplex,multicast></rxcsum,vlan_mtu></broadcast,simplex,multicast>
    

    ipconfig /all (on my windows test box)

    Ethernet-adapter LAN-verbinding:
    
            Verbindingsspec. DNS-achtervoegsel:
            Beschrijving . . . . . . . . . . .:
              Broadcom NetXtreme Gigabit Ethernet
            Fysiek adres. . . . . . . . . . . : 00-21-5A-61-1E-2C
            DHCP ingeschakeld:. . . . . . . . : nee
            IP-adres. . . . . . . . . . . . . : 172.16.1.42
            Subnetmasker. . . . . . . . . . . : 255.255.255.0
            Standaardgateway. . . . . . . . . : 172.16.1.123
            DNS-servers . . . . . . . . . . . : 172.16.1.123
    

    Btw thanx for all the effort, man this seems to be a newb problem but i cant figure why :O

    ARP for there mac's? DNS problem then



  • no, it has nothing to do with DNS - you only ever ARP for addresses in your subnet.  i see the problem now, your xl1 has no IP address.  it is apparently NOT getting one from the modem/router!

    
    xl1: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
            options=9 <rxcsum,vlan_mtu>ether 00:10:4b:45:22:56
            inet6 fe80::210:4bff:fe45:2256%xl1 prefixlen 64 scopeid 0x2
            inet 0.0.0.0 netmask 0xff000000 broadcast 255.255.255.255 <==== BINGO!!!!
            media: Ethernet autoselect (100baseTX <full-duplex>)
            status: active</full-duplex></rxcsum,vlan_mtu></up,broadcast,running,simplex,multicast> 
    


  • i noticed that to. but when i look in the web interface of pfsense i says this

    pfSense:

    pfSense Shell:

    Speedtouch Router/Modem:

    so this seems to be strage but i thought that is was becouse i recieve DHCP from wan

    oke i wil try to give my WAN interface a fixed ip. maybe that wil fix my problem. one moment

    edit:

    
    xl1: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
            options=9 <rxcsum,vlan_mtu>ether 00:10:4b:45:22:56
            inet6 fe80::210:4bff:fe45:2256%xl1 prefixlen 64 scopeid 0x2
            inet 192.168.1.30 netmask 0xffffffff broadcast 192.168.1.30
            media: Ethernet autoselect (100baseTX <full-duplex>)
            status: active
    xl2: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
            options=9 <rxcsum,vlan_mtu>ether 00:0a:5e:1d:e1:d0
            inet6 fe80::20a:5eff:fe1d:e1d0%xl2 prefixlen 64 scopeid 0x3
            inet 172.16.1.123 netmask 0xffffff00 broadcast 172.16.1.255
            media: Ethernet autoselect (100baseTX <full-duplex>)
            status: active</full-duplex></rxcsum,vlan_mtu></up,broadcast,running,simplex,multicast></full-duplex></rxcsum,vlan_mtu></up,broadcast,running,simplex,multicast> 
    

    still no internet.



  • well, a couple of things: your subnet mask for the WAN should NOT be 255.255.255.255!  It should be 255.255.255.0.  Also make sure you set the default gateway to 192.168.1.254.



  • at home i booted a system i installed a long time ago. and there is pfsense installed :P dint know i still got that on the harddisk
    is there a way to figure out je install date of the machine ?

    EDIT: built on Thu Jan 8 22:30:24 EST 2009 haha

    this system works like hell.

    so im going to copy the setting and see if i can make it work ;)
    if it works i will post the solution

    *** Problem SOLVED!! ***

    oke it was the 255.255.255.0 thanx you danswartz :D
    in the wan static config was 192.168.1.30/32 witch had to be /24
    i still don't know why DHCP wast working because at home WAN witch DHCP works normal

    but never the less my problem is solved :D

    (omg i feel kinda stupid this has to be the easiest problem to be :o)



  • different subnets is a must, nothing silly.


Log in to reply