ATT Internet AIr

[stephenw10]

Go to Diag > States and filter by :53

What is logged in the System and Gateway logs when you reconnect the Frontier modem?
How are you running the failover test? Physically unplugging something?

[ahole4sure]

@stephenw10 I'll have to retest and check the logs

And yes to fail - I just unplug the ethernet cord from the back of the frontier modem

[ahole4sure]

@stephenw10
Here are the screen shots of the info
Apologies and thanks for help!!

They start with states during failover
Show the DNS error on web browser
(the is with Forwarder Mode off under DNS Resolver settings)

Then shows what happens after waiting for Frontier WAN to come back up

Ultimately would not fully connect and come back up untill full reboot of pfsense

[ahole4sure]

@stephenw10

[ahole4sure]

@Gblenn
I have checked ALL for both

Is that correct?

[stephenw10]

Hmm, no DNS states shown there on states with ports starting with 53. You might need to filter differently to see that in the states.

I don't see the link state change in the logs there. Does it actually show the that when you reconnect the modem?

[Gblenn]

@ahole4sure said in ATT Internet AIr:

@Gblenn
I have checked ALL for both

Is that correct?

Yes that is correct, and I'm starting to think that ATT is actually blocking access to authoritative servers... If this is true you either have to stick to Forwarder mode, or ask ATT to stop blocking. I wonder if there is some setting you can change for your account perhaps?

On the fiber issue, there are a few things that stand out to me.

1. Gateway shows an IP but status is pending. So that IP is probably cached data in pfsense, the link is up (eth to frontier box) but pfsense has not verified the DHCP lease?

2. I notice you have IPv6 enabled on the fiber WAN. Could that cause issues? Try disabling it and see if that makes any difference when testing?

3. Have you tried pulling the fiber instead of the ethernet cable to pfsense? If that is possible to do?
   Keeping the physical link up on pfsense interface thoughout the test... If there is something on that side that isn't really working as it should?
   If you look at the dashboard instead of Status / Gateways, you will also see the negotiated settings for the interface. Does that seem ok, and is it the same before and after pulling and reconnecting the cable?

[ahole4sure]

@stephenw10
Yes it does show this when I reconnect the Frontier fiber modem -- I will have to try it again this PM to try to get the states again
As far as ATT - wonder if @Gblenn is correct - I have been reading that ATT has some sort of DNS assist that could be hijacking my DNS queries -- not sure how to determine that.

https://gist.github.com/CollinChaffin/24f6c9652efb3d6d5ef2f5502720ef00

@Gblenn
I will retest with IPv6 disableld tonight ! I see (after some ressearch) that ATT could be hijacking the DNS. I will look into this. Thanks

[stephenw10]

Yes if they're redirecting DNS that would break the resolver.

[Gblenn]

@ahole4sure Why can't ISP's just leave things alone... I'm assuming, since you run the modem(s) in passthrough mode, that it's not in the device that is being blocked, or is it?
I'm thinking you need to log in to their portal (your accounts) to disable that "helper feature"...

[ahole4sure]

@Gblenn @stephenw10

So am trying to leave things in situ as they have been setting and working (ie the ATT modems)
They are supposoed to be accesible from my LAN (and they were right after I re setup my pfsense) - via 192.168.2.1 and 192.168.3.1 (set in the device as the configuration addresses)
Through VIPs

For some reason I can't access either of those VIPs any longer --

I was trying to see if I could change the DNS settings we were discussing.

I can ping both 192.168.2.1 and 192.168.3.1 but can't access via web browser

[stephenw10]

Do you have outbound NAT rules in place for those?

[ahole4sure]

@stephenw10

Just auto
But looks like it’s there ????

[stephenw10]

Well it looks like you have conflict with the 192.168.2.10 VIP. You have that subnet on an internal interface too it appears since it's included in the auto rules.

You should also have manual rules to translate to the VIPs for traffic from LAN to the modem.

[ahole4sure]

@stephenw10

I think it is where I set up a static route trying to do what @Gblenn had suggested back in this thread previously

So the static route must have done the auto rule

Just so I don’t screw it up, after I have now deleted the static route, how should I set up the the outbound rule?

[ahole4sure]

@stephenw10
So I got rid of the static route and then created the NAT rule ( ?? correct )

Still get the error trying to reach 192.168.2.1

[ahole4sure]

@stephenw10

Correction == waited for a bit

This worked
Thanks