ATT Internet AIr
-
Yes if they're redirecting DNS that would break the resolver.
-
@ahole4sure Why can't ISP's just leave things alone... I'm assuming, since you run the modem(s) in passthrough mode, that it's not in the device that is being blocked, or is it?
I'm thinking you need to log in to their portal (your accounts) to disable that "helper feature"... -
So am trying to leave things in situ as they have been setting and working (ie the ATT modems)
They are supposoed to be accesible from my LAN (and they were right after I re setup my pfsense) - via 192.168.2.1 and 192.168.3.1 (set in the device as the configuration addresses)
Through VIPsFor some reason I can't access either of those VIPs any longer --
I was trying to see if I could change the DNS settings we were discussing.
I can ping both 192.168.2.1 and 192.168.3.1 but can't access via web browser
-
Do you have outbound NAT rules in place for those?
-
Just auto
But looks like it’s there ????
-
Well it looks like you have conflict with the 192.168.2.10 VIP. You have that subnet on an internal interface too it appears since it's included in the auto rules.
You should also have manual rules to translate to the VIPs for traffic from LAN to the modem.
-
I think it is where I set up a static route trying to do what @Gblenn had suggested back in this thread previously
So the static route must have done the auto rule
Just so I don’t screw it up, after I have now deleted the static route, how should I set up the the outbound rule?
-
@stephenw10
So I got rid of the static route and then created the NAT rule ( ?? correct )Still get the error trying to reach 192.168.2.1
-
-
Will out seems that maybe disabling IPv6 might have fixed the problem with the frontier modem coming back online
After disabling. Came back online in secondsThere had been a support request sent to ATT about their DNS
After fixing NAT and being able to access the ATT modems config site - even after manually setting the DNS servers ( to non ATT servers) on fail over or attempt to utilize the ATT modem for internet access it just didn’t work unless DNS Forward Mode is checked in DNS Resolver
-
Nice. Yes those outbound NAT rules look correct now and no conflict is shown.
I would still try to capture the DNS traffic with the resolver enabled just to check it's actually trying to use the AT&T connection. A pcap filtered for port 53 would show that.
-
@ahole4sure Ok great that it works as intended when IPv6 is disabled. I have now idea why this is an issue other than I'm guessing something is not initializing as it should on IPv6 so it gets stuck. Perhaps @stephenw10 has some idea as to why this is and how to make it work fully, also with IPv6.
And on the DNS issue, I hope ATT comes back with a resolution that allows you to chose resolver mode as well.
-
Thank you guys for your continued help and putting up with me.
@Gblenn - I know it is semantics , but I have Resolver enabled but just have to check to "use Forwarding Moding" on that resolver settings page --- not sure what the difference is ??Also one other issue -- in my prior pfsense setup I was able to connect to 192.168.2.1 and 192.168.3.1 when connected remotely via my Wireguard VPN -- but now I cannot. Any addnl NAT settings for that to work? I have a Wireguard any rule in place and I have 192.168.2.0/24 and 192.168.3.0/24 as allowed IP's in my settings for my WG client
-
@ahole4sure said in ATT Internet AIr:
I know it is semantics , but I have Resolver enabled but just have to check to "use Forwarding Moding" on that resolver settings page --- not sure what the difference is ??
In that mode, you are using unbound instead of dnsmasq but you target the same DNS servers you specified in the System / General. These are different from the Root or Authoritative servers used in resolver mode.
So it's not that ATT are trying to force you to use their own DNS servers, only not use the top level one's (root and authoritative)...
About your issue not being able to access those subnets over VPN... I guess you need to add your VPN to the Source of those rules for it to work. Now you only have LAN subnets?? Or rather create a copy of the rule where you specify the WG subnet...
-
The AT&T router could be passing DNS servers via DHCP and if pfSense is set to use those it will work in forwarding mode if they are blocking all others.
Look in the router config for anything named 'DNS helper' or similar.
