Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    ATT Internet AIr

    Scheduled Pinned Locked Moved
    General pfSense Questions
    5
    133
    3.9k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      ahole4sure @stephenw10
      last edited by

      @stephenw10
      Ok I can change back to 192.168.2.0

      but we were running into the same issue there as well??

      Also - question -- when I create the interface connection and set up as a DHCP connection for the created WAN it seems to create some "dummy" gateway (that is greyed out and not available for use in the gateway group area). Do I just create an additional gateway ? Or how to handle that?

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        Change it back. Any tests with the subnets conflicting will definitely fail an just confuse matters.

        We want to see DNS states on the WAN, without being NAT'd, and check if there are any reply packets.

        Is your outbound NAT still set to automatic?

        A 3 Replies Last reply Reply Quote 0
        • A
          ahole4sure @stephenw10
          last edited by ahole4sure

          @stephenw10
          yes automatic re outbound nat

          1 Reply Last reply Reply Quote 0
          • A
            ahole4sure @stephenw10
            last edited by

            @stephenw10

            Here are some pics of where I changed back to 192.168.2.0/24

            And the 53 filtered state

            Image 10-25-24 at 5.26 PM.jpeg Image 10-25-24 at 5.32 PM.jpeg Image 10-25-24 at 5.33 PM.jpeg Image 10-25-24 at 5.33 PM.jpeg Image 10-25-24 at 5.24 PM.jpeg

            1 Reply Last reply Reply Quote 0
            • A
              ahole4sure @stephenw10
              last edited by

              @stephenw10
              Sorry for being a pain in the butt -- but the really bad issue is that I can't seem to find a work around to get things working after the "fail" without literally rebooting the pfsense box!! Makess testing so hard

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                Ok, two odd things there.

                You fail to get any ping replies from 8.8.8.8 when pinging from WAN. That should work.

                There is DNS traffic from WAN directly but the states show it's still being outbound NAT'd from it's own address which should never happen.

                On the outbound NAT page what rules are shown for the auto generated rules?

                A 1 Reply Last reply Reply Quote 0
                • A
                  ahole4sure @stephenw10
                  last edited by

                  @stephenw10 IMG_0055.png

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    Hmm, that looks OK.

                    You have NAT states showing 192.168.2.2 being NAT'd to itself just on a different port. That normally wouldn't hurt DNS but it also shouldn't happen so it's unclear exactly what it's doing.

                    What happens if you reboot with WAN2 disconnected?

                    A 1 Reply Last reply Reply Quote 0
                    • A
                      ahole4sure @stephenw10
                      last edited by

                      @stephenw10 So attached are shots where rebooted with WAN2 disconnected

                      Still no DNSImage 10-25-24 at 7.52 PM.jpeg Image 10-25-24 at 7.53 PM.jpeg Image 10-25-24 at 7.53 PM (1).jpeg Image 10-25-24 at 7.54 PM.jpeg Image 10-25-24 at 7.54 PM.jpeg

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        Ok. So there is no DNS traffic on WAN there.

                        There are clients that are configured to use 8.8.8.8 directly, 192.168.1.79 there, but it appears 8.8.8.8 is statically routed via WAN2 so it's failing.

                        Check the routing table in Diag > Routes.

                        That would usually be either the gateway monitoring or in the general setup if 8.8.8.8 is configured as a DNS server.
                        In your previous screen shots you have 8.8.8.8 used on WAN for both those but it looks like something has changed because it's being forced via WAN2.

                        Is 192.168.1.79 a client you're testing from?

                        A 4 Replies Last reply Reply Quote 0
                        • A
                          ahole4sure @stephenw10
                          last edited by

                          @stephenw10
                          So I am attaching the Diag > Routing table

                          I am attaching my current setup for my interfaces / gateways
                          And my current setting in the General Setup DNS page

                          Lastly I am attaching what I thought / hoped might work form a Protectli support page for setting up LTE modem on thier devices (in the Advanced Settings of the LAN Rules - forcing it to use the Failover GW

                          But this AM tested and it still failed -- AND had to completely reboot to get internet back up and going once the main WAN2 was plugged back in!
                          Image 10-26-24 at 12.14 PM.jpeg Image 10-26-24 at 12.14 PM (1).jpeg Image 10-26-24 at 12.15 PM.jpeg Image 10-26-24 at 12.15 PM (1).jpeg

                          1 Reply Last reply Reply Quote 0
                          • A
                            ahole4sure @stephenw10
                            last edited by

                            @stephenw10
                            Image 10-26-24 at 12.13 PM (1).jpeg Image 10-26-24 at 12.13 PM.jpeg Screenshot 2024-10-26 at 12.11.31 PM.png

                            1 Reply Last reply Reply Quote 0
                            • A
                              ahole4sure @stephenw10
                              last edited by

                              @stephenw10
                              Image 10-26-24 at 12.11 PM.jpeg Image 10-26-24 at 12.10 PM.jpeg Image 10-26-24 at 12.09 PM.jpeg

                              1 Reply Last reply Reply Quote 0
                              • A
                                ahole4sure @stephenw10
                                last edited by

                                @stephenw10

                                also btw, I am not sure what .179 is
                                it is not the device I'm testing form - but the network is large with probably more than 50 or 60 devices connected

                                The routing table does not gicve the device a name (like many have) - it just gives a MAC address

                                1 Reply Last reply Reply Quote 0
                                • stephenw10S
                                  stephenw10 Netgate Administrator
                                  last edited by

                                  Ok you have some conflicting settings there. You have DNS servers set with specific gateways and you also have the same DNS servers set as monitoring IPs for the gateways. Both those thing add static routes and must match to work correctly.

                                  In your setup you don't need to set gateways on the configured DNS servers because they should work on either WAN and you're using a failover group as the default gateway. Additionally your are resolving directly so the DNS servers configured there are only used as a backup. However the conflicting static routes still breaks DNS for anything trying to use those servers directly. So remove the gateway settings from the DNS servers on the general setup page.

                                  If you add a failover group to the pass rules on LAN you bypass rules for local traffic. That includes DNS traffic from LAN side clients to the LAN interface. Otherwise it will be forced out of the WAN and never reach Unbound in pfSense.

                                  A 3 Replies Last reply Reply Quote 0
                                  • A
                                    ahole4sure @stephenw10
                                    last edited by

                                    @stephenw10

                                    Ok. Thank you for advice
                                    I’ll change the DNS settings

                                    So do I leave the advanced LAN rule like Protectli recommended or change back to not using. I’m sorry I wasnt clear …

                                    1 Reply Last reply Reply Quote 0
                                    • A
                                      ahole4sure @stephenw10
                                      last edited by

                                      This post is deleted!
                                      1 Reply Last reply Reply Quote 0
                                      • A
                                        ahole4sure @stephenw10
                                        last edited by

                                        @stephenw10
                                        Here is the new routing table after removing the DNS static routesIMG_0061.jpeg IMG_0062.jpeg

                                        1 Reply Last reply Reply Quote 0
                                        • stephenw10S
                                          stephenw10 Netgate Administrator
                                          last edited by

                                          Hmm, well I still expect to see the gateway monitoring IPs there, did you remove those too?

                                          Anyway that device at 192.168.1.79 should work fine trying to access 8.8.8.8 directly.

                                          I'm assuming (because it's the default) that your LAN side clients are being passed the LAN interface address to use for DNS?

                                          A 2 Replies Last reply Reply Quote 0
                                          • A
                                            ahole4sure @stephenw10
                                            last edited by

                                            @stephenw10
                                            I didn't change the monitor IP's on the gateways
                                            ??
                                            Is this what you were referring to?
                                            Image 10-27-24 at 7.28 PM.jpeg Image 10-27-24 at 7.29 PM.jpeg

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post