WAN connected after default install, but no access from LAN



  • I'm a bit of a networking newbie considering that I come from a development background. But since I work for a non-profit organization that can't afford the best, I usually play many roles.  Little surprise I have been at this for a whole day before I posted this.

    That said, PFsense's (1.2.2) installation was pretty straight forward.  I installed everything with the defaults, only changing the LAN IP to 192.168.1.99. We use PPPoE and we have a static IP address assigned to us. At the moment, because we're moving offices I have some slack time to get things up and running, but soon we'll be hosting our own email and websites so the firewall part is important.

    My question is, shouldn't the default installation allow me to access the big bad internet from the LAN?

    We have a Windows Domain, with Win2k3 acting as the [domain] DNS and the DHCP.  Try as I might, I cannot connect to the internet from any client (we have windows and linux clients). I do connect to my ISP and I do get assigned the correct Static IP address, and I tried Diagnostics > Ping and I can ping google but for the life of me, I cannot connect to the internet.

    Does anyone have a clue as to how to start resolving this?

    I don't know what other information needs to be posted to help, so forgive me.

    TIA



  • The default gateway for your clients is the pfSense LAN interface?



  • Certainly, and I just double checked. To be completely honest, it is on the computers I'm trying to connect from, the rest take whatever the DHCP feeds them, but that's another issue.



  • Can you clarify "can't connect to the internet"?

    On the clients with correct gateway specified what happens if you try to ping www.google.com?
    What happens if you try to ping 208.67.219.230?
    What happens if you traceroute 208.67.219.230?

    You haven't provided enough information to tell if the problem is in hostname to IP address translation, routing or something else.



  • I want to double check something since nothing is working the way _it should.

    (Static IP)
    (Big Bad WWW) –------- [Modem]–---[PFSense] (Lan IP 192.168.1.1)
                                                             |
                                                             |
                                                             |
                                                       [   Switch                                          ]
                                                          |                       |                      |
                                                         [DNS]          [Win Client]           [Linux Client]

    I placed one of each OS/Client though there are more.  DNS Box is W2K3 and is both DNS and DHCP, assigning dynamic IP addresses in range from 192.168.1.150-200.  The Router is set to be the Lan IP of the Pfsense box (is this right?) Some clients connect through wifi but this is a moot point since they're part of the same LAN and get assigned IPs in the range.

    A few questions. Should I activate DNS forwarding? Should I allow the WAN DNS to override? Should I let Pfsense handle the DHCP? Isn't the network gateway pfsense's LAN IP address? Why the heck is pfsense the only thing capable of seeing the WWW?

    TIA_



  • @wallabybob:

    Can you clarify "can't connect to the internet"?

    Pfsense connects to the www through WAN perfectly fine. However, anything on the LAN side of the FW cannot browse the WWW or indeed perform any function that would require a packet to leave the confines of the subnet.

    @wallabybob:

    On the clients with correct gateway specified what happens if you try to ping www.google.com?

    :~$ ping google.com
    ping: unknown host google.com

    Confirmed:
    steve@steve-laptop:~$ ping -c 4 google.com
    ping: unknown host google.com

    @wallabybob:

    What happens if you try to ping 208.67.219.230?

    Will double check but should be the same thing. I've tried pinging a zillion different sites and the same with browsing. The result is always the same.

    Result:

    steve@steve-laptop:~$ ping -c 4 208.67.219.230
    PING 208.67.219.230 (208.67.219.230) 56(84) bytes of data.
    64 bytes from 208.67.219.230: icmp_seq=1 ttl=52 time=258 ms
    64 bytes from 208.67.219.230: icmp_seq=2 ttl=52 time=257 ms
    64 bytes from 208.67.219.230: icmp_seq=3 ttl=52 time=258 ms
    64 bytes from 208.67.219.230: icmp_seq=4 ttl=52 time=256 ms

    –- 208.67.219.230 ping statistics ---
    4 packets transmitted, 4 received, 0% packet loss, time 3004ms
    rtt min/avg/max/mdev = 256.409/257.730/258.679/1.020 ms

    @wallabybob:

    What happens if you traceroute 208.67.219.230?

    Haven't tried a traceroute. I'll test it (I have one connection so after posting this I'll try it and reconnect and edit this post).

    Result:

    steve@steve-laptop:~$ traceroute 208.67.219.230
    traceroute to 208.67.219.230 (208.67.219.230), 30 hops max, 60 byte packets
    1  * * *
    2  * * *
    3  * * *
    4  * * *
    5  * * *
    6  * * *
    7  * * *
    8  * * *
    9  * * *
    10  * * *
    11  * * *
    12  * * *
    13  * * *
    14  * * *
    15  * * *
    16  * * *
    17  * * *
    18  * * *
    19  * * *
    20  * * *
    21  * * *
    22  * * *
    23  * * *
    24  * * *
    25  * * *
    26  * * *
    27  * * *
    28  * * *
    29  * * *
    30  * * *

    @wallabybob:

    You haven't provided enough information to tell if the problem is in hostname to IP address translation, routing or something else.

    Sorry! I appreciate the help and I apologize for my inability. I did try to explain it further with the post that has the drawing.  If there is something more specific you would like to know, then tell me please. I'm not a system admin so I might not know what is needed.



  • If pfsense can access foreign hosts by name, but internal hosts can't (but can by IP), they are not getting DNS.  What are you setting for DNS for the LAN hosts?



  • I figured as much after try wallabybob's small tests, I just didn't touch it for fear of messing it up.

    At the moment, DNS is empty with the "Allow DNS server list to be overridden by DHCP/PPP on WAN" checked.  I previously had the local DNS server's address  (which is also the DHCP and the PDC).

    What do you suggest?



  • No, that wasn't my point.  It doesn't matter what pfsense has set for DNS if the LAN hosts are set wrong.  What is your DHCP server giving hosts for DNS?



  • The local DNS/PDC address which is part of the same subnet.  Worked fine with ISA, why not with pfsense?



  • And where is IT getting its DNS from?



  • It only has the domain DNS zone (forward lookup only).  I am pretty sure it does not update or reflect or retrieve anything from the internet.



  • I am confused then.  If it is not pointed at outside name servers, how would you ever expect name resolution to work?  Some host inside your LAN needs to be querying outside DNS!  Did that use to be the ISA?  If so, set the pfsense to allow WAN DNS and have it serve up the DNS to hosts.



  • Your client appears to be attempting to use an invalid name server, OR the name server itself can no longer get the information it requires.

    You could use the Linux nslookup utility to see what name server is being invoked by your Linux client.

    On the name server itself, can it resolve www.google.com?

    Earlier you said you checked the clients had the correct DNS address. How did you check? How did you decide it was correct? (If I understand you correctly, you want the clients to use pfSense as the gateway and the WIN2K3 box as the DNS.)

    @Steve:

    It only has the domain DNS zone (forward lookup only).  I am pretty sure it does not update or reflect or retrieve anything from the internet.

    So how will this name server resolve something like www.google.com if it doesn't get it from the internet?



  • We now come to the crux of my lack of knowledge.

    danswartz:
    I thought the name resolution for external name servers was automatic. Very naive of me now that I think about it.  I think it was ISA. The reason I don't know this stuff because about 3 weeks ago, the guy that was here before me passed away in a car accident and he hadn't left much that could explain what is doing what.  Just to be completely sure, you mean System > General Setup > Allow DNS server list to be overwritten, correct?

    wallabybob:
    nslookup gives me the google name servers 74.125.0.0/16 , the local DNS cannot resolve names.

    When I said I checked the DNS, I checked for the local one and I did that by an nslookup, trying to resolve the names of local servers.

    @wallabybob:

    Earlier you said you checked the clients had the correct DNS address. How did you check? How did you decide it was correct? (If I understand you correctly, you want the clients to use pfSense as the gateway and the WIN2K3 box as the DNS.)

    Precisely.

    @wallabybob:

    So how will this name server resolve something like www.google.com if it doesn't get it from the internet?

    I hadn't thought of that. I'm not a sys admin by trade, I'm a developer, but I'm loving the lessons I'm getting here.  Out of curiosity, where would I be able to find out more about how to get the local DNS server to do just that?



  • Someone else will have to help with the Windows setup because I don't have that sort of experience.

    I'd setup pfSense to act as the DNS server and DHCP server but I'm not aware of the implications of that for your particular requirements.

    pfSense has a single configuration file (including DNS and DHCP configuration) that is easily backed up so its pretty easy to get a pfSense system running again after (say) a hard drive problem and it can probably be done a lot more quickly than restoration of a Windows server. This could be an important consideration if (say) your Windows server has some sort of problem preventing it booting and you want to surf the internet for clues about suitable recovery action. If you are relying on the Windows server for DHCP and DNS you'll need some special inspiration to surf the net looking for a solution.



  • DHCP being moved to something else is perfectly alright _, but regarding Windows DNS I don't have the slightest clue. Looks like I'm going to have to phone up someone.

    Thanks a million though._



  • After reading and looking at the network diagram I would recommend letting your pfSense box do the dns and dhcp. If the Win2k3 ain't doing anything but dns and dhcp it's wast of power imo.

    As you are non profit it could be a solution for you.
    Free email
    Free website

    Just my 2 cent.



  • Is it possible to let pfsense handle the dns? Even if the dns box is also providing AD and PDC? Where would I find information on how to do that?

    Many thanks for the links dude :)



  • Then it's correct to use win2k3 for DNS when AD is in play.

    Is the DNS server ip's correct in Windows Server DNS Forwarders?



  • without knowing about the server, it is hard to say.



  • http://www.petri.co.il/install_and_configure_windows_2003_dns_server.htm

    The "Enable DNS Forwarding for Internet connections" part



  • Ugh, my experience with windows is pretty much zero (certainly for something like this.)  Sorry…



  • The server is currently running with ISA as a firewall.  Its forwarding fine and its working fine. It is my intention to swap ISA with pfsense for the simple reasons that ISA's demo license will expire soon and it has proven to be a very complicated tool that is liable to bring the whole network to a halt.  When I connect through pfsense, dns forwarding is not working, but connecting through ISA, everything works like a charm. I know I'm doing something wrong, I'm just not sure what it is; its regarding dns forwarding, but that's the extent of what I know is wrong.



  • okay that is clearer now.  i had gotten the impression you needed pfsense AND the ISA box.  it really is not a good idea to try to have both at the same time.  if all the ISA is doing is dhcp and dns for LAN hosts, i would wait until off-hours, shut it down, and replace it with the pfsense.  put the pfsense in with WAN and LAN interfaces set appropriately, enable the DHCP as you need it to be set, enable DNS forwarder, and check the "allow override" box.  i know this sounds like a lot, but it really is not feasible to give you a 'become an IT guy in 5 minutes" lesson :(



  • OK, I got it working after much deliberation with friends,  google and trial and error.

    ISA was the problem.  Brought it down, let pfsense handle DHCP, altered the values for the DNS on W2K3 and updated the gateway IPs on the clients.

    Is beautiful when things are going like clock work! :D

    Thanks to every one!



  • cool!


Log in to reply