New PF Sense Setup with Netgear R8000 with Tomato

giuliafw70

One simple split is: first check whether a wireless client is getting a normal IP/gateway from Tomato. On the phone/laptop, look at the Wi-Fi details and compare the IP/subnet/gateway with a wired client on the Tomato side. If it has an address but only DNS fails, try temporarily disabling Stubby/custom DNS on Tomato and point clients at pfSense or a known resolver just to isolate it. If it gets no lease or a strange subnet, then Tomato is probably not acting as the AP/bridge you expect behind pfSense.

Builder

@stephenw10 - Hello I have not forgot about you on this - been working alot and not been able to get back to it. Was hoping today - simply ran out of time and it may be another week before I can get back it as weekends are only time I can hopefully get time on this. I am simply connecting my router that I had been already using prior to getting this firewall

Builder

@giuliafw70 - Update - I turned off the stubby and the cloudfare and quad net in the router and kept the use internal dns on. Rebooted the router and then did a dns leak test and confirmed that it then was using the ISP dns. I was still able to connect wirelessly - but that was all - no internet though - so that tells me there is or are other settings that need to be modified in the router with tomato and I do not even know what those would be as I am very green with this. What I can say is that the factory defaults that Tomato uses is what is used in the router. You will see which version of Tomato I am using from the photos I attached at the very beginning of this post. Thank you

Builder

@stephenw10 Update - I turned off the stubby and the cloudfare and quad net in the router and kept the use internal dns on. Rebooted the router and then did a dns leak test and confirmed that it then was using the ISP dns. I was still able to connect wirelessly - but that was all - no internet though - so that tells me there is or are other settings that need to be modified in the router with tomato and I do not even know what those would be as I am very green with this. What I can say is that the factory defaults that Tomato uses is what is used in the router. You will see which version of Tomato I am using from the photos I attached at the very beginning of this post. Thank you

16 out of 16
Copyright 2026 Rubicon Communications LLC (Netgate). All rights reserved.

stephenw10

@Builder said in New PF Sense Setup with Netgear R8000 with Tomato:

I was still able to connect wirelessly - but that was all - no internet though

Ok you need to narrow this down a bit to find out where the problem is.

So when you connect to the wifi does that client get an IP address in the expected subnet?

If so can that client ping local IP addresses? The Tomato router IP address for example? The pfSense internal interface IP address?

Can it ping something external directly like 8.8.8.8?

Can it ping pfsense.org?

If you can find which step there is failing that will indicate where the problem is.

Builder

@stephenw10 ok and so how do I do these steps please so I can let you the answers to your questions? Thank you

stephenw10

What is the wireless client you're testing with? A laptop I assume? Windows?

If so open a command prompt and run ipconfig to see what IP address it has.

Builder

@stephenw10 - I am using a linux laptop running Zorin 17.3 and also have windows virtual installed for those odd windows programs that need windows.

In the meantime does this make sense to you as well - the router needs to be put into an access point mode. otherwise it is trying to hand out an IP from it's own DHCP server?

If so how do I do this?

stephenw10

Yes if it's running in full router mode it's probably going to pass out it's own IP addresses.

When you connect the laptop either check the network manager or run ip addr so see what address and subnet it's receiving when it connects.

If it's in the expected subnet try the pings tests.

Builder

@stephenw10 - Morning yes ok and how do I do all these tests you are talking about?

stephenw10

Like how do you ping? Open a terminal window in Linux and ping something like:

steve@steve-NUC9i9QNX:~$ ping -c3 172.21.16.1
PING 172.21.16.1 (172.21.16.1) 56(84) bytes of data.
64 bytes from 172.21.16.1: icmp_seq=1 ttl=64 time=0.312 ms
64 bytes from 172.21.16.1: icmp_seq=2 ttl=64 time=0.327 ms
64 bytes from 172.21.16.1: icmp_seq=3 ttl=64 time=0.334 ms

--- 172.21.16.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2085ms
rtt min/avg/max/mdev = 0.312/0.324/0.334/0.009 ms

So in my case 172.21.16.1 is the LAN interface of my pfSense router. It responds to the pings and round trip time is very low because it's very close.
You should use the IP address of your own pfSense box.
if that works try to ping something external by IP address like:

steve@steve-NUC9i9QNX:~$ ping -c3 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=115 time=26.4 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=115 time=6.89 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=115 time=6.90 ms

--- 8.8.8.8 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 6.893/13.405/26.422/9.203 ms

If that works try by fqdn like:

steve@steve-NUC9i9QNX:~$ ping -c3 pfsense.org
PING pfsense.org (208.123.73.78) 56(84) bytes of data.
64 bytes from acb.netgate.com (208.123.73.78): icmp_seq=1 ttl=45 time=126 ms
64 bytes from acb.netgate.com (208.123.73.78): icmp_seq=2 ttl=45 time=126 ms
64 bytes from acb.netgate.com (208.123.73.78): icmp_seq=3 ttl=45 time=126 ms

--- pfsense.org ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 125.902/126.205/126.497/0.243 ms

One of those steps will fail and which one does will tell you what's broken in your setup.

If I was doing this I would first setup pfSense and the tomato router with a very basic config and made sure that's working. I've never read that book you're referenncing but it sounds like it details a fairly complex setup that could be difficult to troubleshoot.

Builder

@stephenw10 Hello Stephen, thank you for your help and with 2 tweaks - it is now working great - everything is pinging and I can access internet - etc. Thanks again

johnpoz

@Builder said in New PF Sense Setup with Netgear R8000 with Tomato:

help and with 2 tweaks

What tweaks? What was the problem exactly?

Builder

@johnpoz - and connect via different port on router and all set working

johnpoz

@Builder So your wan was disabled? How is enabling your connection a "tweak" Glad your working.