WAN access problem/s

Agnemon

Topology:

Starlink V4?
Pfsense 2.9 on bare metal.
Local LAN

New install.
I can access any device on the local side.
I can check for upgrades from the pfsense home page.

I can not access the internet through the firewall (works fine if I bypass it)

I am assuming it is a rule problem on the WAN.

I initially setup one rule to allow everything as a test.

"Pass
WAN
IPv4
TCP/UDP
From Any (no invert)
To Any (no invert). Port any to any."

I then added separate rules to allow ports 80, 443, 53,123 and ICMP (any).

Internal IP address's are:

Gateway 192.168.1.1
Firewall 192.168.1.2
WAN 192.168.1.144

All interfaces are running with no errors indicated
Traffic graphs are showing traffic on both WAN and LAN.

So what am I doing wrong? In noob terms (obviously I need it at this level)

johnpoz

@Agnemon said in WAN access problem/s:

I am assuming it is a rule problem on the WAN.

Why would you think that? Wan rules are for allow unsolicited inbound traffic from the the internet to pfsense or through pfsense via port forwards. There are zero rules needed on the wan to allow internet to work from clients behind pfsense.

So starlink using cgnat right? What IP are you getting on your wan interface - pfsense shows gateway up right? A device on your lan would use pfsense lan IP as its gateway, pfsense would then nat this traffic to its wan IP.

edit:
WAN 192.168.1.144, so your using the same network on your pfsense lan as its wan.. Yeah that not going to work.. Use a different on your pfsense lan, say 192.168.2.0/24

this doesn't read right

Gateway 192.168.1.1
Firewall 192.168.1.2
WAN 192.168.1.144

firewall 192.168.1.2 - is your pfsense lan IP??

If you have a 192.168.1 network on pfsense wan, then its lan has to be something that does not overlap with that 192.168.2 for example

SteveITS

@Agnemon Also the CGNAT would fortunately be protecting you because opening WAN would normally allow the Internet to connect to pfSense via SSH, HTTPS, etc.

Agnemon

@johnpoz
Tomorrow I will reinstall from scratch with the following IP address's

Starlink 192.168.1.1
Gateway 192.168.1.1
WAN 192.168.2.1
LAN 192.168.1.2

Is that going to work or do I have to have LAN, WAN and Starlink on 3 separate subnets?

The end goal is to have the Starlink in bypass (bridge) mode but I wanted to get everything working first.

Gertjan

@Agnemon said in WAN access problem/s:

Tomorrow I will reinstall from scratch with the following IP address's

Starlink 192.168.1.1
Gateway 192.168.1.1
WAN 192.168.2.1
LAN 192.168.1.2

I'm to late ?
If not, stop !

Reinstall is ok, but I propose the following :
Change 1 thing : your pfSense password. That's it.
Do not change/touch/etc firewall rules.
Do not edit/add/remove/touch/etc DNS related stuff.

Get your pfSense, don't hook up WAN ( !! ), just a switch on the pfSense LAN, and on that switch you hook up your PC.
Did I say : don't hook up WAN ?

Now, access the pfSense GUI, visit the LAN interface settings, and change the default 192.168.1.1 / 24 settings - these :

to

Do a Save and an Apply.

Now, disconnect your device's network cable for a moment.

If all goes well, the LAN IPv4 DHCP server also changed from 192.168.1.0/24 to 192.168.2.0/24 and the correct pool.
If issues, assign your device with a static IPv4 setup like 192.168.2.10, gateway 192.168.2.1 and dns 192.168.2.1, ,ow you can access the GUI again, and redo your LAN IPv4 DHCP server settings.

And done.

If the startlink router uses 192.168.1.1/24 on it's LAN, then pfSense can't use 192.168.1.1/24 on its LAN, that why you have to change one of them.
You could also change the starlink LAN settings to 192.168.2.1 first, and in that case you have nothing to do with pfSense except changing the password (no joke). You could treat it like a low bud DLINK router that you buy and just power up, and it works.
pfSense is just another router firewall (with a zillion options that don't need your attention right away).

edit :

When you re install pfSense, you can set the pfSense LAN settings directly to 192.168.2.1/24 and pick a correct DHCP pool for the LAN, like 192.168.2.2 to 192.168.2.200 (example) and it that case it works right away.

You will probably never have to add rules on the WAN interface, for reasons mentioned above.

Agnemon

@Gertjan
How dare you interrupt me when I am making a mistake

So there needs to be separate subnets for the Starling Router, the PfSense firewall and the LAN. Three in total?

I will probably re install if for no other reason than to clean out all the garbage I have tried and failed at. There is no real setup to worry about, no rules etc.

While you can change the Starlink IP that only works if you are not in Bypass mode. Then again the only reason to switch to bypass mode is to avoid double NATing.

The only issue I have with this is that I now need to redo the static IP address's on about a dozen devices.

Thanks in advance.

Gertjan

@Agnemon said in WAN access problem/s:

So there needs to be separate subnets for the Starling Router, the PfSense firewall and the LAN. Three in total?

The startlink, or any other ISP router, has a 'LAN'.
You connect the pfSense WAN interface to this ISP (you : starlink).

If the ISP router uses "192.168.1.1/24" as its LAN settings, the pfSense can't have a "192.168.1.1/24" as its LAN.
Or, most firewall routers use "192.168.1.1/24" as their default LAN setting.

So you have to change one of them.
Btw : I changed my ISP router LAN interface from "192.168.1.1/24" to 192.168.10.1 as it has only one device hooked up to it : my pfSense. My pfSense WAN now uses 192.168.10.4/24, obtained by a DHCP lease from the ISP router.
DHCP (client) usage on pfSense is the default setting.

The upstream ISP router WAN interface : normally, you don't care about that one, as it can't be a RFC1918 (like ""192.168.1.1/24""), but fact check it anyway.

johnpoz

@Agnemon said in WAN access problem/s:

So there needs to be separate subnets for the Starling Router, the PfSense firewall and the LAN. Three in total?

Where would you come up with 3?

internet - wan starlink lan -- 192.168.1.0/24 wan pfsense lan - 192.168.2.0/24 - clients

Pretty sure starlink uses cgnat, so on starlinks wan this would be some 100.64-127.x.x network.. If you bridge it pfsense wan would just get some 100.64-127.x.x address. In that scenario bridging it doesn't really get you much. Normally you would bridge a isp device so your pfsense wan gets an actual public IP. But since starlink using cgnat, ok your getting rid of 1 nat, but you still have 2 vs 3.

But having the same network on both the wan and lan of pfsense makes it hard for pfsense to route traffic.

If your going to want to run your starlink device in bridge mode. Doesn't really get you much other than not stepping on your default pfsense lan of 192.168.1 to be honest. But sure do that from the get go. There shouldn't be any reason to reinstall pfsense, just change its lan IP to something that doesn't step on what its wan network is. If your pfsense wan your getting from your starlink device is 192.168.1, then change pfsense lan to 192.168.2 for example.

Ankalaev

You don't need 3 separate subnets. Just make sure pfSense WAN and LAN are on different networks.

For example:

Starlink: 192.168.1.1
pfSense WAN: 192.168.1.144
pfSense LAN: 192.168.2.1

Your LAN devices can then use 192.168.2.x.

The main issue was having 192.168.1.x on both the WAN and LAN sides of pfSense.

Gertjan

@Ankalaev said in WAN access problem/s:

You don't need 3 separate subnets. ...

Starlink: 192.168.1.1

You missed one : As the 'Starlink' (Dishy ?) is a router, the "192.168.1.1" is the startlink LAN network (interface), and it has another network on it's WAN side.
I guess that's the third one @Agnemon was talking about.

Agnemon

Issue has, finally, been resolved.

I shifted my whole network (12 devices) over to x.x.2.x

In the process I managed to fat finger my way into a lock out on my managed switch.
Oh, that's any easy fix. Just log in through the console right? yeah nah.
Dell switch's do not seem to like USB to serial converters. Everything was displaying correctly but every keystroke was garbage.
And to add insult to injury the only way to reset a Dell switch is via the console.

So last night I finally got the switch reconfigured. This morning still no internet access so I reinstalled pfsense and straight up I have internet access. So it seems I managed to fat finger myself multiple times.
As penance I have given myself the middle fat finger.

Gertjan

@Agnemon

You just summed op the perfect reason to keep all your LAN settings, so no need to change anything on the pfSense LAN side, but change something 'the other side' of pfSense : the upstream router, most often a ISP router. Change it's LAN from 192.168.1.1/24 to 192.168.x1./24.
pfSense uses DHCP on it's WAN, so nothing to be done there.
So, one click in the ISP router GUI, and then a pfSense WAN reconnect, and done.

That said, not keeping 192.168.1.1/24 as a LAN, but using some other random RFC1918 network is considered a good thing. The reason can show itself when you start with VPN stuff.

@Agnemon said in WAN access problem/s:

every keystroke was garbage

Serial speed, stop bits or something like that are set wrong on the receiver side. The good settings are in the Dell's doc.
A console access is the most important interface on any device, and this is also valid for pfSense. RJ45 networking plugs are only useful when 'all is fine'

stephenw10

@Agnemon said in WAN access problem/s:

As penance I have given myself the middle fat finger.

Agnemon

@Gertjan Was not a settings error on the console side which was my initial thought. Changed to a 9 pin to 9 pin serial cable and it worked fine on default console settings.
It maybe a driver fault for the usb to serial chip. I did try three different usb->serial cables and all had the same problem. Anything sent from the console was fine everything sent to the console was scrambled. Generally a settings error affects both sides of the link not just one.