Stuggling with PfSense configuration ESXi

  • Stuggling with PfSense configuration.

    Sky Hub (does wifi, dhcp, firewall-prob NAT etc)  => LAN either via wiffi or cable to sky hub.

    I'm building a vmware esxi home lab and bought a managed switch and a 2 boxes for vmware to run VM's on

    the box that will have pfsense installed has to physical NICs, the other has box for vm's has one nic.
    the box with 2 nic has one nic connected to sky box (and would be WAN connection ) and the other to the switch (LAN connection).
    I want vmware servers and all the other servers or pc's connected to the switch use pfsense as a firewall/gateway/dhcp/dns server. So that sky hub would be an upstream server.
    Sky hubs is itself is a dhcp server and gives out ip's from address range (sky box local ip
    I reserved an ip for pfsense on the box which gets assigned properly
    pfsense's lan will be and pfsenses ip will be wan configuration will have sky hub as a dns server
    i followed pfsense instructions for vmware to set up pfsense
    so my test laptop (windows 8.1) thats connected to the switch gets an ip from pfsense, but when i try to browse the internet ( etc) i get nothing. also when i try to tracert or ping it gets nothing.

    Any ideas what to check or configure? What have i missed?

  • LAYER 8 Global Moderator

    Did you happen to set a gateway on pfsense lan interface this interface?  This seems to be a common issue.

    Did you edit the rules on the lan, by default they would be any any.  If your wan is on private rfc1918 space, ie your then you most likely want to disable the block private network on the wan interface which a default rule.

  • I am pretty sure I did remove the RFC and bogon. I think I did assign a gateway on LAN interface, but I will double check when I get home.

  • LAYER 8 Global Moderator

    You do not want a gateway on LAN interfaces - where would you point it in the first place?  If you put a gateway on the lan, pfsense thinks its a wan connection.  If you need to route networks in your lan, then you need to create specific routes to those and not put a gateway on the actual interface.

  • Right. I don't have Gateway on my LAN and i have disabled RFC 1918. I can see that it win8 client is opening like google or bing but if i try to open wikipedia for example nothing happens and I get webpage not found.

  • LAYER 8 Global Moderator

    so you can ping out to the internet?  So you can ping for example?  This is a level 3 public dns that I know answers ping


    Pinging with 32 bytes of data:       
    Reply from bytes=32 time=32ms TTL=52
    Reply from bytes=32 time=33ms TTL=52

    Sounds more like a dns issue related problem then if your having issues accessing specific sites.

  • Yes i can ping this fine, but i can't browse for example pfsense forum

  • nslookup?

  • LAYER 8 Global Moderator

    Well you have connectivity then its name resolution - what are you using for DNS?

    If you can resolve - but not as example and opens just fine then its a dns related problem not connectivity.

  • yea yahoo is not working. (via browsing),

    But when i ping yahoo it works, and nslookup yahoo works also:

    PS C:\Users\Administrator> ping

    Pinging [] with 32 bytes of data:
    Reply from bytes=32 time=174ms TTL=50
    Reply from bytes=32 time=153ms TTL=50
    Reply from bytes=32 time=151ms TTL=50
    Reply from bytes=32 time=170ms TTL=50

    Ping statistics for
        Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
    Approximate round trip times in milli-seconds:
        Minimum = 151ms, Maximum = 174ms, Average = 162ms

    This is odd, i don't have any issues browsing if i connect to sky hub. so there isn't anything on the box stopping.
    Maybe some sort of routing issue?

  • LAYER 8 Global Moderator

    if it was a routing issue how could you ping ;)

    if it resolves - did you change the rules on pfsense from the default any any?

    Did you install any packages like squid or snort?  Is your browser using any sort of proxy setting? etc. etc..

  • You are correct about the routing. it makes sense.

    no i have'nt changed any rules. I did enable just now manual NAT.

    I dont have a proxy, no snort or squid.

    Its a basic new install. with changes/configurations that i mentioned above.

    If its a DNS issue then whats stopping from browsing anything else than google?

  • LAYER 8 Global Moderator

    Sure your box has not been compromised and infect with some sort of redirect for searches and traffic?

    Why would you have changed over to manual nat?  There is rarely a need to do this, and not suggested unless you fully understand what your doing ;)

    If your install is pretty much default it should just work.  What I would suggest is do a sniff (packet capture) on pfsense - say the wan and lan at the same time via tcpdump watching the traffic.  do you see your dns queries and answers for sites that are not working?  Do you see the traffic come back after you do your http get to the site?

    Could you have some issue with using ipv6 vs ipv4?  Are you using ipv6?

Log in to reply