LAN can't connect to WAN on new install
-
Problem summary
I'm having an issue getting my LAN to connect to the Internet. What's strange is I can successfully ping internet IP if I use the ping tool found in pfsense's web interface but I cannot ping the same IP when I try to use my PC (found on the same LAN than connects to pfsense) Any suggestions? (note: I'm a newb so it might be something self-evident but I lack the familiarity with networking to fix)Current setup
- my modem is connected to WAN port of a wireless router running OpenWRT
- LAN port of my router connects to WAN port on server running latest version of pfsense (fresh install)
- Server running pfsense has 4 port addon nics and 2 built in nics (i.e. six total)
- server has 1 nic configured as WAN interface, WAN successfully gets DHCP address from router.
- another server nic has been configured as LAN interface
- LAN port of pfsense plugged into switch
- LAN port of pc running Ubuntu plugged into same switch
- Ubuntu PC successfully gets DHCP address from pfsense -
What IP addresses do you have configured for WAN and LAN? Post screenshots of what you have for Interfaces - WAN and Interfaces - LAN. It might be a gateway issue. LAN should have no gateway, and WAN should have your modem as its gateway.
-
Just a guess, but the WAN address on pfSense is a private IP. Usually this is 192.168.0.0/24 in most routers or a 1 or 254 in the third octect. pfSense is configured by default to block private IPs. Go to the WAN interface setup and disable block private IPs. If this doesn't work, please make sure that the computer you are testing with is only on the LAN and is using pfSense as its gateway.
-
@KOM:
What IP addresses do you have configured for WAN and LAN? Post screenshots of what you have for Interfaces - WAN and Interfaces - LAN. It might be a gateway issue. LAN should have no gateway, and WAN should have your modem as its gateway.
I've posted screenshots.
For the record, my WAN port on pfsense server is connected to my router (running OpenWRT). If you look at the dashboard screenshot you'll see that PFsense does gets a WAN side DHCP connection. I also sucessfully get a DHCP connection on my PC from the LAN interface of Pfsense server.
I can ping the Internet if I use the ping tool found in the pfsense web interface. It just doesn't work when I try to ping the same ip using a pc connected to pfsense server. (i.e. the LAN isn't talking to the WAN for some reason)
-
Just a guess, but the WAN address on pfSense is a private IP. Usually this is 192.168.0.0/24 in most routers or a 1 or 254 in the third octect. pfSense is configured by default to block private IPs. Go to the WAN interface setup and disable block private IPs. If this doesn't work, please make sure that the computer you are testing with is only on the LAN and is using pfSense as its gateway.
I don't have block private ips set. I've attached screenshots (in another post on this same thread). Any other ideas?
-
can you ping by ip address? perhaps a traceroute from a computer 8.8.8.8 so that you can see where the packet is getting to. What does your routing table look like?
-
I'm not sure if pfSense knows about your gateway. Since you have it set to DHCP, the Gateway field is blank as it's expecting to get it from your DHCP server.
If I were you, I would punt DHCP and give your WAN port a static IP address, and then define your gateway.
-
can you ping by ip address? perhaps a traceroute from a computer 8.8.8.8 so that you can see where the packet is getting to. What does your routing table look like?
I can't even ping my router from pfsense LAN network, Traceroute stops at LAN (192.168.10.1), Where would I find my routing table?
-
@KOM:
I'm not sure if pfSense knows about your gateway. Since you have it set to DHCP, the Gateway field is blank as it's expecting to get it from your DHCP server.
If I were you, I would punt DHCP and give your WAN port a static IP address, and then define your gateway.
I tried setting the the WAN to static then added a gateway (used ip of my router). Still no luck.
-
Post a shot of Firewall->NAT->Outbound please.
-
-
There are no NAT rules for your LAN network. Why not use automatic?
-
If you must use manual, something like this should get you going:
Interface: WAN_RE0
Source: 192.168.10.0/24
Source Port: *
Destination: *
Destination Port: *
NAT Address: WAN_RE0 address
NAT Port: *
Static Port: No -
If you must use manual, something like this should get you going: …
Woo hoo. That did the trick.
Out of curiosity – what did I just do? (in layman's terms).
-
Well, first thing is you took the default configuration, set it to manual NAT, and broke your network. I have no idea why you want NAT rules for loopback addresses. The default, automatic NAT rules work in probably 99.9% of "newb" install situations.
Second, you told pfSense that traffic heading out WAN_RE0 with a source address in 192.168.10.0/24 should have the source address dynamically NAPT translated using the interface address of WAN_RE0.
-
loopbacks are set for pfsense internal services to get to the internet. They are created automatically when you switch to manual. No idea why you switched to manual outbound NAT. So far your setup doesn't need it. Automatic outbound nat would work well.
-
I didn't know that about the loopback NAT. Thanks.
-
I'll just add that your LAN firewall rule is set to allow only IPv4 TCP/UDP traffic which doesn't include ICMP (ping). You need to add a further rules to allow ICMP or change the existing rule to any IPv4 protocol.
Steve
