No internet access with default install and public ip

glisignoli · Jul 2, 2014, 7:50 AM

I'm not sure the title explains exactly what my problem is. I have a thomson/technicolor vdsl2 modem that I have setup with DMZ (http://help.telecom.co.nz/app/answers/detail/a_id/20201)

My physical setup looks like this:

Modem <–-> pfSense <---> LAN

From the default install my console shows this:


*** Welcome to pfSense 2.1.4-RELEASE-pfSense (amd64) on pfsense ***

 WAN (wan)       -> re0        -> v4/DHCP4: 219.XX.XXX.XX/24
 LAN (lan)       -> re1        -> v4: 10.1.1.1/24

My routing table shows:


Routing tables

Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
10.1.1.0/24        link#2             U           0     1073    re1
10.1.1.1           link#2             UHS         0        0    lo0
127.0.0.1          link#5             UH          0      270    lo0
219.XX.XXX.0/24    link#1             U           0        0    re0
219.XX.XXX.XX      link#1             UHS         0        0    lo0

When I try and ping 8.8.8.8 from the pfsense shell I get no response, when I try to ping from my LAN I also get no response.

When I add a defualt route to the 219 re0 interface I am able to ping fine:


route add default 219.XX.XXX.XX
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: icmp_seq=0 ttl=55 time=41.416 ms

But even with that route added my lan is still unable to ping any internet ip addresses. From my pc's I am able to ping 10.1.1.1 (the pfSense lan ip).

I'm assuming there is another route I need to add between 10.1.1.1 and 219.XX.XXX.XX, or is it some sort of gateway or NAT that I need to setup?

divsys · Jul 2, 2014, 1:35 PM

What do your firewall rules for WAN and LAN look like?

glisignoli · Jul 2, 2014, 9:09 PM

Just the defaults that came with pfsense (at the time).

I have since changed my modem to act as a bridge and it's working fine. I didn't even realise that it had the option to do that. So all is well.

I have a new weird problem where ssh port forwarding doesn't seem to work for one ip address, but I'm not concerned about this now.