No internet access on multiple NIC's



  • Hello,

    I am having a little issue with the pfSense router. I have 5 NIC's 3 of which are in use. Only one of them seems to be working and has internet access while others don't.

    I just installed pfsense, did not configure anything besides assigning interfaces.
    Here's my setup:

    intel adapters
    em0 (WAN) - DHCP
    em1 (LAN) - Linksys Router E2500 Bridged 192.168.1.1/24
          [ESXi NIC 1 did not work in em2, connected directly into Linksys router] 192.168.1.2/24 (DHCP x.x.x.200-254)
    em2 (Not in use, no internet access when configured with esxi)

    realtek adapters
    re0 (LAN) - ESXi Server 2'nd NIC - Thunderbolt 10.129.0.1/22 (DHCP x.x.3.200-.254)
    re1 (Not in use, no internet access when configured)

    I'm not sure whats causing the issue, the pfsense can ping default gateways. The devices that have no internet access obtain IP's from DHCP but cannot even ping it's own default gateway.

    All this happened after first reboot once the interfaces were configured.

    My board: Jetway NF9D-2550 Intel D2550 Dual LAN Mini-ITX w/ AD3INLANG, 5 x Gb LAN
    It has 2 Realtek NIC's on board and 3 intel Nics.

    em - intel nicas
    re - realtek

    on my ESXi I had no problems with the pfsense works like a charm.

    Help is really appreciated.

    Thank you!



  • Sounds like you did a default setup, got a wan and lan which probably configured the way you want and then 1 or more OPT interfaces that are not doing what you want.  To get those working you have to activate DHCP on each opt device and give them a domain (usually their own /24) and you have to add a pass-all firewall similar to the one on the LAN.  Thats about it.



  • I didn't go with default configuration, I passed all the traffic through other interfaces like the LAN but still no internet connectivity. I can provide screenshots if that would be useful to tell what could possibly cause the issue.

    So far only my LAN works, nothing else gets internet access. Could be some misconfiguration, I did't configure pfsense with multi NIC's before, only done WAN and LAN.
    I uploaded screenshot of my Firewall rules on the NIC that has no internet access.

    Edit:
    Now my LAN stopped getting internet access. I still however able to access WebConfig page as I'm on the LAN. The LAN is the router that is bridged. Gets IP Address, default gateway, DNS but does not get internet access.

    ![Screen Shot 2015-03-14 at 12.01.54 AM.png](/public/imported_attachments/1/Screen Shot 2015-03-14 at 12.01.54 AM.png)
    ![Screen Shot 2015-03-14 at 12.01.54 AM.png_thumb](/public/imported_attachments/1/Screen Shot 2015-03-14 at 12.01.54 AM.png_thumb)



  • Bridge…  I wonder what was bridged to what and how?



  • My router is in the bridge mode therefore acts like an AP. The  pfSense is being used as DHCP server on the LAN NIC. I've used DHCP on the AP to obtain IP Addresses.
    LAN IP/Default Gateway - 192.168.1.1/24
    DHCP Lease Range - .200 - .254.
    Then my ESXI is directly plugged into AP as that's the only way I can access ESXI server on LAN due to no Internet access and don't have a switch.
    I'll eventually move it to separate NIC once I figure to get network access and make devices on different networks/NICS communicate with each other.



  • There is something (maybe alot) I'm missing here.

    Maybe draw me a picture of this network and put here.  Network diagram.


  • Banned

    @Koval88:

    Now my LAN stopped getting internet access. I still however able to access WebConfig page as I'm on the LAN. The LAN is the router that is bridged. Gets IP Address, default gateway, DNS but does not get internet access.

    The first 3 rules are completely useless. The DNS one is broken is addition, since you don't allow UDP or anything else, just TCP. Ditto for the last two ones. You won't have working DNS with this, in the first place. Also, IPv6 does not work properly with ICMP blocked.



  • @kejianshi:

    There is something (maybe alot) I'm missing here.

    Maybe draw me a picture of this network and put here.  Network diagram.

    I'll draw it tomorrow in the morning. Current or the one I'm trying to accomplish with all Nic's?
    Ill do two just in case.

    Thanks!



  • Did you delete your default TCP + UDP pass all rule on the LAN?

    Thats a problem as doctornotor said.



  • @doktornotor:

    @Koval88:

    Now my LAN stopped getting internet access. I still however able to access WebConfig page as I'm on the LAN. The LAN is the router that is bridged. Gets IP Address, default gateway, DNS but does not get internet access.

    The first 3 rules are completely useless. The DNS one is broken is addition, since you don't allow UDP or anything else, just TCP. Ditto for the last two ones. You won't have working DNS with this, in the first place. Also, IPv6 does not work properly with ICMP blocked.

    So if I understood it correctly, get rid of first three and add one for UDP? I'll disable IPv6 as I'm not using it. Anything else I'm missing?

    Thanks!



  • make your last rule TCP and UDP

    Then get rid of your first 3 rules.

    Yeah - I totally missed that your last rule didn't include UDP.  My bad.


  • Banned

    @Koval88:

    So if I understood it correctly, get rid of first three and add one for UDP? I'll disable IPv6 as I'm not using it. Anything else I'm missing?

    Do you have some reason to block something? If not, what's wrong with ANY as protocol? At minimum, you DO want ICMP/ICMPv6, in addition to TCP/UDP.



  • Technicly you're right I have no reason to block anything internally in LAN, that's what I'll have my second firewall for and will place my VM's inside NAT on the Virtual pfSense.
    I did what you guys have told me but still unable to ping even with specific interface sites lily Google and 8.8.8.8.


  • Banned

    You will never be able to ping anything with ICMP not allowed…



  • Internally yes but external hosts/sites I should be able to right? At least I was able to when it was working. Still have no internet access on the bridged LAN. I'll draw a map in few hours of my network once I'll get home.
    Thanks!


  • Banned

    Sigh. Allow ICMP if you want ping to work…



  • Wow - Thats twice doctornotor said to be sure to allow ICMP and he was uncharacteristically polite about it….  I'd try allowing ICMP.



  • I have uploaded my network diagram. Right now all I'm trying to accomplish is to just get internet access working then I'll start planning on the virtual network.
    I still do not have internet access, not sure what I am doing wrong. Interfaces are in up status but no internet access from either one. I've rebooted pfsense multiple times still same issue. Thanks!

    ![Plan A.jpg](/public/imported_attachments/1/Plan A.jpg)
    ![Plan A.jpg_thumb](/public/imported_attachments/1/Plan A.jpg_thumb)
    ![Plan B ESXi Internally.jpg](/public/imported_attachments/1/Plan B ESXi Internally.jpg)
    ![Plan B ESXi Internally.jpg_thumb](/public/imported_attachments/1/Plan B ESXi Internally.jpg_thumb)


  • LAYER 8 Netgate

    Which of those are you currently trying to get working?  How many 10.129.0.1 interfaces are you planning on putting on one network?



  • I'm trying to get both working. 192.168.1.1 and 10.129.0.1 network. Hoth have same configurations but no internet access. I do not know what's blocking it.


  • LAYER 8 Netgate

    I meant which diagram.  Start piece by piece, one interface and function at a time until you're done.



  • Plan A, first pfsense firewall. I'm not worrying about firewall inside the ESXi server yet, moving one at a time.
    Thanks!


  • LAYER 8 Netgate

    Where are you trying to make NAT happen?  pfSense or VM pfSense or both?



  • I'm trying to NAT both, but starting with Bridge. 192.168.1.0/24.
    My configurations of firewall are attached to give more clear idea.









  • LAYER 8 Netgate

    What are the bridge members?  (goddamn bridges, why?)

    Read this:  Especially the very bottom.

    https://doc.pfsense.org/index.php/Interface_Bridges



  • I weird. I just removed the ESXI from the AP port and placed AP onto 192.168.2.1 network and lost connectivity completely. Getting the 169.x IP address now I am locked out cannot access Web Panel, really strange.


  • Banned

    Are you attempting some CARP/HA, or what exactly is the virtualized pfSense supposed to do there, beyond needlessly complicating things and causing general headache and mess?



  • That is my project that I am working on. Its gor my digital forensics lab where ill have workstation lab to which ill be remoting into. Other than that I'm trying to make as complicating as possible where I'll be connecting other routers to the network. Im more of a Cisco IOS never used pfSense before.

    I'm just trying to get the pfSense 1 to work and get it online. If someone has a configuration file with multiple NIC's so I could try it out.

    Thanks!


Log in to reply