Adding new WAN Connection - Ping Yes, Use No

padapa

I am adding a second WAN port (Verizon connection) to an existing PFSense installation.

The Network looks like this:

173.xxx.xxx.133
_____________
173.xxx.xxx.134 | |
–-- Comcast ---- | em0 | ____________________
| | | |
| pfsense em1|-------- LAN -------| PC @ 192.168.1.135 |
| | 192.168.1.1 |____________________|
---- Verizon ---- | ue0 |
10.1.1.1 |_____________|
10.1.1.10

I have my interface and gateway added and routes to allow traffic. The gateway monitor for the new interface is set to 8.8.4.4 and shows green on Status –> Gateways page.
I can ping from the LAN side all the way to the GW 10.1.1.1 address, but I can't get webGUI of the gateway router connected there.
If I move my PC to the 10.1.1.x network I can log into the webGUI.

What am I missing in my config? What would you look at/for?

Thanks,

a very frustrated padapa

heper

are you missing NAT on the new wan?

padapa

I would think if NAT wasn't working, I wouldn't be able to ping the 10.1.1.1 gateway address???

Applied to the LAN interface I have a new rule that looks like this:
https://www.dropbox.com/s/b1f260jxswvlzbm/Firewall%20-%20Rule%20-%20LAN%202015-11-06%20at%2012.55.56%20PM.png?dl=0

and in the outbound NAT setting I have this:

https://www.dropbox.com/s/ld5j8a757oscfqv/Nat%20-%20Outbound%202015-11-06%20at%2012.53.59%20PM.png?dl=0

I am preparing to send all 166.0.0.0 traffic out the new port, once it's working.

Heper, what else can I show you so you can help me see the issue?

padapa

padapa

@heper:

are you missing NAT on the new wan?

So where do I check that?

BTW… I can ping out to the next IP interface on the front of the Verizon path (10.10.1.1), but can't see it's webgui either??? >:(

If I do a traceroute to a public address like 166.xxx.xxx.125 it fails to see beyond the path to 10.1.1.1 and 10.10.1.1... like this:

traceroute 166.xxx.xxx.125
traceroute to 166.xxx.xxx.125 (166.xxx.xxx.125), 64 hops max, 52 byte packets
1 10.1.1.1 (10.1.1.1) 3.967 ms 3.045 ms 3.038 ms
2 10.10.1.1 (10.10.1.1) 9.783 ms 4.958 ms 4.836 ms
3 * * *
4 * * *
5 * * *

If I traceroute on the Verizon interface, I see the following: (So I know the outbound path is working correctly.)

traceroute 166.xxx.xxx.125
traceroute to 166.xxx.xxx.125 (166.xxx.xxx.125), 64 hops max, 52 byte packets
1 my.jetpack (10.10.1.1) 144.029 ms * 3.016 ms
2 241.sub-66-174-12.myvzw.com (66.174.12.241) 47.605 ms 40.756 ms 39.191 ms
3 244.sub-69-83-28.myvzw.com (69.83.28.244) 35.273 ms 44.141 ms 36.294 ms
4 17.sub-69-83-28.myvzw.com (69.83.28.17) 41.110 ms 37.837 ms 46.419 ms
5 170.sub-69-83-28.myvzw.com (69.83.28.170) 33.923 ms 37.562 ms 30.134 ms

Any more ideas?

padapa

padapa

I was checkin the system logs and found this: kernel: arpresolve: can't allocate llinfo for 10.1.1.1 on ue0

ue0 is my new wireless WAN connection. It is a USB to Ethernet adapter…

I can ping all the way out to public addresses, but I still can't use port 80/443 for webGUI access to anything?

Any Ideas??? Anyone!

David_W

You need an additional outbound NAT rule to get traffic for the gateway router UI originating from the correct subnet.

You might have to make this rule higher priority (i.e. above) the automatically created rule to get everything working correctly.