PFSense not serving WAN traffic to LAN? | Linus Tech Tips | Page 1

subtle trail Aug 11, 2023, 11:49 PM

#

Newly set up PFSense box hooked up to my WAN via modem and my LAN. I'm able to access my LAN, including the pfsense box, via my access point; my former LINKSYS Router/WAP combo.

The PFSense box has a WAN IP and can ping from the web interface, but I can't reach the internet from any client on the LAN.

rn_image_picker_lib_temp_06f2f93b-577a-4494-bbfe-53e9e34c77c3.jpg

vital hazel Aug 12, 2023, 2:56 AM

#

subtle trail Newly set up PFSense box hooked up to my WAN via modem and my LAN. I'm able to a...

Did you create rules to allow traffic? pfsense is a deny by default deal

#

It'll be something similar to this, though with LAN net as your source and default as your gateway

#

Mine's different because I'm using opnsense

subtle trail Aug 12, 2023, 3:03 AM

#

I'll take a look at the rules and add away

vital hazel Aug 12, 2023, 3:07 AM

#

Start with rules that let anything through then work your way to more fine grained

subtle trail Aug 12, 2023, 3:10 AM

#

I've blanket allowed everything on both WAN and LAN interfaces, and I'm still not seeing internet access

vital hazel Aug 12, 2023, 3:10 AM

#

What do your logs show? Make sure your rules have the Log box checked

#

But you should NOT need any rules on WAN

subtle trail Aug 12, 2023, 3:11 AM

#

rn_image_picker_lib_temp_79de064b-3fbc-4afd-9936-e080f325803c.jpg

#

rn_image_picker_lib_temp_9fd7c9b8-63d8-47b1-ba9b-bbba85e0f623.jpg

vital hazel Aug 12, 2023, 3:11 AM

#

Yea, disable that WAN rule. You're letting all inbound traffic in

#

You only need to make WAN rules if you're trying to do some port forwarding

#

Did you set up DHCP ranges and whatnot?

subtle trail Aug 12, 2023, 3:15 AM

#

Yeah, default gave from 10.0.0.10 - 10.0.0.245 during setup wizard

vital hazel Aug 12, 2023, 3:15 AM

#

That's your LAN net range then?

subtle trail Aug 12, 2023, 3:16 AM

#

Yes. WAN is set to dhcp on IPV4 and IPV6 disabled

vital hazel Aug 12, 2023, 3:17 AM

#

Do you have the LAN interface enabled?

#

This is mine for reference

subtle trail Aug 12, 2023, 3:17 AM

#

Yeah, it's enabled. I'm connecting to the box wirelessly on the lan

vital hazel Aug 12, 2023, 3:18 AM

#

Look at your firewall logs, see if it shows you traffic being blocked

#

(this assumes logs are enabled for your rule)

#

I'm pretty sure pfsense does that still

subtle trail Aug 12, 2023, 3:19 AM

#

Looking for where logs are

vital hazel Aug 12, 2023, 3:20 AM

#

https://docs.netgate.com/pfsense/en/latest/monitoring/logs/index.html#filtering-log-entries

#

Derp wrong link

#

https://docs.netgate.com/pfsense/en/latest/monitoring/logs/firewall.html

#

Status > System Logs, on the Firewall tab

subtle trail Aug 12, 2023, 3:22 AM

#

Found it

rn_image_picker_lib_temp_be8670aa-5a5f-4c88-8532-c70e6aec714c.jpg

vital hazel Aug 12, 2023, 3:23 AM

#

Those are coming in at your WAN

subtle trail Aug 12, 2023, 3:24 AM

#

Right. I dont quite understand why they've been blocked though...

vital hazel Aug 12, 2023, 3:24 AM

#

Because you don't have a rule allowing in WAN traffic. That's expected

#

Try setting a ping from your pc to 1.1.1.1 and just let it run. Trying to remember how to get windows to not auto stop it

#

ping -t 1.1.1.1

#

then look at your firewall logs and change the source to your PC IP

subtle trail Aug 12, 2023, 3:26 AM

#

Running Ubuntu. I believe it's continuous by default

vital hazel Aug 12, 2023, 3:26 AM

#

Oh then much easier, yea

#

Looks like you don't have logs turned on for your rule

subtle trail Aug 12, 2023, 3:34 AM

#

Turned on logs for the rule. Still don't see logs from the ping test

vital hazel Aug 12, 2023, 3:36 AM

#

I think maybe your linksys device is getting in the way somehow

#

Especially if it's got its own DHCP server running

subtle trail Aug 12, 2023, 3:37 AM

#

I'm starting to think that as well. When I visit it's IP I get a weird message after signing in

vital hazel Aug 12, 2023, 3:37 AM

#

Is your PC IP in the range of your pfsense LAN?

#

ip a

subtle trail Aug 12, 2023, 3:40 AM

#

10.0.0.128

vital hazel Aug 12, 2023, 3:40 AM

#

Try taking the linksys out of the chain for now

subtle trail Aug 12, 2023, 3:40 AM

#

Just deleted LINKSYS from LAN. Adding new hard-line interface on pfsense.

vital hazel Aug 12, 2023, 3:46 AM

#

Wait, are you intending on creating a new interface? Shouldn't need to, just plug into the same port the linksys was in

subtle trail Aug 12, 2023, 3:47 AM

#

LINKSYS was plugged into a switch... Nvm caught it as I was typing it

vital hazel Aug 12, 2023, 3:47 AM

#

Ahh

subtle trail Aug 12, 2023, 3:49 AM

#

Pc froze when running dhclient rebooting

vital hazel Aug 12, 2023, 3:50 AM

#

oof

subtle trail Aug 12, 2023, 3:54 AM

#

Oh boy. Can't reach the web Configurator now and running sudo dhclient now returns "Operation not possible due to RF-kill"

#

rn_image_picker_lib_temp_a8967b91-2627-4b85-ace6-3937c6319950.jpg

vital hazel Aug 12, 2023, 3:55 AM

#

Looks like your PC isn't being given a dhcp lease

#

Never seen the need to run dhclient though

#

Should be automatic

subtle trail Aug 12, 2023, 3:58 AM

#

Hmm. I was trying to use old router as dhcp server. dhcp server probably didn't spin up when I unplugged LINKSYS

vital hazel Aug 12, 2023, 3:59 AM

#

pfsense should be handling it for sure

subtle trail Aug 12, 2023, 4:00 AM

#

Now that I've lost dhcp, do I have to/would it be better to reset to factory defaults, or can I start the dhcp server from command line?

vital hazel Aug 12, 2023, 4:01 AM

#

I don't know pfsense cli off the top of my head, but you should be able to do it with a monitor plugged directly into the box assuming you have an igpu in it

#

But a factory reset might be easier

#

In general, you want to start off as simple as possible to make troubleshooting easier

#

The linksys router should be put into bridge/AP mode once you get things working hard wired

subtle trail Aug 12, 2023, 4:05 AM

#

Yeah, I think I'll stick to just the modem, the switch and the pfsense box for now.

vital hazel Aug 12, 2023, 4:07 AM

#

If you have the money, I use omada gear myself for switch & APs with the controller in a docker container to manage all my stuff. Works well

#

Has a mobile app for it, too

subtle trail Aug 12, 2023, 4:08 AM

#

Controller for what is in docker container?

vital hazel Aug 12, 2023, 4:08 AM

#

The omada controller

#

Can create up to 8 wifi networks on a single AP each on its own vlan.

#

You can get the controller in a physical box for like $100, but the docker container works just as well for free

subtle trail Aug 12, 2023, 4:13 AM

#

Interesting. Just spent $300 on this little box to experiment with PFSense, looking like I'll need at least 1 standalone AP at this point. Might do a whole migration 🤷‍♂️

vital hazel Aug 12, 2023, 4:14 AM

#

I started off like that, too. But found the wonders of using a 1 liter thin client PC as my router/firewall. Got it off ebay for just under $200 and it's WAY more powerful than those boxes if you got like a protectli or similar

subtle trail Aug 12, 2023, 4:14 AM

#

Protect Li! That's the one

#

Okay.

vital hazel Aug 12, 2023, 4:15 AM

#

I used this as inspiration. I snagged a m920q off ebay
https://smallformfactor.net/forum/threads/lenovo-m720q-tiny-router-firewall-build-with-aftermarket-4-port-nic.14793/

SFF.Network

Log - Lenovo M720Q Tiny router/firewall build with aftermarket 4 po...

Greetings all, I promised an update on my work to do an aftermarket conversion of a Lenovo M720Q Tiny to have an extra 4 port NIC - and here it is. I've not been able to find another report on such a build elsewhere, so it's a bit of hyperbole but let's call this a world exclusive. ? You can...

subtle trail Aug 12, 2023, 4:15 AM

#

Just finished running through setup wizard agaom

#

Pfsense has my public IP and my WAN rules show the default blocked message!

vital hazel Aug 12, 2023, 4:17 AM

#

That's normal. Did your PC get assigned an IP?

#

I assume so since you're looking

subtle trail Aug 12, 2023, 4:17 AM

#

Correct

vital hazel Aug 12, 2023, 4:18 AM

#

Do you have internet access?

subtle trail Aug 12, 2023, 4:18 AM

#

Negative

vital hazel Aug 12, 2023, 4:18 AM

#

Created a LAN rule too?

subtle trail Aug 12, 2023, 4:19 AM

#

Default LAN rules look like they should be enough?

rn_image_picker_lib_temp_70666604-f28d-4dd2-8c11-e75f7b1e1c1e.jpg

vital hazel Aug 12, 2023, 4:20 AM

#

Try changing the gateway to WAN

subtle trail Aug 12, 2023, 4:21 AM

#

Change destination from "*" to "WAN Net"?

vital hazel Aug 12, 2023, 4:22 AM

#

No this

#

looks like some traffic is going over LAN at least

#

But turn on logs for the rules too

subtle trail Aug 12, 2023, 4:24 AM

#

Found the setting. Buried in advanced tab

#

Still no internet. Trying to find logs tab again

vital hazel Aug 12, 2023, 4:26 AM

#

And set the src to your PC IP

subtle trail Aug 12, 2023, 4:29 AM

#

??? I can ping! No Google though

rn_image_picker_lib_temp_ae6ad96f-8728-47cf-9f0d-651a439f1ea1.jpg

vital hazel Aug 12, 2023, 4:30 AM

#

Ok that's a good 1st step

#

Looks like DNS is next

subtle trail Aug 12, 2023, 4:30 AM

#

Put source as 10.0.0.1/16 would that suffice？

vital hazel Aug 12, 2023, 4:30 AM

#

That's a whole shitload of IPs lol, but yea

#

Go through this and make sure you did everything
https://docs.netgate.com/pfsense/en/latest/multiwan/interfaces-and-dns.html

#

You might need to assign a DNS service for pfsense to send queries to

#

Sorry that link's for multi-WAN, one sec

#

This one should work
https://docs.netgate.com/pfsense/en/latest/services/dns/resolver-config.html

#

Probably need to set system DNS servers

When checked, unbound will use the system DNS Servers from System > General Setup or those received from a dynamic WAN, rather than using the root servers directly.

#

Try dig @9.9.9.9 google.com

#

On your PC

#

If that works, then you need to set up DNS on pfsense

#

This is my output, for reference

; <<>> DiG 9.18.17 <<>> @9.9.9.9 google.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 65054
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;google.com.                    IN      A

;; ANSWER SECTION:
google.com.             10      IN      A       172.253.62.102
google.com.             10      IN      A       172.253.62.138
google.com.             10      IN      A       172.253.62.139
google.com.             10      IN      A       172.253.62.101
google.com.             10      IN      A       172.253.62.113
google.com.             10      IN      A       172.253.62.100

;; Query time: 14 msec
;; SERVER: 9.9.9.9#53(9.9.9.9) (UDP)
;; WHEN: Fri Aug 11 23:35:52 CDT 2023
;; MSG SIZE  rcvd: 135

subtle trail Aug 12, 2023, 4:37 AM

#

I've got similar output from dig commanf

vital hazel Aug 12, 2023, 4:37 AM

#

Then you know your problem lol

subtle trail Aug 12, 2023, 4:39 AM

#

Bit confused. Should I enable DNS forwarder instead of DNS resolver then?

vital hazel Aug 12, 2023, 4:39 AM

#

Start with resolver

#

Your ISP might be a bitch and block that, then forwarding mode would be next to try

#

You can test pfsense dns by just doing dig google.com. That should query it

subtle trail Aug 12, 2023, 4:43 AM

#

! Changed outgoing network interfaces to WAN and enabled DNS QUERY Forwarding mode

rn_image_picker_lib_temp_074c54b5-3f71-42ad-8aa6-2fdec8c24327.jpg

vital hazel Aug 12, 2023, 4:44 AM

#

Start with All for outgoing interfaces

#

But i'm glad it resolved for ya

subtle trail Aug 12, 2023, 4:45 AM

#

I've heard before "it's always DNS" but this is just ridiculous 😆

vital hazel Aug 12, 2023, 4:45 AM

#

lol

#

Just wait till you get into pfblockerNG

#

DNS blocking (aka ad blocking) galore

subtle trail Aug 12, 2023, 4:46 AM

#

Ooh boy. I think I'll just get a pre-made container of pihole thank you very much lol

vital hazel Aug 12, 2023, 4:46 AM

#

Oh pihole works great too!

#

I like adguard home more, personally. Gives you more fine grained controls, like blocking certain URLs for individual clients

#

Pihole is just all or none

subtle trail Aug 12, 2023, 4:48 AM

#

Not something that I had thought of before. I will certainly look to see if that's something that would be useful for the family, though.

vital hazel Aug 12, 2023, 4:48 AM

#

Something I do that might interest you is forcing all clients on your network to use only pfsense for DNS

subtle trail Aug 12, 2023, 4:49 AM

#

I've got to thank you so much for helping guide me through this, btw!

vital hazel Aug 12, 2023, 4:49 AM

#

You're very welcome

subtle trail Aug 12, 2023, 4:51 AM

#

Next immediate project I'll be looking for is to set a second LAN interface on pfsense that only allows VPN traffic through. Wireguard would be nice too

vital hazel Aug 12, 2023, 4:51 AM

#

I do that with my opnsense

#

Though I do it via VLANs

#

I also have a managed switch capable of them

subtle trail Aug 12, 2023, 4:53 AM

#

Nice. Nice. I'm thinking of having a small server right near the router to download my Linux isos, and I want that to always be over VPN.

vital hazel Aug 12, 2023, 4:53 AM

#

If you don't have a VPN provider, I recommend mullvad, proton, ivpn, or windscribe. They are decent companies in a sea of scummery

subtle trail Aug 12, 2023, 4:53 AM

#

Would be simple to just have 1 whole interface dedicated to that purpose

vital hazel Aug 12, 2023, 4:54 AM

#

That's exactly what I do with my truenas server

subtle trail Aug 12, 2023, 4:54 AM

#

I use Proton for privacy, and nord for basic security: free wifi and whatnot

vital hazel Aug 12, 2023, 4:55 AM

#

Well good luck to ya

subtle trail Aug 12, 2023, 4:56 AM

#

Thanks again!

#PFSense not serving WAN traffic to LAN?