Score:1

Internet access problems on subnet

us flag

Hello Server Fault friends!

I have a question that I believe should be easy to answer for someone who really gets how a typical subnet should be configured with a router such as PFSense.

My Problem: I am not able to access the Internet from one of my subnets (the LAB)... my network looks like this

enter image description here

Here is some information I hope could help troubleshoot the problem.

Tracert with Network Name

On my HOME NETWORK machines things look good enter image description here

From my LAB NETWORK, it goes only as far as the pfSense WAN interface enter image description here

pfSense Configuration

Here is one of the interface configuration pages (HOME) enter image description here

...and here is the other interface (LAB) enter image description here

Here is the IPv4 routing table enter image description here

Communication from my pfSense to the Internet (TELCO) Router

One thing I discovered while troubleshooting that I think gets closer to the gist of the problem is the fact that pfSense can PING the Internet (TELCO) Router when using the HOME interface but not when using the LAB interface. Is as if the Internet Router didn't want to talk to my LAB network.

enter image description here

Gateways Configuration

Here is a print-screen of my Gateways configuration on pfSense, to address the question of whether I had 192.168.100.254 configured as my Default Gateway. I tried with and without this entry but nothing seems to work enter image description here

I can provide more configuration screens if needed. pfSense has so many configuration pages that I honestly don't know exactly where to start... is a bit overwhelming.

Thanks for your help

Score:1
ar flag

You don't have a default route set.

In short you'll have to add your up stream as default gateway, and possibly turn on masquerading as well.

Given that you find pfsense overwhelming, it's probably a good idea to perform a clean install, and select the upstream interface as WAN, and downstream as LAN. That way you'll have a working, sensible, starting point from which you can learn.

Martin Surasky avatar
us flag
Hi vidarlo I do have 192.168.100.254 as the default gateway in the System / Routing / Gateways. I'm adding a print-screen on my original post of that page
vidarlo avatar
ar flag
You may have it there, but you have no `0.0.0.0` route listed under IPv4 routes.
Score:0
ng flag

Does your PFSense router actually have IP forwarding enabled?
Does it allow traffic between its two connected networks?
Does it perform any sort of NAT?
Do all the other routers involved know where they should send packets addressed to the networks on the other sides to the router itself?

Martin Surasky avatar
us flag
If by IP forwarding you mean Port Forwarding (Firewall / NAT / Port Forwarding) the answer is: NO Does it allow traffic between its two connected networks? YES, actually boxes in 192.168.100.x can ping all the 192.168.101.x and viceversa (I even start RDP sessions on my LAB machines from my HOME machines with no problem) the only problem seems to be the gateway that sends the traffic to Internet (192.168.100.254 in my diagram). That particular box is only seen by the 192.168.100.x boxes (HOME) but not by the 192.168.101.x boxes (LAB) Does it perform any sort of NAT? NO
Martin Surasky avatar
us flag
Do all the other routers involved know where they should send packets addressed to the networks on the other side of the router? The only problem again is that 192.168.100.254 (Default Gateway) router. From that router I cannot ping nor tracert any boxes on 192.168.101.x
Score:0
us flag

After a lot of investigation I finally ended up achieving internet connectivity on my LAB!

I watched this presentation... https://www.youtube.com/watch?v=bU_OYWzjJms

And at about 1 hour into the video there is a demo where the upstream (default) gateway connectivity is being troubleshoot. As the scenario looked pretty much like mine, I continued watching and noticed that the person showing the demo goes to the wan interface "Upstream gateway" combo box and adds the Default Gateway.

I thought by now that my setting would have this gateway there (as I entered as the "Default Gateway" on System / Routing / Gateways) but entering my gateway there is not the same as entering it in the WAN interface configuration.

enter image description here

I still don't understand what the differences are of entering my default gateway in the WAN interface configuration (where I was missing it) vs. the System / Routing / Gateways, but missing that crucial configuration was the one and only thing solving the problem.

As a consequence of adding this setting, I also see that new Automatic Rules were added in the Firewall / NAT / Outbound

enter image description here

I hope all these information in my original post and the resolution can eventually help someone to troubleshoot a similar future problem!

Thanks everybody!

I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.