Problem Description:Internet connectivity fails for all LAN clients when the OPNsense WAN interface is configured with a static IPv4 address, despite working correctly when set to DHCP.
Expected Behavior:LAN clients should have full internet access regardless of whether WAN uses DHCP or static IP configuration.
Actual Behavior:- With WAN on DHCP: LAN clients can browse websites without issues
- With WAN on Static IPv4: LAN clients cannot load any websites (browser shows ERR_TIMED_OUT)
Reproduction Steps:1. Perform fresh OPNsense 26.7.1 installation
2. Complete the OPNsense Setup Wizard with the following settings:
General Information- Hostname: OPNsense
- Domain: internal
- Override DNS: ❌ disabled
DNS [Unbound]
- Enable Resolver: ✅
- Enable DNSSEC Support: ✅
- Harden DNSSEC data: ✅
Network [WAN]- Type: Static
- IP Address: 192.168.2.2/24
- Gateway: 192.168.2.1
- Block RFC1918 Private Networks: ❌ disabled
- Block bogon networks: ✅ enabled
Network [LAN]- IP Address: 192.168.10.1/24
- Configure DHCP server: ✅ enabled
Deployment type- Automatic DHCP/DNS registration: ✅ enabled
Post-Wizard Changes3. Configure Unbound DNS over TLS via Mullvad with the following forwarding servers:
| Server IP | Server Port | Description |
|-----------|-------------|-------------|
|
194.242.2.6 | 853 | Mullvad Family |
|
2a07:e340::6 | 853 | Mullvad Family |
4. From any LAN client, attempt to open a website or ping external addresses →
ERR_TIMED_OUTRelevant System Information:Network Topology:
├── Upstream Device: tp-link Archer MR200
│ └── IP: 192.168.2.1
├── OPNsense WAN Interface
│ ├── IP: 192.168.2.2/24 (Static)
│ └── Gateway: 192.168.2.1
├── OPNsense LAN Interface
└── IP: 192.168.10.1/24
OPNsense Diagnostic Results:
- Ping to 192.168.2.1: SUCCESS
- Ping to 1.1.1.1: SUCCESS
- Ping to google.com: SUCCESS
LAN Client Diagnostics:
- Ping to 192.168.10.1: SUCCESS
- Ping to 1.1.1.1: TIME OUT
- Ping to google.com: TIME OUT
- Website access to google.com: ERR_TIMED_OUT
Error Messages:Browser Error: ERR_TIMED_OUT
Ping Test Failure (LAN Clients): ping 1.1.1.1 → Request timed out
Note: OPNsense itself has full internet access and can reach external hosts. The problem exclusively affects traffic originating from LAN clients.
What I've Tried:| Setting | Action Taken | Result |
|---------|--------------|--------|
| Source NAT | Changed from Automatic to Hybrid mode | No change |
| Routes | Verified default route exists (Flag UGS active) | Route confirmed correct |
| Interfaces | Switched WAN from Static to DHCP | ✅ Problem resolved - internet access restored fo rall LAN clients |
| Gateways | Verified WAN Gateway (192.168.2.1) is set as upstream gateway | Confirmed correct |
Off-topic: Manually converting this text, which was originally written in Markdown, was quite a hassle. Are there any better tools I could use for this?
When configuring WAN manually did you create the gateway in System > Gateways and mark it as "upstream" gateway? Only then will the automatic outbound NAT rule creation work and your clients have Internet access.
In the case of DHCP for WAN this happens automatically.
Thanks for the quick reply.
I see two gateways, one named WAN_GW, which is configured as the upstream gateway to IP address 192.168.2.1.
I had already checked that earlier but unfortunately forgot to mention it. I'll add that to the post above right away.
Out of curiosity, I used the wizard to reconfigure the WAN interface to use DHCP and connected the OPNsense to a different network. This network includes several other devices with static IP addresses, which have not experienced any problems so far. As usual, everything works fine when the WAN is set to DHCP. However, when I switched the WAN to static, I encountered the same problem.
As an additional test, I disabled the DoT entries in Unbound, checked the box to use the system nameservers and set them to 1.1.1.1 for testing purposes.
However, this did not resolve the issue. The problem described in the first post persists: OPNsense can access the internet, but the devices on the LAN cannot.
You can also try to create a manual outbound NAT rule and use "Hybrid" NAT mode.
It is almost sure that you need NAT on OpnSense for this to work because your front router does not know the route to 192.168.10.1/24.
@wiring8228 In addition to System > Gateways check Interfaces > WAN > IPv4 gateway rules and make sure the gateway is selected.
Thank you both for your help :)
I was able to fix the problem with a Source NAT rule in hybrid mode, for which I used the following settings:
Interface: WAN
Version: IPv4
Protocol: any
Source Address: LAN network
Destination Address: any
Destination port: any
Translate Source IP: WAN address
Translate Source Port: any
I suspect I'll need to create a second rule for IPv6 here, since I can't select both in the same rule. Should I adjust the rule in any other way? I haven't worked much with NAT so far — usually just inbound NAT.
If your Archer device supports it, you can set a static route for the 192.168.10.1/24 LAN through the 192.168.2.2 Sensebox WAN interface. That way you can avoid double NAT. For IPv6 you could probably do prefix delegation or other fancy things to avoid NAT, there are pretty comprehensive How-Tos around here (which I cannot comment on since I intentionally NAT IPv6).
Quote from: drosophila on July 26, 2026, 11:22:00 AMFor IPv6 you could probably do prefix delegation
He did a fresh 26.7.1 install so you can't do that unless you switch from DNSmasqd to KEA first :)