OPNsense Forum

Archive => 16.1 Legacy Series => Topic started by: bringha on July 17, 2016, 07:28:52 pm

Title: Missing Route to WAN Port - how to fix
Post by: bringha on July 17, 2016, 07:28:52 pm
Hi together,

I have a 4 port OPNsense mit a WAN, LAN, DMZ and an additional port for a Management Network which shall have access to the Internet over the Port OPT2 (named WLAN here, see rules). The firewall rules on this interface are as attached.

Connected to this port OPT2 is a server with the address, Gateway is, the gateway to the internet is The server has 2 interfaces, the primary interface eno1 is connected to LAN (gateway, the alternate interface eno4 to the network Consequently I have added on the server with iproute2 a second routing table (mng) and have added the necessary rules there:
Code: [Select]
controller# ip rule list
0: from all lookup local
32764: from all to lookup mng
32765: from lookup mng
32766: from all lookup main
32767: from all lookup default

In this second routing table I have configured:
Code: [Select]
controller# ip route list table mng
default via dev eno4 dev eno4  scope link  src
So: what works:
LAN works normal.
I can ping another server in the network
I can ping the gateway:
Code: [Select]
controller# ping -I eno4
PING ( from eno4: 56(84) bytes of data.
64 bytes from icmp_seq=1 ttl=64 time=1061 ms
64 bytes from icmp_seq=2 ttl=64 time=52.2 ms
64 bytes from icmp_seq=3 ttl=64 time=59.7 ms
64 bytes from icmp_seq=4 ttl=64 time=1059 ms
64 bytes from icmp_seq=5 ttl=64 time=83.2 ms
64 bytes from icmp_seq=6 ttl=64 time=90.8 ms

(Remarkable the large variety and duration of the ping ...), but I can't reach the WAN address:
Code: [Select]
controller# ping -I eno4
PING ( from eno4: 56(84) bytes of data.
From icmp_seq=1 Destination Host Unreachable
Obviously, there is a missing route in the opnsense between the gateway and the WAN. Evidence for this is when executing on the server:
Code: [Select]
controller # ip neigh show dev eno4  FAILED dev eno4 lladdr 00:25:kk:mm:rr:a1 STALE dev eno4  FAILED dev eno4  FAILED dev eno4 lladdr 00:17:ww:ff:ww:1c STALE dev eno1 lladdr ac:87:ww:ff:nn:rr REACHABLE dev eno4  FAILED dev eno1 lladdr 00:17:nn:aa:bb:1a STALE
(Don't ask me why even LAN connections are stale  8)); BUT, a trace route command to an address in the internet shows
Code: [Select]
controller# traceroute -i eno4 www.nokia.com
traceroute to www.nokia.com (, 30 hops max, 60 byte packets
 1 (  57.456 ms  59.551 ms  59.545 ms
 2 (  59.573 ms  59.611 ms  59.592 ms
 3 (  59.684 ms  59.668 ms  59.659 ms
 4  (...)
 8  a104-68-210-119.deploy.static.akamaitechnologies.com (  187.744 ms  187.735 ms  187.724 ms
something really confusing here .... :o :-\

I don't understand why with the given firewall rules the WAN net cannot be reached. How can I fix that?

Does anybody has an idea?

Looking forward to your reply.

Br br