[Solved] Unable to ping gateway from LAN

[jds]

I read problems in the forum involving dual WAN setups, but mine is not dual and pretty simple. The 'block private network' switch on WAN is not checked. Yet, I cannot ping the gateway from inside the LAN.  I must be missing something stupid, so any suggestions are likely to be useful, and certainly appreciated.

[bartjsmit]

Your issue is with anti-spoofing features on the firewall. The source IP is on the private ranges, it goes out to the WAN interface and is then attempting to open a connection with the public IP. From the shape that the traffic flow takes, this is called a 'hairpin' route. You can control this with the NAT reflection setting in OPNsense.

Next question is - why do you want to ping your external gateway?

There is a WAN health feature in the dashboard which lets you keep an eye on it. To confirm that you have good connectivity from inside your LAN, ping a known responder ( typically 8.8.8.8 ) or configure smokeping on an internal host.

Bart...

[jds]

Thanks for the response. This indeed looks useful. To answer your question: I don't! But a device on my network does. It checks that it is connected this way very frequently, and reboots the wifi connection if the ping comes back empty. Stupid, I know, but cannot be changed.

So, I think that I found the proper place: Firewall-> Settings->Advanced. There are three radio buttons dealing with reflection. I tried every permutation of enabling these, and saving settings, but none worked. I even tried enabling all three and rebooting, but still no success. Any ideas what I am missing?

[bartjsmit]

Are you allowing ICMP on your WAN interface?

Try capturing some packets on the LAN and WAN side and check the firewall logs for deny entries.

Bart...

[jds]

Yeah, it was ICMP. I made a pass rule in LAN like response#6 here: https://forum.opnsense.org/index.php?topic=10718.msg48955#msg48955

Thank you!

[jonm]

There is a WAN health feature in the dashboard which lets you keep an eye on it.

I can't see this on my system, can you tell me where it is please? Or do I need to enable something to make it appear?

Thanks.

[bartjsmit]

I can't see this on my system, can you tell me where it is please? Or do I need to enable something to make it appear?

Shows you how long I've had it enabled 

Dashboard, Add widget, Gateways

Bart...

[jonm]

Got it, thanks