new lan not getting access to internet

[bloodyskullz]

Hey,

So i am not a networking expert but I am hoping to get some assistance with an issue i am dealing with. Currently I have a mini pc with multiple ports and one port I labelled as a LAN port with subnet 10.0.0.0/24, main LAN is 192.168.1.1

I can't seem to get internet going on this LAN and I think my rules are wrong, even a simple ping would work for a bit then fail entirely.

I currently have the LAB network, any port going to the WAN address as destination with any port for port and gateway.

Is that the wrong rule?

[Maurice]

For Internet access, destination must be 'any', not 'WAN address'.

Cheers
Maurice

[Seimus]

As Maurice said, destination field in the rule cant be WAN for this, the WAN specifies the FW WAN interface IP.

So by your rule traffic only to the WAN IP is permitted and not to the Internet. You need to put ANY or if you want only Internet access while blocking LAN communication between host you can do it via Alias using inverse match in the rule.

Regards,
S.

[bloodyskullz]

I just made the change and I still can't seem to load any webpage, do i need to have any other rules for internet access?

[tverweij]

Is this a physical or VM installation?

[bloodyskullz]

Opnsense is on a physical machine - tiny mini pc with 6 ports. I plugged a laptop directly into it and it's getting a dhcp lease but no access to the internet.

[tverweij]

I asked because I had a similar problem on a VM.
I solved the problem by restoring the hard disk from a backup of 4 days ago.

[Maurice]

[...] and gateway.

Did you specify a gateway in the firewall rule? Don't do that unless you know what you're doing (policy-based routing).

[bloodyskullz]

[...] and gateway.

Did you specify a gateway in the firewall rule? Don't do that unless you know what you're doing (policy-based routing).

Currently set to default at the moment.

[cookiemonster]

please show your interface definition and its rules.
Also your DNS settings for system and your resolver i.e. Unbound or what you setup.
Any diagnostic done so far would be helpful like a dig or nslookup from a client on the new network.

[bloodyskullz]

Sorry but are you looking for screenshots or a CLI output?

Only DNS settings I have made were for the DHCP scope which is the same that I did for the main LAN (multiple ports are setup via lan bridge mode).

I don't know what Unbound is and I never messed with any of those settings.

Tracert results from a windows system

C:\Windows\System32>tracert 1.1.1.1

Tracing route to 1.1.1.1 over a maximum of 30 hops

  1     *        *        *     Request timed out.
  2     *        *        *     Request timed out.
  3     *        *        *     Request timed out.
  4     *        *        *     Request timed out.
  5     *        *        *     Request timed out.
  6     *        *        *     Request timed out.
  7     *        *        *     Request timed out.
  8     *        *        *     Request timed out.
  9     *        *        *     Request timed out.
 10     *        *        *     Request timed out.
 11     *        *        *     Request timed out.
 12     *        *        *     Request timed out.
 13     *        *        *     Request timed out.
 14     *        *        *     Request timed out.
 15     *        *        *     Request timed out.
 16     *        *        *     Request timed out.
 17     *        *        *     Request timed out.
 18     *        *        *     Request timed out.
 19     *        *        *     Request timed out.

[passeri]

May we see your specific rules for this LAN?

[bloodyskullz]

Screenshot of the rules section for the Lab portion is attached

[Maurice]

The direction of the first rule is wrong. This must be an 'in' rule (from the LAB net into OPNsense).
This also makes the second rule redundant.

[bloodyskullz]

Im confused as to how this actually worked (ignorance kicking in at the moment) as it isn't making sense to me.

For "Alternate hostnames" I specified both my LAN and LAB gateways which allows me to ping both subnets but the traffic to each should still be segregated right?