[Solved] Cannot resolve if WLAN uses vlan over pppoe

[jsegido]

Hello everyone. I've been spending some time over the past few weeks trying to configure a firewall. My goal is to remove the router provided by my internet company by connecting the firewall to my ONT. They have provided me with the credentials, including username, password, and VLAN (20) in this case.

The WAN wasn't a problem. First I had to configure a ppoe conection in my WAN. After that created a new vlan (20) with parent device the WAN device.
In the assignments option I assigned the new vlan created into the WAN interface. In the WAN interface option I had to add again the user and password.

After a while I was obtaining a public IP (seen in the dashboard) and I could update the packages.

In all the tutorials I see a guy launching a browser and saying: well, we have access to internet. But that is not my case.

I thought it may be caused because my devices are not in any VLAN. So I created a permisive rule

ipv4 (I only use ipv4), source any, destination any, gateway WAN_GW (the only one and active in system-gateway-configuration).

In the NAT -> Outbound -> Automatic outbound set to true.

In system -> settings -> general, I have configured to dns servers

                   1.1.1.1  use gateway:   WAN_GW (active one)
                   8.8.8.8  use gateway: none (a different option just to see if it works)

I can ping 8.8.8.8, but I cannot resolve domains.


I have also tested to include in the LAN interface dns servers like 8.8.8.8, 8.8.4.4  Without much criteria, changing options just in case there's luck.

I also tried new rules in the WAN interface to allow all incoming traffic and outcoming traffic just in case, but no luck.

This is a particular configuration. The WAN using pppoE in a vlan. Maybe I am doing something wrong, but the WAN is connected to internet, so I have assumed this is right.

I'm running out of ideas. Another alternative is to use my company's router in bridge mode, but this would be my last option.

Any suggestions will be welcome. Greetings.

[knebb]

hi.
reset all your rules to default!

It is unsure what device is having problems with DNS resolution.
The OPNSense itself? Show the output of the Interfaces -> Diagnostics part.

Or your local devices having problems?
Then check their configuration. Which dns do they use? Do you have DHCP enabled? Which dns does it provide?

On your devices use ping, nslookup (Win) or dig, host on Linux or Mac.
What does these tools say? Can you ping the IP of OPNSense?

/KNEBB

[johndchch]

VLAN tagged ppoe is common for ftth installs in NZ/Aus/UK and parts of Europe - lots of people ( myself ) included are happily running opnsense on those connections

one thing to check is whether your ISP allows 'third party' routers - a few look at the MAC of the device connecting and reject it if it's not their device ( thatr's where MAC cloning comes in).

Other thing worth trying if you have a managed switch is to set the switch to handle the tagging/untagging to the ISP hardware and present an untagged WAN feed to your opnsense appliance. Shouldn't matter - but it can eliminate one possible issue ( incorrect tagging setup in opnsense )

[jsegido]

Thank you very much for your responses. Thanks to your advises I could found the problem.

[SOLVED] The problem was that at System - Settings - General, I had selected the option "Allow DNS server list to be overriden".

In the interfaces - Diagnostics - DNS Lookup I could not resolve, so the problem was the firewall itself.

There has been a cluster of circumstances because I had an old router as access point to the LAN port and it had configured a default dns server. So some tests were working and others didn't.

Once I have this is working I can migrate my network to the firewall.

You are the best. Best regards. Have a good day.