WAN IPV4 gateway not working

[anton123]

Hello everyone,

First of all, I want to mention that I am relatively new to OPNsense and wouldn't consider myself an expert in networking. With that said, I've been trying to set up OPNsense on my homelab running Proxmox. In my homelab, I have two NICs: one is used as the WAN port (directly connected to the hardware provided by my ISP, although I'm not sure of the exact type), and the other is used as my LAN interface. I've installed a VM running OPNsense and connected the NICs with the corresponding virtual bridges.

The setup of OPNsense was quite straightforward. The only modification I made was changing the LAN IPv4 to a static one to prevent IP conflicts with my local computer. For the WAN, I used DHCP for both the IPv6 and IPv4 addresses. When I check the interfaces, I can confirm that the WAN has received valid addresses. Additionally, the WAN gateway address appears to be correct, as my home network router also shows the same WAN gateway.

However, it seems like I do not have internet access as I cannot ping outside the network. Interestingly, I noticed that I am able to ping the gateway using the IPv6 address but not the IPv4 address. Here are the troubleshooting steps I've taken so far:

Reset the ARP tables, as I have reinstalled OPNsense several times.
Verified that the WAN IP of the VM is not the same as the WAN IP for my router.
Temporarily accepted all traffic in and out from the WAN interface.
Checked the routing tables and validated that the correct gateways were specified.
The fundamental issue is that I can't connect to the internet, and my hypothesis is that I can't reach the gateway. If anyone has any suggestions or can guide me toward a solution, it would be greatly appreciated.

Has anyone encountered a similar issue or have any ideas on what might be causing this?

Thank you!
 
 

[meyergru]

First, you must find out how your ISP device operates. From what I can tell, it sounds like it is a router providing your LAN (including the Proxmox host) with RFC1918 addresses, not a just a bridge.


Thus, if your OpnSense VM gets one of these (LAN) IPs as WAN, it will still have its LAN on another, separate network. Unless your OpnSense also does NAT between its "LAN" and WAN (i.e. the ISP routers "LAN"), this will not work, because even if you set the ISP router as gateway, there will be no back route.

That is: your ISP router does not know about the separate "LAN" behind your OpnSense and thus, routes no packets there.

There are two ways out:

1. Setup NAT on your OpnSense.
2. If you can, create a route to your internal LAN on your ISP router via the "WAN" IP of your OpnSense.

[anton123]

Hello, thanks for the quick reply.

I also believe that the issue might stem from the network hardware provided by my ISP. To clarify, I live in a rental apartment in Sweden, and like most rentals, the network is provided through a box with several outputs. Unfortunately, I can't find any model number or hardware information to specify the type of equipment it is, nor can I interact with the network box through any interface to understand how the ports are set up. Upon closer inspection, I see that all ports are labeled as LAN ports, which seems contradictory because when I connect my router or Proxmox server, I receive valid WAN IPs (not RFC1918 addresses).

I am currently not at home to try your suggested modifications but will do so as soon as I get back. Additionally, the WAN IPv4 on OPNsense is not an RFC1918 address, which, as I understand, indicates that the ISP is indeed providing a WAN IP, not a LAN IP as you mentioned. Wouldn't this suggest that the ISP is delivering a proper WAN connection?

Thanks again for your assistance!

[meyergru]

That is very strange. If you are right, this would be a setup which one would expect for a business setup, where you can get a subnet of routeable IPv4 addresses for servers as well as a router for your client devices. Given the scarce IPv4 addresses in Europe, I doubt that this is the case.

Are you sure that you get routeable IPv4 addresses? And how do you know that the gateway is the same as "with your home router"? What do you mean by that? Is there another router involved or do you have access to the ISP router web interface?

Apart from RFC1918, there are other ranges that could be "private", like CGNAT addresses starting with 100.

Whatever the case, if you cannot set a route in the ISP router, you will have to:

a. Setup outbound NAT.
b. See that the WAN interface does not block RFC1918 or bogus IPs.
c. Setup an RFC1918 range for your clients behind OpnSense.


In order to minimize the chance that your Proxmox interferes, I would also suggest trying to access the internet from your OpnSense via CLI before you try to get its LAN connected.