First time OPNsense setup - potential NAT problem?

[daveMar]

Hi,
I am a OPNsense first-timer trying to setup an OPNsense firewall in an apartment house with 5 parties sharing the same internet connection. The goal was to establish separated networks for each party as well as separate house automation devices and shared infrastructure (printer, NAS) to be able to limit access for certain parties.
I purchased a Protectli Vault Pro VP2440, fitted it with 128GB SSD and 8GB DDR5 memory and installed OPNsense. Configured VLANs (connected via SFP+ to switch) and WAN port via the first ethernet port (DHCP). The second ethernet port was configured for debugging in case the VLANs do not work. I've put in firewall rules for all VLAN networks to let traffic PASS to all networks (for now). NAT was enabled automatically as the second ethernet port was configured as "LAN".

This configuration works until it suddenly appears to be loosing packets. Websites no longer open, DNS does no longer resolve. The websites don't open for a few seconds/refreshes, after that it works again for a bit before it fails again. If I restart the firewall, it temporarily resolves the issue until it comes back. I've found out that resetting the "states" also resolves the issue, just like the restart. I've run Wireshark from my Windows PC and also done a packet capture from the WAN interface of OPNsense to get some more information on what is going on.

The main thing I could find out so far (with my limited knowledge) is that there are TCP packet retransmissions for SYN packets on OPNsense WAN port. It's not a general internet outage, other parallel connections continue to work smoothly (i.e. parallel video call). However I don't think TCP is the only issue. I am also seeing DNS timeouts when using public nameservers (1.1.1.1). For me it looks like the NAT port is opened when the request from LAN network is received, but is closed before any answer from WAN is received - retransmissions fail just as the first transmission. In the firewall sessions table I believe to have identified the outgoing ports in status CLOSED:SYN_SENT when this happens, but as the interface does not refresh that fast it could also be after the retransmissions. I have seen the problem appear both via the VLAN configuration as well as my "debug" port.

I am a bit clueless as I would not expect the NAT to need specific configuration, however as I said it's my first configuring an OPNsense firewall.

I had to revert the network setup a bit again to have the ISP router no longer "bridge" the public IP to my device but build a private network to enable internet connection again. But the OPNsense is running behind that and still producing the same issue.

Any help is very much appreciated, let me know what information I can provide.
Thank you all very much!