WAN Static IP Breaks LAN Internet Access

[wiring8228]

Problem Description:
Internet connectivity fails for all LAN clients when the OPNsense WAN interface is configured with a static IPv4 address, despite working correctly when set to DHCP.

Expected Behavior:
LAN clients should have full internet access regardless of whether WAN uses DHCP or static IP configuration.

Actual Behavior:

• With WAN on DHCP: LAN clients can browse websites without issues
• With WAN on Static IPv4: LAN clients cannot load any websites (browser shows ERR_TIMED_OUT)

Reproduction Steps:
1. Perform fresh OPNsense 26.7.1 installation
2. Complete the OPNsense Setup Wizard with the following settings:

General Information

• Hostname: OPNsense
• Domain: internal
• Override DNS: ❌ disabled

DNS [Unbound]

• Enable Resolver: ✅
• Enable DNSSEC Support: ✅
• Harden DNSSEC data: ✅

Network [WAN]

• Type: Static
• IP Address: 192.168.2.2/24
• Gateway: 192.168.2.1
• Block RFC1918 Private Networks: ❌ disabled
• Block bogon networks: ✅ enabled

Network [LAN]

• IP Address: 192.168.10.1/24
• Configure DHCP server: ✅ enabled

Deployment type

• Automatic DHCP/DNS registration: ✅ enabled

Post-Wizard Changes

3. Configure Unbound DNS over TLS via Mullvad with the following forwarding servers:

| Server IP | Server Port | Description |
|-----------|-------------|-------------|
| 194.242.2.6 | 853 | Mullvad Family |
| 2a07:e340::6 | 853 | Mullvad Family |

4. From any LAN client, attempt to open a website or ping external addresses → ERR_TIMED_OUT

Relevant System Information:

Network Topology:
├── Upstream Device: tp-link Archer MR200
│  └── IP: 192.168.2.1
├── OPNsense WAN Interface
│  ├── IP: 192.168.2.2/24 (Static)
│  └── Gateway: 192.168.2.1
├── OPNsense LAN Interface
    └── IP: 192.168.10.1/24

OPNsense Diagnostic Results:

• Ping to 192.168.2.1: SUCCESS
• Ping to 1.1.1.1: SUCCESS
• Ping to google.com: SUCCESS

LAN Client Diagnostics:

• Ping to 192.168.10.1: SUCCESS
• Ping to 1.1.1.1: TIME OUT
• Ping to google.com: TIME OUT
• Website access to google.com: ERR_TIMED_OUT

Error Messages:
Browser Error: ERR_TIMED_OUT

Ping Test Failure (LAN Clients): ping 1.1.1.1 → Request timed out

Note: OPNsense itself has full internet access and can reach external hosts. The problem exclusively affects traffic originating from LAN clients.

What I've Tried:
| Setting | Action Taken | Result |
|---------|--------------|--------|
| Source NAT | Changed from Automatic to Hybrid mode | No change |
| Routes | Verified default route exists (Flag UGS active) | Route confirmed correct |
| Interfaces | Switched WAN from Static to DHCP | ✅ Problem resolved - internet access restored fo rall LAN clients |
| Gateways | Verified WAN Gateway (192.168.2.1) is set as upstream gateway | Confirmed correct |

Off-topic: Manually converting this text, which was originally written in Markdown, was quite a hassle. Are there any better tools I could use for this?

[Patrick M. Hausen]

When configuring WAN manually did you create the gateway in System > Gateways and mark it as "upstream" gateway? Only then will the automatic outbound NAT rule creation work and your clients have Internet access.

In the case of DHCP for WAN this happens automatically.

[wiring8228]

Thanks for the quick reply.

I see two gateways, one named WAN_GW, which is configured as the upstream gateway to IP address 192.168.2.1.

I had already checked that earlier but unfortunately forgot to mention it. I'll add that to the post above right away.

[wiring8228]

Out of curiosity, I used the wizard to reconfigure the WAN interface to use DHCP and connected the OPNsense to a different network. This network includes several other devices with static IP addresses, which have not experienced any problems so far. As usual, everything works fine when the WAN is set to DHCP. However, when I switched the WAN to static, I encountered the same problem.

As an additional test, I disabled the DoT entries in Unbound, checked the box to use the system nameservers and set them to 1.1.1.1 for testing purposes.

However, this did not resolve the issue. The problem described in the first post persists: OPNsense can access the internet, but the devices on the LAN cannot.

[meyergru]

You can also try to create a manual outbound NAT rule and use "Hybrid" NAT mode.

It is almost sure that you need NAT on OpnSense for this to work because your front router does not know the route to 192.168.10.1/24.