WAN out connection Issues

[Tetra]

I've ran into an issue setting up my personal physical network. I currently can't ping my ISP Router from my endpoint but I can ping the Opnsense WAN from the same endpoint. I believe it might be a routing issue between the WAN and ISP but I'm hopping someone could provide more input. The following is my topology for clarity:

Endpoint --> SVI --> Switch Routed interface --> Opnsense LAN --> Opnsense WAN --X--> ISP Router --> Modem

[viragomann]

Is the OPNsense WAN IP private or public?
Is the ISP routers IP private?
Can you ping the ISP router from OPNsense?

[Tetra]

The WAN IP is private and the IP on the ISP is private that I am trying to ping. I have also tried to ping the ISP's public IP but as expected no luck. I have tried to ping the ISP router from OPNsense with no luck.

[viragomann]

Does the ISP router even allow any access?
What if you connect a computer to it directly?

Do you have internet access through the router?

[Tetra]

So on the ISP I still have some of my other personal devices connected and they can ping each other and the ISP Router, but can't ping still the OPNsense WAN interface. I've confirmed that its properly pulling a IP from the router by restarting the interface. All my other devices work just fine connected the ISP router but this OPNsense WAN interface.

[Tetra]

Follow-up: For testing purposes I did some allow any firewall changes and I believe the firewall was blocking the pings from the other devices connected to my ISP router. The OPNsense WAN interface can now ping the ISP Router private not public, while other devices connected to the ISP can ping the public IP. Other devices can also ping the OPNsense WAN interface but the issue still persists where the endpoint can't ping the ISP Router(public or private).

[viragomann]

OPNsense blocks private networks on WAN by default. Also response packets to incoming access on WAN are directed to the upstream gateway (ISP router) by default.

If you want to access OPNsense from WAN or devices behind it, you have to

• remove the "Block private networks" check in the WAN interface settings,
• check "Disable reply-to" in Firewall: Settings: Advanced,
• add proper firewall rules to the WAN interface.

If you cannot ping the routers public IP from OPNsense, but other devices can, there might be still something wrong.
So we need some more details of your setup.

Is OPNsense running virtualized?

Did it get an IP from the routers DHCP?
Check Interfaces: Overview. Does the WAN show a gateway and the default router?

Also check the gateway status in System: Gateways: Configuration. Is the WAN gateway shown up as online?

[Tetra]

I have applied what you have suggested and sadly no improvements and no new ping/reachability changes. The only custom things I have done (outside of your suggestions) to OPNsense is set up DNS over TLS to cloudflare and a few other DNS servers with firewall rules. I have also created the LAN point to be a routed interface with a /30 IP. The routed interface is pointing to my cisco switch routed port. On that switch I have a DCHP service enabled and the pools give the gateway to the user their respective SVI on that switch. I don't use OPNsense for dhcp services and none of my vlans or dhcp pools are held/conflict with OPNsense. This set up is entirely physical. The WAN interface is getting a IP from the ISP router's DHCP. Both IPv4 and IPv6 gateways with proper addressing are active and online.

[lmoore]

To be able to help you more details about your set up is required.

Is your aim to move your other devices currently connecting to the ISP Router to be behind OPNsense?

Please provide information for:

Modem:
 - Does it have a management address?
 - Are you able to access it to check the device configuration?
 - Is the modem configured in Router or Bridge (Modem) mode?
 - Is the modem applying settings such as a VLAN ID for the Internet connection?
 - Other information about this devices configuration

ISP Router:
 - Does it have a management address?
 - Are you able to access it and check the device configuration?
 - Is the router capable of being configured in Bridge (Modem) mode?
 - Is there any other feature about the ISP router you will need to use after migrating devices to be behind OPNsense

Cisco Switch:
 - Is the switch connected to OPNsense's LAN network configured to operate in layer-2 or layer-3?

OPNsense:
 - routing table
 - Source NAT settings and Rules
 - LAN Rules (floating, group and interface)

I have also created the LAN point to be a routed interface with a /30 IP

This will permit only your router's IP address on the LAN and OPNsense to communicate in this network - have you considered how you will connect to OPNsense when the Cisco switch stops working?

On that switch I have a DCHP service enabled and the pools give the gateway

How many VLAN's have you configured on your Cisco switch and be more specific about the gateway addresses in DHCP?