New Install Problem - Not able to open websites on lan through firewall

Started by bulldog3346, October 14, 2018, 08:10:20 PM

Previous topic - Next topic
Print
Go Down Pages 1 2 3
User actions
October 22, 2018, 06:47:51 PM #15
Quote from: bulldog3346 on October 21, 2018, 11:28:56 PM
Thanks for the offer.  At the moment, I have to reinstall OpS as something seems to have gotten stomped on from the several resets to factory settings.  However, the rules I tried that did not work was LAN -> WAN allow port 80 and 443 to WAN and WAN -> to LAN allow 80 and 443 to LAN.  I did check

I am curious if reinstalling has changed anything. You should be set up now with a fresh OPNsense without any further custom rules and imho this should work for you ootb.
October 22, 2018, 06:58:58 PM #16
Quote from: Evil_Sense on October 22, 2018, 04:25:57 PM
Since it's a statefull firewall the default configuration allows to access anything from LAN (like browsing etc.).

Think of it like a normal Consumer NAT router.

To be able to access a web or mail server from outside (WAN) that resides behind the Firewall, you would need the respective ports to be forwarded (NAT forwarding).

Bulldog3346 -> Evil_Sense

Thank you, this too was helpful.  You may have opened the door of understanding.

Frank

October 23, 2018, 06:10:24 PM #17
[quote author=Fatmouse69 link=topic=9947.msg45825#msg45825 date=154022687

I am curious if reinstalling has changed anything. You should be set up now with a fresh OPNsense without any further custom rules and imho this should work for you ootb.
[/quote]

Unfortunately, same result, ping by name works, http,https no go.  Gonna try again shortly.

Frank
October 23, 2018, 06:30:21 PM #18
I think we need start one step back ....

Can you provide a drawing of your network config, what is connected to what and IP network addresses you have used on your interfaces, modem, client, ....

Br br
October 24, 2018, 07:02:04 PM #19
Quote from: bringha on October 23, 2018, 06:30:21 PM
I think we need start one step back ....

Can you provide a drawing of your network config, what is connected to what and IP network addresses you have used on your interfaces, modem, client, ....

Br br

Here is a diagram of my network, it's pretty basic as you can see.

Frank
October 24, 2018, 07:20:00 PM #20
Could you try to attach your test device directly to the OPNsense Firewall to rule out the cisco switch?
October 24, 2018, 07:47:14 PM #21
... and before: What is the network address in the WAN DHCP network ....

Br br
October 24, 2018, 07:57:16 PM #22
Quote from: bringha on October 24, 2018, 07:47:14 PM
... and before: What is the network address in the WAN DHCP network ....

Br br

WAN DHCP gets various addresses e.g., 24.x.x.x, 69.x.x.x 75.x.x.x so can't give you a specific one
October 25, 2018, 04:12:43 AM #23
you can also do a very basic check at the opnsense firewall itself. Ssh into it, go to the shell and enter
Code Select
curl https://google.com. When you get that response:
Code Select
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>301 Moved</TITLE></HEAD><BODY>
<H1>301 Moved</H1>
The document has moved
<A HREF="https://www.google.com/">here</A>.
</BODY></HTML> the Wan side of your firewall is working. The next step then should be to eliminate  all other hardware between the firewall and your test device as already suggested.
October 25, 2018, 08:01:23 AM #24
Quote
WAN DHCP gets various addresses e.g., 24.x.x.x, 69.x.x.x 75.x.x.x so can't give you a specific one
Just to be clear: The WAN Port of your opnsense gets an address out of one of these networks?

Br br
October 25, 2018, 05:02:57 PM #25
Quote from: bringha on October 25, 2018, 08:01:23 AM
Quote
WAN DHCP gets various addresses e.g., 24.x.x.x, 69.x.x.x 75.x.x.x so can't give you a specific one
Just to be clear: The WAN Port of your opnsense gets an address out of one of these networks?

Br br

Yes, that is correct.
October 25, 2018, 05:31:57 PM #26
Quote from: bringha on October 25, 2018, 08:01:23 AM
Quote
WAN DHCP gets various addresses e.g., 24.x.x.x, 69.x.x.x 75.x.x.x so can't give you a specific one
Just to be clear: The WAN Port of your opnsense gets an address out of one of these networks?

Br br

For example, the current IPCop's WAN address is: 75.128.246.112/23
October 25, 2018, 07:30:46 PM #27
Next, please check whether you have under System->routes all the routes you require to get traffic at the right places

Then, please check whether your DNS is configured correctly and is accessible from the clients

All that as suggested by others with ONE client directly connected to the LAN interfaces of the sense ....

Br br
October 26, 2018, 03:11:59 AM #28
Quote from: emwe on October 25, 2018, 04:12:43 AM
you can also do a very basic check at the opnsense firewall itself. Ssh into it, go to the shell and enter
Code Select
curl https://google.com. When you get that response:
Code Select
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>301 Moved</TITLE></HEAD><BODY>
<H1>301 Moved</H1>
The document has moved
<A HREF="https://www.google.com/">here</A>.
</BODY></HTML> the Wan side of your firewall is working. The next step then should be to eliminate  all other hardware between the firewall and your test device as already suggested.

I tried a re-install today.  I didn't directly connect my test client to the firewall, I'll try that tomorrow.  However, I was able to successfully do the above test from the Ops server.  However, I was not able to ping clients on LAN.  Nor, was I able to open the Web GUI from a test client on the LAN.  I must be doing something wrong when configuring the LAN interface from the menu.  When ask to give the address of the gateway for the WAN, I entered the ip address of the LAN interface, I then answered no to the question to use the LAN gateway address for DNS.  Are these responses correct?  Why am I not able to ping the LAN from the Server, or ping the server from a LAN client now?   I will try to connect a client directly to the Ops server tomorrow.  I will not be defeated!!
October 26, 2018, 08:22:33 AM #29 Last Edit: October 26, 2018, 08:24:12 AM by Fatmouse69
Hi bulldog,
Quote
When ask to give the address of the gateway for the WAN, I entered the ip address of the LAN interface (...)
the gateway of your OPNsense WAN interface should not be its LAN interface. When you only have one WAN interface then set this option to Auto-detect (default).
Quote
(...) I then answered no to the question to use the LAN gateway address for DNS.
Imho this should be set to yes, if you want your OPNsense to act as a DNS forwarder/responder.
What DNS settings do you have set under System > Settings > General?

Kind regards, David
Print
Go Up Pages 1 2 3
User actions