Trouble in multi-hop routing environment with non-directly connected devices receiving web access

Question

I could really use some help getting the devices (Including the routers) which sit behind Router2 eth0/0 to access the web.

The following is a brief overview of the my network topology:

The current configuration is as such:

• All routers (including pfSense) are participating in OSPF
• pFsense is connected directly to the WAN
• pFsense is configured with 3 VLANs (VLAN 11, 12, 13)
• Router 2, Router 2 are sitting on VLAN13 (192.168.13.x)

At present:

• Router 2 is capable of contacting pfSense WAN, and capable of pining outside addresses
• pfSense and Router 2 are capable of pinging any and all devices behind Router 1

Now, here is the issue:

• Router 1 can ping the WAN port on pfSense
• Router 1 CANNOT ping anything beyond the WAN port.

The following briefly shows the configuration of Router2 and Router1

Router2:

interface GigabitEthernet0/0
 description PrimaryWANDesc_
 ip address 192.168.200.5 255.255.255.252
 ip virtual-reassembly in
 duplex auto
 speed auto
!
interface GigabitEthernet0/1
 ip address 192.168.30.150 255.255.255.0
 duplex auto
 speed auto
!         
router ospf 10
 network 150.10.90.0 0.0.0.255 area 0
 network 192.168.13.0 0.0.0.255 area 0
 network 192.168.200.4 0.0.0.3 area 0
!         
ip forward-protocol nd
!         
ip http server
no ip http secure-server
!         
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1 192.168.13.1 110

Router 1:

interface GigabitEthernet0/0
 ip address 192.168.200.6 255.255.255.252
 ip virtual-reassembly in
 duplex auto
 speed auto
!         
interface GigabitEthernet0/1
 ip address 192.168.24.254 255.255.255.0
 ip virtual-reassembly in
 duplex auto
 speed auto
!         
router ospf 10
 network 192.168.200.4 0.0.0.3 area 0
 network 192.168.24.0 0.0.0.255 area 0
!         
ip forward-protocol nd
!         
no ip http server
no ip http secure-server

Packet Captures from pinging the outside (beyond the WAN connection on pfSense)

Router 2 ping:

16:07:33.194621 IP 192.168.13.150 > 150.10.90.1: ICMP echo request, id 20, seq 0, length 80
16:07:33.195461 IP 150.10.90.1 > 192.168.13.150: ICMP echo reply, id 20, seq 0, length 80
16:07:33.195888 IP 192.168.13.150 > 150.10.90.1: ICMP echo request, id 20, seq 1, length 80
16:07:33.196636 IP 150.10.90.1 > 192.168.13.150: ICMP echo reply, id 20, seq 1, length 80
16:07:33.196964 IP 192.168.13.150 > 150.10.90.1: ICMP echo request, id 20, seq 2, length 80
16:07:33.197753 IP 150.10.90.1 > 192.168.13.150: ICMP echo reply, id 20, seq 2, length 80
16:07:33.198081 IP 192.168.13.150 > 150.10.90.1: ICMP echo request, id 20, seq 3, length 80
16:07:33.199293 IP 150.10.90.1 > 192.168.13.150: ICMP echo reply, id 20, seq 3, length 80
16:07:33.199622 IP 192.168.13.150 > 150.10.90.1: ICMP echo request, id 20, seq 4, length 80
16:07:33.200359 IP 150.10.90.1 > 192.168.13.150: ICMP echo reply, id 20, seq 4, length 80

Router 1 ping:

16:07:37.586067 IP 192.168.200.6 > 150.10.90.1: ICMP echo request, id 190, seq 0, length 80
16:07:39.584913 IP 192.168.200.6 > 150.10.90.1: ICMP echo request, id 190, seq 1, length 80
16:07:41.584978 IP 192.168.200.6 > 150.10.90.1: ICMP echo request, id 190, seq 2, length 80
16:07:43.584984 IP 192.168.200.6 > 150.10.90.1: ICMP echo request, id 190, seq 3, length 80
16:07:45.584962 IP 192.168.200.6 > 150.10.90.1: ICMP echo request, id 190, seq 4, length 80

Please let me know if I can provide any more information if it will aid in helping address this issue.
Thank you again!

Update:

I have gone back and placed the following configuration into the firewall:

- zebra.conf

 !
    password password
    log syslog
    !

- ospfd.conf

!
password password
log syslog
interface bce0
interface em0


router ospf
  ospf router-id 150.10.90.1
  log-adjacency-changes detail
  network 150.10.90.0/23 area 0.0.0.0
  network 192.168.50.0/24 area 0.0.0.0
  default-information originate always
!

---

The OSPF Database of the routers are as follows:

• Router 2:

  OSPF Router with ID (192.168.31.254) (Process ID 10)

                  Router Link States (Area 0)
  
  Link ID         ADV Router      Age         Seq#       Checksum Link count
  150.10.90.1     150.10.90.1     459         0x80000020 0x007FB6 2
  192.168.31.254  192.168.31.254  852         0x8000001E 0x0027FB 2
  192.168.225.254 192.168.225.254 344         0x800001BC 0x00E92C 2
  
                  Net Link States (Area 0)
  
  Link ID         ADV Router      Age         Seq#       Checksum
  192.168.13.115  192.168.31.254  852         0x80000001 0x009262
  192.168.200.6   192.168.225.254 607         0x8000000E 0x00D902
  
                  Type-5 AS External Link States
  
  Link ID         ADV Router      Age         Seq#       Checksum Tag
  0.0.0.0         150.10.90.1     494         0x80000002 0x008642 0
  

Router 1:

OSPF Router with ID (192.168.225.254) (Process ID 10)

                Router Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum Link count
150.10.90.1     150.10.90.1     577         0x80000020 0x007FB6 2
192.168.31.254  192.168.31.254  970         0x8000001E 0x0027FB 2
192.168.225.254 192.168.225.254 461         0x800001BC 0x00E92C 2

                Net Link States (Area 0)

Link ID         ADV Router      Age         Seq#       Checksum
192.168.13.115  192.168.31.254  970         0x80000001 0x009262
192.168.200.6   192.168.225.254 724         0x8000000E 0x00D902

                Type-5 AS External Link States

Link ID         ADV Router      Age         Seq#       Checksum Tag
0.0.0.0         150.10.90.1     612         0x80000002 0x008642 0 

Answer 1

You are creating a default route on Router 2, but you are not originating it in OSPF, so it doesn't get sent to Router 1. You can originate it on Router 2, set a default route on Router 1, or, better yet, originate it on the firewall so that it gets into OSPF from there (you can then eliminate it on Router 2). Originating it in Router 2 could be problematic because your firewall is now participating in OSPF.

Since Router 1 doesn't have a default route (either specifically configured, or from a routing protocol), it has no route to anything on the Internet, so the router will drop traffic to routes it doesn't have in its routing table.

FYI:

You seem to want all your interfaces on each router to participate in OSPF. You can do this with a single network statement:

network 0.0.0.0 255.255.255.255 area 0

Doing it that way will put the networks from every interface into OSPF, and it will try to connect neighbors on all the interfaces. This will save you from needing to add network statement every time you bring up a new interface. If you have any interfaces on which you don't want to try to form neighbors, you can use the passive-interface <interface> command to still use the interface's network, but not send hellos on the interface. You probably want to do this with the WAN interface since you don't want the ISP to neighbor with your network.