1
Diagnostic step 1
Connect a spare laptop to the modem in bridge mode and run the same ping/traceroute tests you ran from pfSense to confirm modem bridging consistency (you already did this; note MTU and path MTU behaviour with ping -s and -M do).
FULL AI ANALYSIS
WAN link shows UP but no internet after replacing ISP modem with DHCP-bridge
Generated Oct 3, 2026, 12:35:03 AM
Analysis summary
Symptoms point to asymmetric path or upstream blocking of outbound packets despite a valid DHCP lease. Because a laptop directly on the modem can access the internet, the modem bridge appears functional. The router obtains an IP but outbound packets are not forwarded or responses are not reaching the router — common causes include MTU/MSS issues, ARP/gateway MAC confusion when modem bridging changes next-hop MACs, ISP binding the public IP to a specific MAC, or modem operating in a partial-bridge (carrier-grade NAT still active). Misconfigured firewall or floating rule on pfSense triggered by upstream changes is also possible.
Possible causes
Modem bridge implements Carrier-Grade NAT or a double-NAT when in supposed bridge mode, causing asymmetric routing back to pfSense.
50%ISP requires the modem to present the same MAC or persistent DHCP identifier; new modem/bridge got a different MAC and ISP blocks some traffic.
40%ARP table/gateway MAC mismatch: modem's MAC to the ISP differs from assumed gateway, causing pfSense to send to the wrong next hop if static ARP or stale cache present on ISP side or device chain in front of pfSense (switch).
20%MTU/MSS black hole on the new modem causing TCP connections to hang (ICMP fragmentation blocked upstream).
10%Suggested fixes
2
Diagnostic step 2
From pfSense, run packet capture (WAN) while initiating a simple TCP/ICMP test and check whether responses arrive at the interface; compare source/destination MACs and IPs to confirm return path reaches pfSense's MAC.
3
Diagnostic step 3
Temporarily set pfSense WAN to use the modem's MAC address (clone WAN MAC) to rule out ISP MAC binding.
4
Diagnostic step 4
Lower WAN MTU on pfSense (e.g. 1400) and test connectivity to detect an MSS/fragmentation issue; if that helps, narrow MTU delta and investigate whether modem or ISP blocks ICMP fragmentation-needed messages.
5
Diagnostic step 5
Enable verbose logging on modem and pfSense and coordinate with ISP support: provide packet captures showing SYNs and absent SYN-ACKs so ISP can verify return routing and any ACL/NAT behavior. Escalate to ISP if packet capture shows SYNs leaving but no replies arriving at pfSense — this usually requires ISP-side tracing.