Why this happens

When GajShield is installed in place of a previous gateway or system, the upstream Internet router may still hold an ARP entry mapping the gateway IP address to the old device's MAC address. Until that entry expires or is cleared, the router keeps trying to send traffic to hardware that is no longer there, so LAN users can't reach the Internet even though the connection itself is fine. The fix is to get the router to refresh its ARP table so it learns GajShield's MAC address.

First step: restart the Internet router

In most cases, simply restarting (power-cycling) the upstream Internet router resolves the issue. This forces the router to rebuild its ARP table from scratch, at which point it learns the correct MAC address for the GajShield appliance and traffic begins flowing again. Try this first, then have a LAN user test Internet access.

If the problem persists

If restarting the router doesn't restore access, work through the following checks.

Confirm GajShield can reach the router. From the appliance, ping the upstream router using Diagnosis > Debug Network. If the ping succeeds, GajShield has a working path to the gateway and the issue is likely between the LAN and the firewall, or in policy; if it fails, focus on the physical link, cabling, and the WAN interface configuration between GajShield and the router.

Check the basic network settings. Verify that the WAN interface IP address, subnet mask, and gateway configured on GajShield match what the connection requires, and that the LAN clients are using GajShield as their default gateway (directly or via DHCP).

Verify firewall policy. Confirm that a firewall rule permits LAN-to-Internet traffic, since by default traffic may not pass until an appropriate policy is in place.

Check DNS. If clients can reach IP addresses but websites won't load by name, the issue is DNS resolution rather than connectivity — confirm clients have a working DNS server and that DNS traffic is permitted.