OPT1 needs LAN DNS access
-
@johnpoz I was just reading this as you responded.
https://docs.netgate.com/pfsense/en/latest/interfaces/wanvslan.htmlI've removed the gateways from the DHCP servers.
I checked the AP (which is 192.168.254.2 on opt2) and it does not have a gateway. It does have a static route option where I could add the gateway.
All devices on opt1 seem to have a proper gateway.
-
If you can add a static route to the AP so it knows how to reach the LAN then it will be able to reply to the LAN client when it tries to access it.
Otherwise it may only be accessible from hosts in it;s own subnet. You can work around that with outbound NAT but it's better not to.
Steve
-
@lewis route prob not going to work.. Maybe - would depend on the soho software, but I doubt it.
But what you can do is just source nat your traffic so that the AP thinks when your coming from your lan, that you are actually the IP address of pfsense on your AP network. So the AP just thinks your some device on its local network talking to it.
This is done via the outbound nat.. I have gone over it multiple times over the years - lets see if I can dig up one of the old threads.
edit: Here you go - went over it back in 2019, put up pretty pictures and everything ;)
https://forum.netgate.com/post/868337 -
Wait now, this will get all confused soon :).
Let me explain what I'm up to first as a reminder.I already have a setup and it's mostly working. I've tested from remote as well and can see what I need to see from specific remote locations and see nothing from others that should see nothing.
Each network is isolated at the moment, where each has Internet access but no access to each other. This is where I'd like to be but some things aren't working so I don't want to go changing everything to start over unless I really messed something up.I have lan, opt1 and opt2.
I want those networks to be isolated so that I can use pfsense rules to allow specific traffic between the networks. All networks should have Internet access and I have some rules to allow incoming to specific networks.I want opt1 and opt2 to be allowed to use the two DNS servers on the LAN, ports 53 tcp/udp only.
I want LAN to have access to the AP device (192.168.254.2) on opt2.
I want to prevent opt1 and opt2 from seeing the pfsense gui.I don't want to do anything fancy or complicated, just want to better understand what I'm doing but see so many recipes/methods that it's hard to learn from them since they aren't always the same.
-
@stephenw10 said in OPT1 needs LAN DNS access:
If you can add a static route to the AP so it knows how to reach the LAN then it will be able to reply to the LAN client when it tries to access it.
Otherwise it may only be accessible from hosts in it;s own subnet. You can work around that with outbound NAT but it's better not to.
Steve
Correct, that's what is happening now. Only devices on that network are able to reach the ap but they also reach its management page which I'd like to prevent.
I looked at the ap and those static options don't seem to be for the LAN ports but still looking.I can add a static route, destination network, mask, gateway and that's it.
-
@lewis said in OPT1 needs LAN DNS access:
I want LAN to have access to the AP device (192.168.254.2) on opt2.
That rule would go on the lan, above any rule that prevents access to your other networks/rfc1918
But if your AP doesn't know how to get back to your lan network, ie no gateway. Then you need to be able to give it a gateway, or if static route work - not sure if will because don't think it uses that for traffic from its lan interface. Or you would need to do the source natting I showed in that other thread. You can for sure limit that to specific IPs on your lan you want to do that for and specific destination. Still need a rule on lan to allow it.
To block access to firewall IPs from any vlan/network just use the "this firewall" alias - this is built in alias that includes all IPs of pfsense, even the wan. So this is great for preventing access to the web gui where rules allow any for internet, since the wan IP is normally public and would be allowed via an internet allowing rule of any. And the alias will update if your wan rule changes, or you change or add any other pfsense IPs, etc.
also reach its management page which I'd like to prevent.
As to access to AP gui from devices on the same network as AP.. yeah good luck with that - most soho devices have no way to prevent that.. But they normally allow blocking wifi access to the gui, so that would limit it to only wired devices on that same network your AP is on.
-
Yes, that's why it's not working. I had put the rule above the block but nothing. Looking at the wifi device, there is no way to add a gateway on the LAN side, only the WAN.
My only option would be to find another wifi device I can use so I can avoid source natting.I do have a bunch of wireless hardware and some embedded PC's with wifi if I used the right OS. Maybe I can turn one into an AP or off to eBay.
-
@lewis or maybe just use 3rd party firmware on the device?
Most of the 3rd party I have used, ddwrt, openwrt allow for putting a gateway for your lan so you can talk to it from other vlans.
But source nat is not the end of the world, and can be secured to only what you want to access the AP ip from on your lan. And is easy enough to setup.
-
This post is deleted! -
@johnpoz Agreed but I'd like to find a real AP at this point or turn that AC1750 I have into an openwrt device that I would use as an AP. Just don't have enough time to do it all which is why I thought ebay but be a good place to find something cheap.
-
I finally got back to this so my apologies for not updating in a while. Lots going on all at once.
I converted that AC 1750 to an openwrt AP but I have yet to complete the gateway part of this to allow an IP from LAN to access the AP on OPT2.
I did assign a gateway on the AP and from the shell on pfsense I can ping the 192.168.254.1 (OPT2) gateway but that's about as far as I've gotten.
I have to review this thread to see what rule I need since what I tried so far has not worked.
-
I really really hate to ask but I have yet to be able to reach a device on OPT2 from LAN.
Can someone please share how I would do this.
I made sure to give the AP its own IP and gateway and I added a gateway IP of 192.168.254.1 to the OPT2 DHCP server on that network.I can ping 192.168.254.1 and .2 from the CLI on pfsense but no matter how I add the rule, I can never reach anything on OPT2 from LAN.
-
@lewis said in OPT1 needs LAN DNS access:
I can never reach anything on OPT2 from LAN.
So your opt2 interface on pfsense is what 192.168.254.1 ?
What is your lan inerface?
What are the rules on your lan - common mistake users make is setting a policy route where they force traffic out say wan or vpn gateway. This does not allow any traffic to any other pfsense networks - since your forcing traffic out some gateway, that can not get to your opt2 network.
If your pfsense lan rules are default, not setting any gateway in the rules. Which are any any.,
Then you would be able to ping 192.168.254.1 from the lan, this is the IP you set on pfsense opt2 interface (NO GATEWAY set on this interface)..
Now if you setup a client on this opt2 network, and it points to pfsense IP 192.168.254.1 as its gateway. This is default what would be handed out by pfsense dhcp server on opt2
If you set your AP with its lan IP to be say 192.168.254.2, and gateway on the AP to 192.168.254.1 you would be able to ping it from lan..
-
I'm definitely missing something because I can't reach anything on OPT2 yet I can reach devices on OPT1. I tried following the same rules for OPT2 but never works.
LAN is 192.168.1.1. OPT1 is 10.0.0.1 and OPT2 (192.168.254.x) is what I set up the AP on using 192.168.254.2.
These are the LAN rules.
-
@lewis well can you ping 192.168.254.1 from lan, this is the IP you set on opt2 correct.
What is the mask you set on it, it would default to /32 - you need to make sure you set it to the mask you want, most likely /24
Lets see the settings on opt2, you didn't set a gateway on it?
-
well can you ping 192.168.254.1 from lan, this is the IP you set on opt2 >correct.
Correct, the OPT2 was set up so I could do this whole AP thing so the wireless router is no longer dishing out DHCP and is only using the LAN port to connect to pfsense.
What is the mask you set on it, it would default to /32 - you need to
make sure you set it to the mask you want, most likely /24Do you mean on the openwrt AP? The AP is at 192.168.254.2/24 since there is no option for a /32. From ssh on the AP, I see its' IP as above and mask 255.255.255.0. Odd that I see /24 on the interface however.
Lets see the settings on opt2, you didn't set a gateway on it?
Do you mean the DHCP server or Interfaces section?
No gateway set on the OPT2 DHCP server.The Interfaces section does have the gateway of 192.168.254.1 with mask of /24.
-
I had the AP IP address static. I've made it DHCP so it picks up from pfsense instead. I still cannot ping it from LAN however.
Looking at the network on openwrt, Status, Network shows 192.168.254.2/24, gateway 192.168.254.1 and the correct DNS servers which are in fact on the LAN network.
A client connecting to the AP works fine.
-
I must be staring at this so hard that I'm not seeing something really small and in my face.
-
@lewis said in OPT1 needs LAN DNS access:
The Interfaces section does have the gateway of 192.168.254.1 with mask of /24.
huh? So on your opt2 interface you set a gateway, and you pointed it to itself?
You do not set gateways on pfsense local networks.. Gateways are how you get off the network - they are for wan interfaces only..
-
Did you confirm that you're able to ping 192.168.254.1 from a client on LAN?
This could be a firewall rule in OpenWRT blocking access from outside it's own subnet.
But, yes, putting a gateway on the pfSense OPT2 interface is incorrect and will introduce a number of ways it could fail.
Steve
