pfSense and meraki z3

pfsauce

@stephenw10 You're correct, thanks. I just had my port wrong. My port was 50716. I actually also found a few other ports in states, but only needed this one enabled after adding them all.

beanska

@crs162 I am struggling with this right now. Could you post your NAT rules?

stephenw10

It requires only an outbound NAT rule with static source ports set for connections from the z3.

That could be further limited to only the known destination IPs (if you know them) but it doesn't really matter since there won't be many connections from it.

https://docs.netgate.com/pfsense/en/latest/nat/outbound.html#static-port

Steve

crs162

@beanska , or however is still looking for additional info regarding my previous post.

I have two rules, and use aliases to make them apply to ranges of hosts and ports. Replace any 192.168.0.253/32 mentions with your Meraki IP (the IP exposed to Pfsense).

First I made, "Cisco Meraki host alias". This alias contains the destination IP's listed to these ports 7351/9350/9351 that you can find on this page: https://documentation.meraki.com/General_Administration/Other_Topics/Upstream_Firewall_Rules_for_Cloud_Connectivity . Make another rule "Cisco Meraki port alias" with those three ports: 7351/9350/9351.

Rule 1: Cisco Meraki ports.
Interface: WAN
Address Family: IPv4+IPv6
Protocol: UDP
Source: Network, 192.168.0.253/32, <no ports defined/blank>
Destination: Network, "Cisco Meraki host alias", "Cisco Meraki port alias"

The second rule will is specific for my company, if you need this, it will be different hosts and ports you need to use. These host addresses are publicly owned by my company and the ports used change every now and then. I've update the ports in this rule 3 times in 1 year. But how I find these ports and hosts is to do a packet capture from PFsense when I power on the Meraki and let it sit for a few minutes, before stopping the capture. Ensure your Meraki is the only device on Pfsense, and look for non response patterns in the log. Excerpt from my capture:

...
05:47:14.880183 IP 192.168.0.253.33621 > 10.214.21.30.40710: UDP, length 102
05:47:14.880188 IP 192.168.0.253.33621 > ###public IP 1###.40710: UDP, length 102
05:47:14.880233 IP 192.168.0.253.33621 > 10.215.136.10.50881: UDP, length 101
05:47:14.880348 IP 192.168.0.253.33621 > ###public IP 2###.50881: UDP, length 101
...

So, that shows we are not getting a reply from requests to these servers (on those ports). That is suspicious. So, I made a rule to allow this. Create aliases for those ports and addresses and create rule 2:

Rule 1: My Company Meraki rule
Interface: WAN
Address Family: IPv4+IPv6
Protocol: UDP
Source: Network, 192.168.0.253/32, <no ports define/blank>
Destination: Network, "My Company Meraki host alias", "My Company Meraki port alias"

This is what has worked for me for a while.

stephenw10

Those are static port outbound NAT rules?

They look more like firewall rules but those could never match any traffic on WAN.

Steve

crs162

@stephenw10 Those rules are outbound NAT rules. My NAT is set to 'Manual outbound NAT'. And yes, I should have mentioned as well that these are static.

stephenw10

Ah, that explains it then,

johnpoz

@crs162 said in pfSense and meraki z3:

My NAT is set to 'Manual outbound NAT'

Why if you don't mind me asking.. I never understand why users do this. Not saying there might not be need to do such a thing. But seems most of the time its users following some "vpn" guide that says to do that - when there really is no reason, hybrid nat works just fine for such a thing, etc.

NollipfSense

@jknott said in pfSense and meraki z3:

My cable modem is in bridge mode and I can get 2 IPv4 addresses.

This caught my attention...what modem box do you have? Does it have more than one Ethernet port? I would love to have more than one IP's. Did you pay a little more for the second IP?

crs162

@johnpoz said in pfSense and meraki z3:

never understand why users do this. Not saying there might not be need to do such a thing. But seems most of the time its users following some "vpn" guide that says to do that - when there really is no r

You are absolutely right, and that exacly what I did. I do not truly understand (hybrid) NAT or maybe most of the buttons I push in Pfsense, but I basically googled: "meraki x3 pfsense connection" and look what random people on the internet say :). I found the vendor documentation not very user friendly - then again my company does not want to deal with individual engineer that has some fancy Pfsense router. They;ll tell me to hook it up directly to my cable modem - and not use personal devices when working. If you have a suggestion, I would not mind trying a simpler better way.