OPT1 needs LAN DNS access

johnpoz

@lewis or maybe just use 3rd party firmware on the device?

Most of the 3rd party I have used, ddwrt, openwrt allow for putting a gateway for your lan so you can talk to it from other vlans.

But source nat is not the end of the world, and can be secured to only what you want to access the AP ip from on your lan. And is easy enough to setup.

lewis

This post is deleted!

lewis

@johnpoz Agreed but I'd like to find a real AP at this point or turn that AC1750 I have into an openwrt device that I would use as an AP. Just don't have enough time to do it all which is why I thought ebay but be a good place to find something cheap.

lewis

I finally got back to this so my apologies for not updating in a while. Lots going on all at once.

I converted that AC 1750 to an openwrt AP but I have yet to complete the gateway part of this to allow an IP from LAN to access the AP on OPT2.

I did assign a gateway on the AP and from the shell on pfsense I can ping the 192.168.254.1 (OPT2) gateway but that's about as far as I've gotten.

I have to review this thread to see what rule I need since what I tried so far has not worked.

lewis

@lewis

I really really hate to ask but I have yet to be able to reach a device on OPT2 from LAN.

Can someone please share how I would do this.
I made sure to give the AP its own IP and gateway and I added a gateway IP of 192.168.254.1 to the OPT2 DHCP server on that network.

I can ping 192.168.254.1 and .2 from the CLI on pfsense but no matter how I add the rule, I can never reach anything on OPT2 from LAN.

johnpoz

@lewis said in OPT1 needs LAN DNS access:

I can never reach anything on OPT2 from LAN.

So your opt2 interface on pfsense is what 192.168.254.1 ?

What is your lan inerface?

What are the rules on your lan - common mistake users make is setting a policy route where they force traffic out say wan or vpn gateway. This does not allow any traffic to any other pfsense networks - since your forcing traffic out some gateway, that can not get to your opt2 network.

If your pfsense lan rules are default, not setting any gateway in the rules. Which are any any.,

Then you would be able to ping 192.168.254.1 from the lan, this is the IP you set on pfsense opt2 interface (NO GATEWAY set on this interface)..

Now if you setup a client on this opt2 network, and it points to pfsense IP 192.168.254.1 as its gateway. This is default what would be handed out by pfsense dhcp server on opt2

If you set your AP with its lan IP to be say 192.168.254.2, and gateway on the AP to 192.168.254.1 you would be able to ping it from lan..

lewis

I'm definitely missing something because I can't reach anything on OPT2 yet I can reach devices on OPT1. I tried following the same rules for OPT2 but never works.

LAN is 192.168.1.1. OPT1 is 10.0.0.1 and OPT2 (192.168.254.x) is what I set up the AP on using 192.168.254.2.

These are the LAN rules.

johnpoz

@lewis well can you ping 192.168.254.1 from lan, this is the IP you set on opt2 correct.

What is the mask you set on it, it would default to /32 - you need to make sure you set it to the mask you want, most likely /24

Lets see the settings on opt2, you didn't set a gateway on it?

lewis

well can you ping 192.168.254.1 from lan, this is the IP you set on opt2 >correct.

Correct, the OPT2 was set up so I could do this whole AP thing so the wireless router is no longer dishing out DHCP and is only using the LAN port to connect to pfsense.

What is the mask you set on it, it would default to /32 - you need to
make sure you set it to the mask you want, most likely /24

Do you mean on the openwrt AP? The AP is at 192.168.254.2/24 since there is no option for a /32. From ssh on the AP, I see its' IP as above and mask 255.255.255.0. Odd that I see /24 on the interface however.

Lets see the settings on opt2, you didn't set a gateway on it?

Do you mean the DHCP server or Interfaces section?
No gateway set on the OPT2 DHCP server.

The Interfaces section does have the gateway of 192.168.254.1 with mask of /24.

lewis

I had the AP IP address static. I've made it DHCP so it picks up from pfsense instead. I still cannot ping it from LAN however.

Looking at the network on openwrt, Status, Network shows 192.168.254.2/24, gateway 192.168.254.1 and the correct DNS servers which are in fact on the LAN network.

A client connecting to the AP works fine.

lewis

I must be staring at this so hard that I'm not seeing something really small and in my face.

johnpoz

@lewis said in OPT1 needs LAN DNS access:

The Interfaces section does have the gateway of 192.168.254.1 with mask of /24.

huh? So on your opt2 interface you set a gateway, and you pointed it to itself?

You do not set gateways on pfsense local networks.. Gateways are how you get off the network - they are for wan interfaces only..

stephenw10

Did you confirm that you're able to ping 192.168.254.1 from a client on LAN?

This could be a firewall rule in OpenWRT blocking access from outside it's own subnet.

But, yes, putting a gateway on the pfSense OPT2 interface is incorrect and will introduce a number of ways it could fail.

Steve

lewis

I always thought each interface would need its own gateway to make it its own private network. OPT1 has its own gateway and that one seems to work fine. Here is how both look.

lewis

@stephenw10
My test was to ping/nmap from a client on the LAN and could not ping or see anything on 192.168.254.0/24.

I then ssh'ed into pfsense and dropped to the command line and from there am able to ping the 192.168.254.1 gateway and other devices on the same network.

stephenw10

Those interfaces look fine. They have IP addresses but not gateways defined like the WAN does.

So you cannot even ping the OPT2 interface IP (192.168.254.1) from a client on LAN?

johnpoz

@stephenw10 said in OPT1 needs LAN DNS access:

So you cannot even ping the OPT2 interface IP (192.168.254.1) from a client on LAN?

Yes this is big question.. If your client on lan is using pfsense as its gateway. And it doesn't have a mask problem where it thinks 192.168.254.1 is on its own lan - you should be able to ping it.

You sure your clients on lan are not using say a /16 mask, they would think 192.168.x is local to them and never send it to pfsense. This would allow you to talk to your opt1 network since its 10.x but no you wouldn't be able to talk to another 192.168 network through pfsense, if your not sending pfsense the traffic in the first place.

lewis

@stephenw10

Correct. Here is a test from a client on the LAN side.

# nmap -sP 192.168.254.0/24
Starting Nmap 7.70 ( https://nmap.org ) at 2021-12-27 17:43 MST
Nmap done: 256 IP addresses (0 hosts up) scanned in 10.47 seconds

# nmap -sP 10.0.0.0/24
Starting Nmap 7.70 ( https://nmap.org ) at 2021-12-27 17:44 MST
Nmap scan report for 10.0.0.1
Host is up (0.00022s latency).
Nmap scan report for 10.0.0.29
Host is up (0.00063s latency).
Nmap scan report for 10.0.0.30
Host is up (0.00051s latency).
Nmap scan report for 10.0.0.52
Host is up (0.00077s latency).
Nmap scan report for 10.0.0.211
Host is up (0.00091s latency).
Nmap scan report for 10.0.0.212
Host is up (0.0098s latency).
Nmap scan report for 10.0.0.214
Host is up (0.00056s latency).
Nmap done: 256 IP addresses (7 hosts up) scanned in 10.07 seconds

johnpoz

@lewis what is the mask on your client on lan?

ipconfig on windows

Ethernet adapter Local:

   Connection-specific DNS Suffix  . :
   IPv4 Address. . . . . . . . . . . : 192.168.9.100
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.9.253

ifconfig on linux

ens3: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.2.12  netmask 255.255.255.0  broadcast 192.168.2.255
        inet6 fe80::11:32ff:fe22:cc7d  prefixlen 64  scopeid 0x20<link>
        ether 02:11:32:22:cc:7d  txqueuelen 1000  (Ethernet)
        RX packets 13788691  bytes 7585716775 (7.5 GB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 9887749  bytes 1520893783 (1.5 GB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lewis

@johnpoz
Wait, you might have something.
Yes, the client I was testing from has a /16.
This is a test from another client with a /24.

# nmap -sP 10.0.0.0/24
Starting Nmap 6.40 ( http://nmap.org ) at 2021-12-28 08:28 MST
Nmap scan report for 10.0.0.1
Host is up (0.00023s latency).
Nmap scan report for 10.0.0.29
Host is up (0.00066s latency).
Nmap scan report for 10.0.0.30
Host is up (0.00066s latency).
Nmap scan report for 10.0.0.52
Host is up (0.00052s latency).
Nmap scan report for 10.0.0.211
Host is up (0.00062s latency).
Nmap scan report for 10.0.0.212
Host is up (0.012s latency).
Nmap scan report for 10.0.0.214
Host is up (0.00052s latency).
Nmap done: 256 IP addresses (7 hosts up) scanned in 14.86 seconds

# nmap -sP 192.168.254.0/24
Starting Nmap 6.40 ( http://nmap.org ) at 2021-12-28 08:28 MST
Nmap scan report for 192.168.254.1
Host is up (0.00029s latency).
Nmap scan report for 192.168.254.2
Host is up (0.00043s latency).
Nmap scan report for 192.168.254.10
Host is up (0.013s latency).
Nmap scan report for 192.168.254.11
Host is up (0.21s latency).
Nmap scan report for 192.168.254.16
Host is up (0.24s latency).
Nmap done: 256 IP addresses (5 hosts up) scanned in 26.94 seconds