OPT1 needs LAN DNS access
-
@jsmiddleton4 said in OPT1 needs LAN DNS access:
thought AP's needed Static IP.
Why would that be? The IP on the AP is only used for management of the AP.. How it gets that IP makes no difference, and its not used in any fashion where anything other than management would need to talk to that IP.
-
So you can find the AP when needing to access it for setup.
-
@jsmiddleton4 said in OPT1 needs LAN DNS access:
Did you leave the AP IP as DHCP?
I thought AP's needed Static IP.
If the AP is an AP I thought all of the stuff like DNS/DHCP was managed by the actual router. DNS/DHCP info passes from the PFSense router though the AP.
I have Asus AX86U with RMerlin's FW as an AP. But I did my PFSense LAN as a Bridge.
Glad its working of course. Just trying to connect the dots.I had changed the AP to DHCP client to test it getting the correct network settings. It gets a static IP from the pfsense DHCP server and the AP clients get their DHCP settings from pfsense as well. All are static in fact so I can keep track of what is on the networks.
-
A+B=C. The IP for the AP stays the same.
Mine is assigned a static IP of its own yet outside the DHCP range of PFSense DHCP server.
-
Yeah a real AP (acting as only an AP) is a layer 2 device, it doesn't actually need an IP at all. Though not having one is very inconvenient if you ever want to change anything.
-
I have DHCP set on all networks so that I can see new devices when they pop up. I then nab their MAC address and create a static DHCP entry.
For me, it's just a convenient way to keep track of things. If a MAC changes for some reason, like a vm rebuild for example, I just update the MAC in my DHCP static list.
-
And if you need to access the AP directly as in LAN cable to the AP. While a static IP assigned via the router gets to nearly the same place, the IP stays the same, if for some reason the router is out of the picture, good luck accessing the AP without a factory reset turning the AP back into a router.
-
@lewis said in OPT1 needs LAN DNS access:
I then nab their MAC address and create a static DHCP entry.
Yeah I pretty much do the same thing, anything on my network other then guest devices normally have a reservation..
I'm not really a big fan of the term "static dhcp" maybe I am old school, its a dhcp reservation for me ;)
Any time someone says static - what comes to my mind is setting the IP on the device directly.
-
@johnpoz said in OPT1 needs LAN DNS access:
I'm not really a big fan of the term "static dhcp" maybe I am old school, its a dhcp reservation for me ;)
Any time someone says static - what comes to my mind is setting the IP on the device directly.That is of course correct. My bad....
-
@jsmiddleton4 its not you - pfsense calls it static as well..
Its not the term is "wrong" exactly - its just it can be a bit confusing if not spelled out exactly that it was via dhcp or set on the device, etc. Especially for us old timers that grew up with the term reservation for years and years..
-
@jsmiddleton4 said in OPT1 needs LAN DNS access:
And if you need to access the AP directly as in LAN cable to the AP. While a static IP assigned via the router gets to nearly the same place, the IP stays the same, if for some reason the router is out of the picture, good luck accessing the AP without a factory reset turning the AP back into a router.
Before doing a reset, you should still be able to see the AP in the wireless list no matter its LAN IP is by using a wireless laptop. Then you could access the AP's admin page since if would be the laptops gateway IP.
-
Maybe it's a reserved static DHCP IP :).
It really is reserved but once reserved, it's outside of the DHCP pool making it static within the DHCP server LOL.
-
Giving the AP its own static IP eliminates any variables including if a DHCP server is up and running. I like eliminating variables.
-
@jsmiddleton4 said in OPT1 needs LAN DNS access:
including if a DHCP server is up and running
This is a misconception as well - dhcp server being offline doesn't stop clients from working that had already gotten a lease. It only prevents clients from getting a new IP or renewing their lease. If you have no new clients coming on to the network.
If your lease was say 4 days, worse case scenario your lease would be at 2 days when dhcp goes offline - you would have then 2 days to notice your dhcp server is offline before clients started dropping off when their lease expired ;)
Setting a reservation, or call it a static mapping you will has way more advantages then setting the IP on the device itself. You can now change options like dns,ntp, domain or gateway or even the mask or even the IP range being used without having to actually touch a client and make these changes.
With the use of reservations - I can easy change a devices IP without having to mess with it. Say its a pain in the ass on stuff like iot or printers are big example. Where you have to go through some arcane menu system using up down arrows and such on the little menu on the printer. If I want my printer IP to be something different, just change the reservation and reboot the printer - bobs your uncle its now on the new ip.
-
@johnpoz said in OPT1 needs LAN DNS access:
With the use of reservations - I can easy change a devices IP without having >to mess with it. Say its a pain in the ass on stuff like iot or printers are big >example.
Exactly and keep track of devices by Description names, MAC and IPs set via the DHCP server. It's how I manage lots of devices.
-
@lewis, I am glad that in part it is already solved, but what about this?
It says I don't want anyone to be able to get to pfsense management but it has a default rule on LAN (You have to remove it) to correct this.
@lewis said in OPT1 needs LAN DNS access:
I want to prevent opt1 and opt2 from seeing the pfsense gui.
-
That rule only passes traffic from LAN it would not allow devices on OPT1 or OPT2 to access anything.
-
@silence Oops, yes, I've removed that now. Thank you for pointing that out.
-
@lewis, a pleasure to help you, anything else you need here we are.
-
Wait now, do I have to uncheck that then or not?
I had already tested and clients from anything other than LAN could not get to pfsense.
