PF Sense Setup
-
@jsmiddleton4 Thank you for the information. It really helps. I honestly didn't realize/understand PFSense was a router I just thought it was an open-source program that ppl added to the network for XYZ, I knew it was a firewall but I never thought of it as a router because it seems to do SO much more than what a normal router can do (at least it seems like it).
For 3. What I am trying to say is so currently on my ISP router/modem in LAN setup:
It has a Private LAN 192.168.x.x
Subnet mask of 255.255.255.0
LAN DHCP is enabled. The starting DHCP is 192.168.x.10 and ending is .200.
I DO have a handful of static addresses assigned w/in the LAN DHCP, that I would like to keep the same.*If I am being honest, I don't recall why it starts at .10 to .200. I know a friend of mine was helping me setup PFsense in the past and I'm thinking we set it as that so anything above .10 could be used for something else (cameras or other equipment?)...that something else IDK what because this is the part that i don't understand w/the IP addresses.
In WAN setup, Assign WAN IP manually is disabled. WAN IP address is 72.270.x.x/24 (I do not understand this 72.270.x.x IP address.) not even my wireless devices have that.....My impression is that the 72.240.x.x is the public IP that the devices display when they are posting out to the outside world, so you don't see there actual IP address (which I would think would be 192.x.x.x)
WAN DNS Server has some IP addresses in it.
Gateway Function tab, residential gateway function IS enabled (I do know that when I disable this it puts the modem/router into bridge mode and it keeps all my settings as is when I bring it back out of bridge mode)
UPNP enabled
SIP ALG enabled (idk what this is)
Wireless TAB, my ssid etc.DMZ Settings is disabled (dont understand this)
DNS is set to my pihole IP and a 2nd DNS ip.
I don't understand the IP address classes and the subnets etc. I know a little about it but I don't understand it a whole lot and I am also trying to be careful to not leave something setup incorrectly and leave me vulnerable or open to be hacked.
As you mentioned your DHCP range is 192.168.2.9-50, like why is it not 192.168.0.x?
I know that you have to be careful when assigning IP addresses classes and ranges etc. and subnets because you dont want to cause conflict and Ive read up on these things but it still is confusing to me so when I start working on something like this it helps me understand more of how things function.**Can I/ Should I mirror these settings that my LAN tab and WAN tab have?
- Yes I have another PC computer I will setup w/pf sense in the lab, which i also have some OLD Cisco switches and devices that I will plan on setting up in the lab as well, when i get to that point.
The part of all this for me is I dont know what i dont know, so i will set everything up that we've discussed in the post (and I'll share if i had issues or if i was able to get it working etc.), but that being said i can set up all of this and dont know if i left myself open on my network somewhere in the process, that is one reason why I try to share as much info etc.
- Another thing I am thinking as I write this, the time prior when I set my ISP device in bridge mode, to test I just wanted to see what would happen when I plugged in a laptop to the back of the isp device when it was in bridge mode and it came up as a public local connection...I dont know if that is a normal thing or if that isn't supposed to happen?
Was curious because does that mean someone could plug the device into the back of the ISP device in bridge mode and get out to the internet or should those ports on the back of it not work at all once its in bridge mode?
*I dont see anyone plugging anything into that device w/out me knowing but I was just curious when I saw that and i tried to look it up to see why and couldn't really find anything.
Thank you again for your help.
-
Your modem is still doing too much.
All you want it to do is get the WAN IP, IPV4/IPV6 address your ISP gives it and hand that off to the PFSense WAN port. That's all.
I use the .2 address to be different than the defaults.
Your modem needs to be dumb, dumb, dumb. You keep looking for ways to keep it smart and then how do you configure it?
Beyond setting it to pass just the WAN on to the PFSense WAN's port, you don't do anything in it. There's no answer to your "How do I configure it" questions beyond make it a dumb transparent bridge.
"I have a WAN address from the ISP. Now what?"
"Hand it off to the PFSense box."
When setup correctly you may in fact have to boot your modem and then the PFSense box. That's often how both devices know what each is going to do. The modem gets and passes along the WAN ISP IP information. The PFSense box looks for and gets that WAN IP address information being handed to it from the modem for the PFSense WAN interface.
-
About the 3020. Of course the beefing up of components not needed for PFSense.
https://www.youtube.com/watch?v=bRl5N_M9AvA
-
@jsmiddleton4 Thank you for the information/explanations. I will set it up and if I have issues, I am sure I'll add to this post w/specifics.
-
Great. My box is down at the moment. I’m upgrading some of its hardware and pulled it to do so. Back to just my Asus router for now.
-
@jsmiddleton4 Something seems off w/the WAN. Pics attached.
Here is everything I've done so far, from start to finish.
Set modem/router in Bridge mode. Plugged ISP modem into wan port on pfsense. Lan port into switch. Grabbed laptop plugged into the modem and set static IP address for the laptop.Went to pfsense IP address. In pfsense went to services, dhcp server, LAN. Checked, enable dhcp server on LAN interface. Left everything as default except changed range to a diff. range.
Hit save & Rebooted PFsense. Pic below everything seems fine but the thing that seemed off to me was the gateway saying pending and status unknown. And the fact the WAN says n/a in interfaces.
After seeing that I figured id try something, so I went to PF Sense, Interfaces, set WAN from ipv4 dhcp to none..that didn't help, it made it display no WAN -even after rebooting- pic below. So then I set it back to DHCP so it would display the pic above.
In both instances the router and modem have been rebooted and I get the same result.
After setting the WAN BACK TO Ipv4 dhcp I figured id take my laptop and plug it into the switch that the pfsense box is in to see if I could get internet and I don't get internet.
I am not sure if I did something wrong in the setup or what needs to be adjusted. I remember you said to get the WAN IP, IPV4/IPV6 address your ISP gives it and hand that off to the PFSense WAN port. In the first pic you can see it gives the WAN an IP address, so my impression was that PFsense picked up the wan IP because its plugged into the modem that is in bridge mode.
Any help is appreciated. I am only able to reply to this because I am going off of a hotspot. lol.
-
I don’t understand why you’re plugging the laptop into the modem.
Once you’ve set it to transparent bridge, not going DHCP, its out of the picture.
The variable that needs to be set for you to access the internet going through the PFSense box is in PFSense.
The WAN port from the modem to the NIC that is the WAN for PFSense. Which port on the modem is the WAN port?
Laptop into PFSense. (Or terminal mode.)
Then go back through the General Setup steps. In fact you might want to restore to defaults and then go through the Step by Step setup process.
You have no gateways? I don’t think that’s right. As noted mine is down. Someone else will have to step in.
That’s not why you don’t have IP information for your WAN though.
-
@jsmiddleton4 I am plugging the laptop into the modem because that is literally the ONLY way I can connect to my pfsense box. I tried plugging my laptop into the switch and going to the IP of the PFSense box and it wont reach it so plugging into my modem was the only way to reach the pfsense box. I even tried plugging straight into the laptop from the pfsense wan/lan port and couldn't reach it.
the only way i could connect to the pfsense box was setting my laptop up w/a static IP and connecting it to my modem that is in bridge mode.
I set WAN to bridge and that didn't do anything. It still just showed this (pic below).
I should clarify even though I am connected to the modem I don't have internet. It just has the little yellow triangle over the hardwired icon, that is even the case when plugging into the switch.
I also went to interface, wan, unchecked the 'block private network & bogon network' settings, and doing that removed the gate way option that was pictured above. so when I saw that, I went back and checked the boxes and that re-enabled the gateway setting as shown above.
-
There’s something wrong with your PFSense setup. I know, rocket scientist. Its not your modem assuming the modem is in transparent bridge mode.
PFsense should hand out DCHP lease information to the laptop, you connect by entering the IP address of the PFSense box.
The PFSense LAN port should have a statically assigned IP and a DHCP address range. That’s the IP you put in the address line in your browser.
Can you access the PFSense console via a monitor?
Those block this stuff is for the WAN.
-
Sounds like you've accidentally switched the WAN and LAN NICs.
-
Some times the time it takes to blast it and start over is WAY less than trying to figure out what’s wrong and fix it.
-
@travelmore If your putting your modem into bridge mode, you wouldn't be getting a 192.168.100 which is what I am guessing?
There is zero reason to hide 192.168 addresses..
When you set your modem in to bridge mode. Power cycle it, once it has finished booting ie all the lights are correct and it shows it has internet, then plug in and turn on pfsense with dhcp set to its wan. Even if you were double natting you would still have internet. Even if the pfsense wan was a 192.168.1.x address and overlap your lan. You would still be able to get to pfsense via lan.. Your laptop would get dhcp from pfsense and be able to connect to the gui.. So you could change the IPs so they do not overlap.
-
I'd guess it will work as expected if you just swap the cables between the NICs from what you're seeing.
Steve
-
If he can get to the console and go through the steps to assign and configure interfaces that’d eliminate a variable. Easy to do via the console menu too.
Those modems that have multiple ports easy to mistake which port is the WAN. My modem has one port so its mistake proof.
-
@johnpoz I did not get a 192.168.100.1 address when my modem was in bridge mode which really confused me because literally a few days ago I purposely put my router in bridge mode and pulled it back out of bridge mode just to know how to do it/if it would save the settings, etc.
The other day when I put my modem into bridge mode, I was able to go to 192.168.100.1 and login and reset it back out of bridge mode but tonight I couldnt get to that 192.168.100.1 IP at all no matter what i tried/rebooted which really threw me for a loop because i would have figured if anything I should be able to get that and log back in to take it out of bridge mode but that wasn't the case. I even shut pf sense box off at one point and just plugged my laptop into my modem and went to the 192.168.100.1 address to see if i could reach it and login to revert it out of bridge mode but I couldn't. Is there a specific reason why i couldn't reach the 192.168.100.1 address to revert it out of bridge mode instead of having to reset it?I'll try it again tomorrow or later this week and see. I know i rebooted my modem quiet a few times and the pf sense box a few times as well after plugging things in and verify everything was on the right port.
-
As a last resort I’d hit the reset button for your modem. Set it back to defaults.
Where did the IP address that worked come from?
That’s not the IP your ISP gives you for the WAN.
Also is your laptop network properties manually set? If your modem isn’t given out IP’s, which it shouldn’t be in bridge mode, your laptop IP could be outside the subnet so it can’t connect to the modem.
-
@jsmiddleton4 i did reset my modem and uploaded my prior configs backup so everything is working normally for work tomorrow.
the IP address that worked was a static one that I set when I was going through the initial configuration. So I set a static IP for my LAN.
the only way i could connect to the pfsense box was by setting my laptop up w/a static IP (via network settings, ipv4, setting the IP to 192.168.0.10, subnet 255.255.255.0, and gateway to 192.168.0.1 and physically connecting the cat5 cable from my laptop to my modem that is in bridge mode.
-
@stephenw10 i did try swapping the cables at one point and it didn't make a difference. i cant recall if it made it worse or not i just know it was not progress moving forward when i swapped them lol. (so then i reverted the swap to keep troubleshooting.)
-
You set the static IP for the modem?
While this can be very frustrating you should know it shouldn’t be. Its not this hard to make PFSense work as a basic router/firewall.
You set the modem to pass WAN information to the PFSense box. If configured with the initial simple settings, PFSense picks up the WAN information on its WAN port.
Are you able to access the console mode for PFSense, simple menu, etc.?
-
@jsmiddleton4 this is the back of my modem/router combo. from what i know it doesn't specify wan or lan.
it says 1 wan port on the doc but then when you look closer it says:
WAN ports: 1
WAN port(s) type: Coax F-connector
LAN ports: 4sooo technically, id take that as it doesn't have a wan port and it just uses the coax as wan and gives you 4 lan ports.
