PF Sense Setup
-
Yeah interesting. Using the wifi when it's in bridge mode is kind of undefined. You might check what public IP wifi clients end up using. It's probably going to be the same IP pfSense is using as a gateway.
@travelmore said in PF Sense Setup:
Now my question is...how do I get my wireless devices to communicate w/my hard-wired devices & vice versa?
Both those things are going to be difficult to impossible because there is no route between them. Using a separate access point connected to pfSense is going to be much easier if you can.
Steve
-
WiFi modes: Access point
It list AP as possible in the documents. Still digging.
Seems it would need another network cable from PFSense to Port 1-3 however.
-
@stephenw10 said in PF Sense Setup:
Using the wifi when it's in bridge mode is kind of undefined
This.. As mentioned what IP is your wifi client getting.. Does this gateway device also provide nat to your wifi devices while your getting public IP on pfsense, etc.
The better setup is to forget doing anything on that isp device other than providing pfsense internet and public IP. And put all of your devices behind pfsense, be wired or wireless (via AP)..
-
Residential Gateway Setting?
We did so many things I want to double check, this should be Disabled.
While you're there, disable UPNP as well.
When you Save, if you have to change them, the modem will boot.
The documents are confusing as some refer to IP Passthrough as if that's bridged mode, others refer to Disable Gateway as if that's bridge mode.
Also that may change your WAN port on the modem from 4 to 1. This from support site for the modem and doing what you're doing, using the modem as just a modem.
1st: Disable wireless
2nd: Disable Residential Gateway and UPnP.
3rd: Modem will reboot and you will be in bridged mode.
4th: Plug router in Lan1.
It could be IP Passthrough keeps the Hitron in play with its wireless, DHCP, etc., which is why wireless clients are connecting to the Internet but not the PFSense router.
Disabling Residential Gateway makes it JUST a modem.
So both work but not exactly the same way.
It might be a good thing to keep the wireless in play. You'd have a wireless AP. Some one with more insight could explain how you'd create a gateway and a firewall rule in PFSense to let the wireless clients connect to the modem AND be passed through the PFSense router/firewall to be able to connect to its wired clients.
That is doable. Thinking it'd be a WAN gateway/firewall matter.
I wonder if the 3 other Ethernet ports on the modem are still working as well as the wireless?
-
"The CGNVM is the access point, and the computers you connect to the CGNVM are wireless clients."
There's no way I've found to make it a stand alone wireless access point. The documents uses the term, access point, to refer to it being all things to all networks.
-
Just so you have an idea what a stand alone wireless access point looks like and would do, cost as well.
Stand alone wifi6 access point plus its also a ethernet switch. 70 bucks.
https://www.amazon.com/TP-Link-Wireless-AX1500-Wifi-Router/dp/B07ZSDR49S/ref=sr_1_18?crid=2JQRDYED76PPY&keywords=wifi%2B6%2Bwireless%2Baccess%2Bpoints&qid=1641397369&sprefix=wifi%2B6%2Bwireless%2Baccess%2Bpoints%2Caps%2C79&sr=8-18&th=1
-
Sorry I kind of puked on the page here but I have to go. Wanted to get everything I found posted. I'll check back later this afternoon or early evening.
-
Spent the day updating my Dell 390. Was wondering how travel is doing…..
-
@jsmiddleton4 Hello, I appreciate all the information and help as always. No worries about puking on the page lol it takes me a day or two before I am able to get back on and reply or do any troubleshooting and update you. I’ll address all of your posts from the other day in one response. I have not made any changes since setting the modem in IP Passthrough mode a few days ago when I stated I got everything working.
First to share the CURRENT settings on my modem, it is ONLY in IP Passthough mode (pic below)
I did notice something interesting since my modem has been in IP Passthrough mode. Below is a picture of what my devices would normally look like without being in IP Passthrough mode and having it just the normal router/modem setup…notice the Interface column where it lists Ethernet, MoCA, and Wifi. The device titled HT-EMN2 is the wifi range extender.
After putting my modem in passthrough mode (and it currently still is), it turns almost all devices into MoCA except for a cell phone (blacked out). I have the option to disable MoCA, which I think MoCA is part of the wireless but actually the coax part in reality because the settings page lists MoCA, then it says Coax (pic below of part of the settings)
All the devices in the below screen shot display all the devices as MoCA now. Don’t know if that’s anything but I figured more information and screen shots the better.
To add to this, one thing I didn’t think of /realize until now is I have 5 cat5 cables ran into the modem/router because it was being used to hardwire other devices that needed to be hard wired…which now I don’t know how I would get those back to being hardwired…unless I use a switch and connect it to the switch that has the pf sense box (which that is do-able, just means I have to run a cable(s) and/ or provision an old router into a switch)You asked if the modem still had internet access on the other ports if I plugged anything into it, so I did just that. I grabbed my laptop and plugged it one of the open ports on the back of the modem and I get internet BUT I can’t connect to my pfsense box or my pihole that are physically connected (modem pfsense switchpihole)…..when I tried to ping either of those boxes it says destination host unreachable. Which I am betting I am unable to reach them because it would make my laptop be technically in front of the pf sense at that point.
The wifi I noticed today still says Internet may not be available at different points, I am wondering if its now because too many devices or if its something im unaware of that is causing it because it never stated that until I started this project (which I am fine w/it I understand it’s a project and its not fully done yet, it’s a bug that needs to be fixed).
I do have some UNIFI APs but they were part of that group of cat5 cables that plugged into the modem (to connect to the POE Switch).If I make the changes you suggested (below), do I take this out of IP Passthrough mode or keep it in IP Passthrough mode?
1st: Disable wireless
2nd: Disable Residential Gateway and UPnP.
3rd: Modem will reboot and you will be in bridged mode.
4th: Plug router in Lan1
Let me know if you think I should make the changes you mentioned above or if I should do something else after sharing this update.
Again, thanks man for your help I really appreciate it. -
You probably don’t need MoCA mode. That’s for using coax cable like old network runs, some times cable boxes can do MoCA but very rarely ever setup that way. Plus devices you connect to via a MoCA connection have to also be MoCA able.
Its not impacting your PFSense setup. Just saying…..
Based on sorting through the information on your modem I’d say you want to switch so the setup is the four steps. It should over write your previous settings. Which means plug into LAN 1.
Having said that, while I was just speculating I do think there’s a way you can keep the modem as a wireless access point so you don’t need to buy one. That would mean keeping your modem setup just the way it is, IP Passthrough, Wireless still active. The DHCP pool you’d setup in the modem would have to be different than the DHCP pool in the PFSense box. IP Passthrough keeps the wifi, dhcp server, etc., all active in the modem. Which is what your screen captures show.
You’d have to create the relevant gateway/firewall rules for the IP address ranges you’ve setup in the MODEM to pass through the PFSense box.
Setting the gateway/firewall rules to do so not something I’ve done or learned. In other words one of the other helpful folks would have to assist. What I do know is it would only take a couple and it would not be complicated. They’d be on the WAN in the PFSense box. They’d have to be setup so ONLY the wireless devices connecting to the modem are able to get through the firewall. All your clients could talk to each other.
Not having the gateway/firewall rules to let clients hanging off the modem in place in the PFSense box is why you can’t connect “modem” clients to anything connected to the PFSense box.
IF you don’t want to attempt such, then do the wireless off….steps.
I’m assuming the Unifi AP’s are powered POE. All you’d have to do so as to use them is instead of plugged into the modem, plug them into a switch that is connected to the PFSense box. Or a switch that is connected to a switch as you noted.
Since you have those, that’s another reason to simplify the modem by turning everything off beyond being a dumb modem. You don’t need the wireless in the modem.
Given your setup more than likely not setup to play well with others would be my guess as to why the internet comes and goes on your wireless.
It is not too many clients. At least very unlikely.
IF you want to simplify the modem, move the AP’s to a switch that is getting dhcp, DNS, etc., from the PFSense box, absolutely turn the wifi off, disable gateway, attach to its LAN port 1, boot the modem.
Don’t change the connection at the PFSense box. It’ll get WAN information from LAN Port 1 instead of port 4 is all. You might have to refresh the WAN lease or boot the PFSense box once the modem comes back up.
Edit: What’s that HT-EMN2 hanging off the MoCA interface?
-
@jsmiddleton4 Well I might need MoCA ....as in your question where does the HT-EMN2 (wireless extender), hangs off of the modem, via coax.
this pic below is the pic of my modem/router.
A wall outlet w/coax connection is where the ISP comes into the house, that coax cable from the wall connects to the coax cable in the back of the modem/router.
i know i have tried to login to the wifi range extender but I am unable to make ANY changes to it. Even tried hard resetting it once and it wouldnt clear, it would just boot back up to the configured settings (that i couldnt change).
I will look at doing the first steps you suggested about disable wireless, res. gateway UPnP mode, etc. and see how that works. That is going to be a weekend project for sure because i'll have to run a cable or setup a switch to a switch to get everything connected again. I will have to think about how im going to do that before i start turning off the wireless.
i'll keep you posted.As for wireless, im thinking the modem/router doesnt like the setup and my exact thought was too many clients, i disconnected my work laptop from a hotspot today and it grabbed onto my home wireless and right then i look at my phone that is on home wireless and it starts saying 'internet may not be avaliable' then a few min. later it kicks back in just fine. Its definetly something wonky that hasnt happened until i started this project.
-
So you have a splitter on the coax that feeds the modem somewhere?
Are you sure you can get the PFSense box 2nd in line?
I’ve never seen a MoCA wireless extender. Only ever seen wired AP’s, power line adapters or wireless repeaters.
-
@jsmiddleton4 There is a splitter on the cable that goes to the wireless range extender.
I just checked and there is no coax splitter on the main modem.
Here is a pic before all of this pf sense how the router/modem looked.
Here is a pic (below), of how the setup currently is w/the modem being in IP Passthorugh mode and the cat5 connecting to the pf sense box (in basement)
here is the starting point of the coax cable that goes into the modem, then the rest of those cat5s were what i was referring to earlier where i used to have them all plugin to the modem before pf sense.
here is the hitron range extender.
This is how the setup is currently which I would believe make the PF Sense box 2nd in line (to answer your question)...and w/this current setup is where we are still finding a way for the wireless devices to connect to pfsense, so all devices can be monitor and or all devices can see each other on the same network...which as you stated earlier to try the 1-4 steps above.
-
Good morning.
One of the things that's making this harder than it needs to be is trying to figure out a way to keep everything you have in place and setup the PFSense box.
Makes things complicated and for the PFSense box to fully do what the PFSense box is designed to do it needs to be the master for lack of a better word.
Which means for you forget the modem and the way anything you have working which is connected to the modem. Make it dumb, hook its WAN output to the WAN on the PFSense box. Make sure THAT works.
Which you've done. At least the diagram looks like it. You should be able to wire to the Switch and connect to the internet through the PFSense box.
Everything else you need for your network infrastructure will in one way or the other be hung off the PFSense box.
If you need a wired wireless extender upstairs, we'll figure out how to get a wireless extender upstairs working but through the PFSense box.
What I was talking about leaving the modem in IP Passthrough means you'll have two separate networks. You'll have one that gets its DHCP/DNS, etc., through the modem AND uses the modem as the gateway to the internet. One that gets its DHCP/DNS, etc., through the PFSense box AND uses the PFSense box as its gateway to the internet.
Let's say the modem's dhcp range is 1.100.100.1-1.100.100.100. All your clients be they wired or wireless hung off the modem will get a dhcp in the 1.100.100.1 range.
For the clients hung off the modem to see clients hung off the PFSense box you'd have to tell PFSense to let anyone with a range of ip's 1.100.100.1-1.100.100.100 through its WAN port. And to let any of the PFSense clients go through to the modem.
Then the two networks are able to talk to each other.
Is that possible? Sure.
Probably more complicated than doing double NAT which others have mentioned as an option. Double NAT means the modem does everything it can do. The "WAN" information the PFSense box uses is a LAN IP from the modem. Clients on the PFSense box connect to the internet through the LAN port of the modem. Both modem and PFSense do network address translation, NAT. The modem does its NAT using the ISP provided IP information. PFSense does its NAT using the IP the modem gives it.
Works fine. Probably gateway and firewall rules so the two networks can talk to each other. Everything hooked up to your modem works through your modem. Everything hooked to the PFSense box works through the PFSense box which sends everything to a LAN port on the modem and the modem connects the PFSense box clients to the internet.
Either is not having the PFSense box do the heavy lifting which is where I thought you were going.
IF you want the PFSense box to do the heavy lifting, what its designed to do, make the modem a dumb modem, shut down its wireless, turn off residential gateway, connect the WAN port of the PFSense box to LAN 1 on the modem, boot if you have to, make sure wired clients hung off the PFSense box can get to the internet. (Connecting to a switch which is connected to the PFSense box is just like connecting directly to the PFSense box.)
Once that's done, work through how to setup all the other things you need.
One step at a time. Not all of it at the same time.
From what I can tell everything you need to do can be done through the PFSense box.
Your MoCA connected, wired, wireless extender. May not be configuration options. It might be getting all its information via DHCP and the modem/router. There are MoCA adapters which you can connect via ethernet to the PFSense box and then coax to your extender. IF you have to keep using coax that's not a deal breaker.
You have to decide how you want your network to be setup. There's no right or wrong. There's how you want it. Then we can advise how to do so.
Not trying to be a wise guy. Just saying we can't hit a moving target.
Edit: Your wireless extender can be a wifi repeater. Doesn't need a wired connection. IF wired, can be coax or ethernet. Did you buy the ISP equipment or are you leasing it?
https://us.hitrontech.com/products/service-providers/ht-emn2-wifi-extender-with-moca/
-
@jsmiddleton4 Hello, thank you again for the information and time you've put into helping me figure this out. I really appreciate it and just so you know Ive been taking notes as I go, so I have reference points if needed in the future, so the info you give isnt going to waste.
I do want my PFSense box to do the heavy lifting, what it is designed to do, you are correct in that. Tonight I will, do as you stated, make the modem dumb, etc.
You are right, one step and a time not all of it at the same time. I get caught on that part at times.
I bought my ISP equipment, specifically the modem/router and the wifi range extender, granted it was years ago but its still good.
I will keep you posted once I make my modem dumb and work on my network diagram to see how we can make it work, the 'fun' (not) thing will be either moving equipment around or re-running cables. which that is something I have to figure out.
-
I'm more than happy to help and kudos to you for sticking with it.
Tell me about the other wireless AP's you have. One way or the other you're going to need wireless AP's. I'm assuming preference is to use what you have if at all possible.
Based on the reading on your MoCA wireless extender it does get its "setup" information from the modem/router. It is "automatically" setup. Still working on what that actually means.
I have played with several wireless repeaters. Plug them in for power where you need them. Easy to setup. Can hard wire to them and use them as AP's. NOT expensive.
https://www.amazon.com/NETGEAR-Wi-Fi-Range-Extender-EX6250/dp/B07MDZ8G4T/ref=sr_1_7?crid=384GTQASI0E7R&keywords=Netgear+wireless+repeater&qid=1641586211&sprefix=netgear+wireless+repeater%2Caps%2C89&sr=8-7
-
I'm trying to nail down if you can connect a MoCA adapter so it gets its info from the PFSense box yet put a splitter on the coax feed. The question is will that mess with the ISP data sent to the modem on that same COAX cable.
It is possible to do. Read several "How to's" from folks who did just that. But their modem/router stayed in the loop as both. Not JUST a modem which is where you're headed.
You don't want the modem to do anything MoCA.
So it may be possible to keep using the coax feed to the upstairs and the PFSense box doing the heavy lifting. PFSense ethernet to a MoCA adapter. The MoCA adapter coax to a splitter on the COAX feed. Upstairs the receiving MoCA adapter. All the while the modem gets the WAN info from the ISP via the existing COAX connection.
1gbs MoCA pairs not expensive either. Some have the splitter already built in.
I'm still not confident if you can do that by adding one new adapter hanging off the PFSense box and keep using the MoCA wireless extender upstairs.
You might have to disconnect that wireless extender from your modem, plug in an ethernet cable. Poke around in the wireless extender via just ethernet. That way the modem isn't sending anything to the extender "Automatically". Do that and MAYBE you can configure it independently.
EDIT: Looks like you can use the MoCA wireless extender on its own without the hitron modem/router. IF you go that way only thing would be to setup the two MoCA adapters so they are on the same frequency, etc., for the COAX feed.
https://us.hitrontech.com/wp-content/uploads/2020/07/HT-EMN2_datasheet_2018-01-24.pdf
-
@jsmiddleton4 Okay, I did what you recommended I made the modem/router though I had to reset it to make it do so. Currently, the modem/router is NOT in IP Passthrough mode. It has wireless is disabled, residential gateway & UPnP are disabled. It is in bridge mode now, I verified I could connect to it w/my PF Sense box for hardwired devices.
I setup an old router (Belkin AC) to use as an Access point when that time comes.
You are correct when you said I'd prefer to keep/use the equipment I have for this and not purchase anything new.
As for the APs i was referring to, I have 3 Unifi APs (2 are old and outdated recently w/in the past yr arn't supported anymore to grab new firmware...was going to just put these in a lab environment depending on how far behind they are on firmware). These APs are connected to a Cisco 2960POE Switch (i know its old but its still good) and this also had a PS TV connected to it as well, this POE Switch was 1 of the cables that was hardwired to my modem/router.
I have a 3560G Cisco Switch (I know its old but good) that I was using in another room for devices (2nd of the hardwired connections to the modem/router) before I purchased a Netgear 26port POE Gigabit switch. This Netgear switch (3rd hardwired connection to modem/router) is what the PF sense box, NAS(x2), and Pihole (old NVR) are running off of. The Netgear is hardwired into the modem/router.
Misc. dumb switch w/a few devices was connected to the modem/router, making the 4th hardwire run to the modem/switch.
I have 2 more old routers I can use for access points if the hitron extender cant be used anymore (this is fine as long as I can get WiFi up somehow).
So now I just need to figure out how to get wireless devices plugged back in (No plugins installed yet for PF Sense)
Guessing as described above how everything was laid out I'll probably have to run another cable back up and add a dumb switch to connect the 3 cables or so that used to be connected to the modem/router, to make everything talk to each other again...i think.
I still have yet to try to connect the hitron extender via cat5 cable. I will grab it tomorrow and plug it into the switch downstairs to see if i can even access it now that the modem is in bridge mode...I would still need to run a cable somewhere to get everything connected again.
Currently, I am using a hotspot for wireless so i dont kill my mobile data/ go over my data cap on that.
-
@travelmore said in PF Sense Setup:
The Netgear is hardwired into the modem/router.
Want to make sure I understand.
Other than the PFSense box plugged into LAN1 which is now the WAN port on the hitron modem/router, do you still have stuff plugged into the hitron modem/router?
Or should that be "was plugged in...."?
If so all of it needs to be plugged into the PFSense box. Which is what needs to be figured out next.
From your pictures and description the PFSense box is in the basement. Yes? In terms of connections and logistics it might be better to move it to where the most ethernet cables are accessible. All you'd have to do is put a switch where it is now IF its in the basement. Or just use the switch that's already down there. Obviously you have a cable run from where the hitron modem/router is now.
Old switches are great. I have a bunch in a drawer in the garage I'd be glad to give you.
Is the MoCA wireless extender upstairs doing anything now?
IF it is, you'll need to turn off MoCA in the hitron modem/router. Turn the extender off at least. Wouldn't need to disconnect it.
"if the hitron extender cant be used anymore"
Might be able to. I wouldn't count it out yet.
-
@jsmiddleton4 My apologies, should have been was plugged in. Late night. It is never as simple as it seems to set this stuff up lol.
Currently, the only thing plugged into the modem is the power cord and PF Sense. Verified I can connect to PF Sense client and pihole from hardwired devices. Verified no wifi is displaying, the wireless range extender is unplugged. I will grab it now and plug it in to see if I can connect to it on a hardwired device. I created a diagram to better explain the current setup.
PF Sense box is in the basement. I did have all of my IT equipment (the old cisco 3560G switch,2 NASs, a few PCs in a room upstairs but it was too hot and too loud so i moved everything to the basement so its a better temp, safer, and quiet..i dont have to hear IT equipment running.
I need to somehow connect main floor room1, upstairs room 1 and upstairs room 2 hardwired connections to PF Sense somehow. I think the simplest way of accomplishing this is running a 2nd wire up from the basement to the main floor, to allow me to place a switch up there, unless you see an easier way? (without moving equipment from the basement up).
As far as equipment not listed in that pic that I can use, I have 1 of each below unless stated otherwise by an x#):
- CISCO ASA
- En Genius Wireless AP
- Old cisco router w/ddwrt
- belkin router (just setup lastnight for an AP to 'replace' the extender if i cant use it)
- old Netgear router
- 3020 PC
- Cisco 3560
- Cisco 3560 G (the one mentioned above that the Netgear replaced)
- Old 3COM switch
The Cisco ASA and Cisco switches are all old but I want to use those in a lab environment once I get my home network setup. I want them to grab the same internet from the ISP but be completely separate so if i bonk anything up in my lab it doesnt affect my home environment but that is for another project. I used to work for an IT company and they would get rid of IT equipment and anything we wanted to get was up for grabs so I did, that is how I have so much equipment.
I feel the next steps now is:
- Get my wireless and wired devices talking to each other somehow.
- Connect Main Floor Rm1, Upstairs Rm1 & Upstairs Rm 2, to the PF Sense box so they can all be hardwired and in commission again.
Below is a diagram of how everything is.
