PF Sense Setup
-
Good morning.
One of the things that's making this harder than it needs to be is trying to figure out a way to keep everything you have in place and setup the PFSense box.
Makes things complicated and for the PFSense box to fully do what the PFSense box is designed to do it needs to be the master for lack of a better word.
Which means for you forget the modem and the way anything you have working which is connected to the modem. Make it dumb, hook its WAN output to the WAN on the PFSense box. Make sure THAT works.
Which you've done. At least the diagram looks like it. You should be able to wire to the Switch and connect to the internet through the PFSense box.
Everything else you need for your network infrastructure will in one way or the other be hung off the PFSense box.
If you need a wired wireless extender upstairs, we'll figure out how to get a wireless extender upstairs working but through the PFSense box.
What I was talking about leaving the modem in IP Passthrough means you'll have two separate networks. You'll have one that gets its DHCP/DNS, etc., through the modem AND uses the modem as the gateway to the internet. One that gets its DHCP/DNS, etc., through the PFSense box AND uses the PFSense box as its gateway to the internet.
Let's say the modem's dhcp range is 1.100.100.1-1.100.100.100. All your clients be they wired or wireless hung off the modem will get a dhcp in the 1.100.100.1 range.
For the clients hung off the modem to see clients hung off the PFSense box you'd have to tell PFSense to let anyone with a range of ip's 1.100.100.1-1.100.100.100 through its WAN port. And to let any of the PFSense clients go through to the modem.
Then the two networks are able to talk to each other.
Is that possible? Sure.
Probably more complicated than doing double NAT which others have mentioned as an option. Double NAT means the modem does everything it can do. The "WAN" information the PFSense box uses is a LAN IP from the modem. Clients on the PFSense box connect to the internet through the LAN port of the modem. Both modem and PFSense do network address translation, NAT. The modem does its NAT using the ISP provided IP information. PFSense does its NAT using the IP the modem gives it.
Works fine. Probably gateway and firewall rules so the two networks can talk to each other. Everything hooked up to your modem works through your modem. Everything hooked to the PFSense box works through the PFSense box which sends everything to a LAN port on the modem and the modem connects the PFSense box clients to the internet.
Either is not having the PFSense box do the heavy lifting which is where I thought you were going.
IF you want the PFSense box to do the heavy lifting, what its designed to do, make the modem a dumb modem, shut down its wireless, turn off residential gateway, connect the WAN port of the PFSense box to LAN 1 on the modem, boot if you have to, make sure wired clients hung off the PFSense box can get to the internet. (Connecting to a switch which is connected to the PFSense box is just like connecting directly to the PFSense box.)
Once that's done, work through how to setup all the other things you need.
One step at a time. Not all of it at the same time.
From what I can tell everything you need to do can be done through the PFSense box.
Your MoCA connected, wired, wireless extender. May not be configuration options. It might be getting all its information via DHCP and the modem/router. There are MoCA adapters which you can connect via ethernet to the PFSense box and then coax to your extender. IF you have to keep using coax that's not a deal breaker.
You have to decide how you want your network to be setup. There's no right or wrong. There's how you want it. Then we can advise how to do so.
Not trying to be a wise guy. Just saying we can't hit a moving target.
Edit: Your wireless extender can be a wifi repeater. Doesn't need a wired connection. IF wired, can be coax or ethernet. Did you buy the ISP equipment or are you leasing it?
https://us.hitrontech.com/products/service-providers/ht-emn2-wifi-extender-with-moca/
-
@jsmiddleton4 Hello, thank you again for the information and time you've put into helping me figure this out. I really appreciate it and just so you know Ive been taking notes as I go, so I have reference points if needed in the future, so the info you give isnt going to waste.
I do want my PFSense box to do the heavy lifting, what it is designed to do, you are correct in that. Tonight I will, do as you stated, make the modem dumb, etc.
You are right, one step and a time not all of it at the same time. I get caught on that part at times.
I bought my ISP equipment, specifically the modem/router and the wifi range extender, granted it was years ago but its still good.
I will keep you posted once I make my modem dumb and work on my network diagram to see how we can make it work, the 'fun' (not) thing will be either moving equipment around or re-running cables. which that is something I have to figure out.
-
I'm more than happy to help and kudos to you for sticking with it.
Tell me about the other wireless AP's you have. One way or the other you're going to need wireless AP's. I'm assuming preference is to use what you have if at all possible.
Based on the reading on your MoCA wireless extender it does get its "setup" information from the modem/router. It is "automatically" setup. Still working on what that actually means.
I have played with several wireless repeaters. Plug them in for power where you need them. Easy to setup. Can hard wire to them and use them as AP's. NOT expensive.
https://www.amazon.com/NETGEAR-Wi-Fi-Range-Extender-EX6250/dp/B07MDZ8G4T/ref=sr_1_7?crid=384GTQASI0E7R&keywords=Netgear+wireless+repeater&qid=1641586211&sprefix=netgear+wireless+repeater%2Caps%2C89&sr=8-7
-
I'm trying to nail down if you can connect a MoCA adapter so it gets its info from the PFSense box yet put a splitter on the coax feed. The question is will that mess with the ISP data sent to the modem on that same COAX cable.
It is possible to do. Read several "How to's" from folks who did just that. But their modem/router stayed in the loop as both. Not JUST a modem which is where you're headed.
You don't want the modem to do anything MoCA.
So it may be possible to keep using the coax feed to the upstairs and the PFSense box doing the heavy lifting. PFSense ethernet to a MoCA adapter. The MoCA adapter coax to a splitter on the COAX feed. Upstairs the receiving MoCA adapter. All the while the modem gets the WAN info from the ISP via the existing COAX connection.
1gbs MoCA pairs not expensive either. Some have the splitter already built in.
I'm still not confident if you can do that by adding one new adapter hanging off the PFSense box and keep using the MoCA wireless extender upstairs.
You might have to disconnect that wireless extender from your modem, plug in an ethernet cable. Poke around in the wireless extender via just ethernet. That way the modem isn't sending anything to the extender "Automatically". Do that and MAYBE you can configure it independently.
EDIT: Looks like you can use the MoCA wireless extender on its own without the hitron modem/router. IF you go that way only thing would be to setup the two MoCA adapters so they are on the same frequency, etc., for the COAX feed.
https://us.hitrontech.com/wp-content/uploads/2020/07/HT-EMN2_datasheet_2018-01-24.pdf
-
@jsmiddleton4 Okay, I did what you recommended I made the modem/router though I had to reset it to make it do so. Currently, the modem/router is NOT in IP Passthrough mode. It has wireless is disabled, residential gateway & UPnP are disabled. It is in bridge mode now, I verified I could connect to it w/my PF Sense box for hardwired devices.
I setup an old router (Belkin AC) to use as an Access point when that time comes.
You are correct when you said I'd prefer to keep/use the equipment I have for this and not purchase anything new.
As for the APs i was referring to, I have 3 Unifi APs (2 are old and outdated recently w/in the past yr arn't supported anymore to grab new firmware...was going to just put these in a lab environment depending on how far behind they are on firmware). These APs are connected to a Cisco 2960POE Switch (i know its old but its still good) and this also had a PS TV connected to it as well, this POE Switch was 1 of the cables that was hardwired to my modem/router.
I have a 3560G Cisco Switch (I know its old but good) that I was using in another room for devices (2nd of the hardwired connections to the modem/router) before I purchased a Netgear 26port POE Gigabit switch. This Netgear switch (3rd hardwired connection to modem/router) is what the PF sense box, NAS(x2), and Pihole (old NVR) are running off of. The Netgear is hardwired into the modem/router.
Misc. dumb switch w/a few devices was connected to the modem/router, making the 4th hardwire run to the modem/switch.
I have 2 more old routers I can use for access points if the hitron extender cant be used anymore (this is fine as long as I can get WiFi up somehow).
So now I just need to figure out how to get wireless devices plugged back in (No plugins installed yet for PF Sense)
Guessing as described above how everything was laid out I'll probably have to run another cable back up and add a dumb switch to connect the 3 cables or so that used to be connected to the modem/router, to make everything talk to each other again...i think.
I still have yet to try to connect the hitron extender via cat5 cable. I will grab it tomorrow and plug it into the switch downstairs to see if i can even access it now that the modem is in bridge mode...I would still need to run a cable somewhere to get everything connected again.
Currently, I am using a hotspot for wireless so i dont kill my mobile data/ go over my data cap on that.
-
@travelmore said in PF Sense Setup:
The Netgear is hardwired into the modem/router.
Want to make sure I understand.
Other than the PFSense box plugged into LAN1 which is now the WAN port on the hitron modem/router, do you still have stuff plugged into the hitron modem/router?
Or should that be "was plugged in...."?
If so all of it needs to be plugged into the PFSense box. Which is what needs to be figured out next.
From your pictures and description the PFSense box is in the basement. Yes? In terms of connections and logistics it might be better to move it to where the most ethernet cables are accessible. All you'd have to do is put a switch where it is now IF its in the basement. Or just use the switch that's already down there. Obviously you have a cable run from where the hitron modem/router is now.
Old switches are great. I have a bunch in a drawer in the garage I'd be glad to give you.
Is the MoCA wireless extender upstairs doing anything now?
IF it is, you'll need to turn off MoCA in the hitron modem/router. Turn the extender off at least. Wouldn't need to disconnect it.
"if the hitron extender cant be used anymore"
Might be able to. I wouldn't count it out yet.
-
@jsmiddleton4 My apologies, should have been was plugged in. Late night. It is never as simple as it seems to set this stuff up lol.
Currently, the only thing plugged into the modem is the power cord and PF Sense. Verified I can connect to PF Sense client and pihole from hardwired devices. Verified no wifi is displaying, the wireless range extender is unplugged. I will grab it now and plug it in to see if I can connect to it on a hardwired device. I created a diagram to better explain the current setup.
PF Sense box is in the basement. I did have all of my IT equipment (the old cisco 3560G switch,2 NASs, a few PCs in a room upstairs but it was too hot and too loud so i moved everything to the basement so its a better temp, safer, and quiet..i dont have to hear IT equipment running.
I need to somehow connect main floor room1, upstairs room 1 and upstairs room 2 hardwired connections to PF Sense somehow. I think the simplest way of accomplishing this is running a 2nd wire up from the basement to the main floor, to allow me to place a switch up there, unless you see an easier way? (without moving equipment from the basement up).
As far as equipment not listed in that pic that I can use, I have 1 of each below unless stated otherwise by an x#):
- CISCO ASA
- En Genius Wireless AP
- Old cisco router w/ddwrt
- belkin router (just setup lastnight for an AP to 'replace' the extender if i cant use it)
- old Netgear router
- 3020 PC
- Cisco 3560
- Cisco 3560 G (the one mentioned above that the Netgear replaced)
- Old 3COM switch
The Cisco ASA and Cisco switches are all old but I want to use those in a lab environment once I get my home network setup. I want them to grab the same internet from the ISP but be completely separate so if i bonk anything up in my lab it doesnt affect my home environment but that is for another project. I used to work for an IT company and they would get rid of IT equipment and anything we wanted to get was up for grabs so I did, that is how I have so much equipment.
I feel the next steps now is:
- Get my wireless and wired devices talking to each other somehow.
- Connect Main Floor Rm1, Upstairs Rm1 & Upstairs Rm 2, to the PF Sense box so they can all be hardwired and in commission again.
Below is a diagram of how everything is.
-
No need to apologize. Trying to describe some things is way harder than the thing actually is.
ddrwt.... man there's a blast from the past. Old Linkysys 54gl....
The location that has the most hard wires running to it is the main floor?
-
@jsmiddleton4 Yes the location that has the most, hard-wired connections running to it is the main floor, where the modem/router is at because originally all of those were connected to the back of the modem. Id prefer to leave the pfsense box and netgear in the basment that was part of the whole putting my main IT equipment in the basement.
Realistically the only thing I am seeing that is the simplest solution is running another cable up from the basement (plugged into netgear), plugged into a switch in the main floor to then plug in the main fl rm 1, upstairs rm1 & upstairs rm2 devices to get those hardwired devices talking to each other. I do not know if there is another solution that is simpler and I dont know if this would be required to get the wireless devices to talk to each other (as phones are always wireless and chrome casts are wireless as well).
EDIT: i would prefer to get the wireless devics somehow setup this weekend so I can finally have this done but i dont know what my next steps are as far as all the information I gave in the above post. Once i get this done then I can start installing PF Sense packages for bandwidth monitoring and other things, etc.
EDIT: Realistically, idk if i will be able to actually run the cable this weekend as my 'fish sticks' are still on there way, said to be delivered monday and as far as cable, im not sure how long of a cable i'll actually need. I may just purchase a pre-crimped one instead of trying to end it myself because i suck at that. I have my hotspot, if needed for wireless till I can get this whole thing resolved.
-
@travelmore
Getting the wireless stuff up and running being they're AP's won't be difficult.The Belkin when in AP mode it still has LAN ports that work like a switch?
For now would you be okay with getting stuff setup and running the easiest way possible and then later run ethernet cable?
For now the easiest way to get you up and running is put the PFSense box where the most ethernet cables exist already.
In doing and learning "IT" stuff in your lab having the PFSense box right there isn't all that necessary. Once you pull cables have it there, on its own monitor, etc., would be nice.
I was serious about sending you switches I have in my garage. At least 2 of them are "managed", although just barely managed. What that means is you can create VLANS and bond ethernet ports together so a pair acts as one. Learning how to create VLANS would be valuable. Get that sorted and then do real or live VLANS in PFSense. You can get very fancy with VLANS. You'd have a practice platform with the switches.
https://www.netgear.com/support/product/GSS108E.aspx
For now IF you want to, move the PFSense box to the main floor, connect the one ethernet cable already there, main floor to basement, to the switch that is in the basement. You're done with the basement. Anything else you want to connect in the basement you plug into the switch.
On the main floor, use a short ethernet cable to connect the modem's WAN port to the PFSense box WAN port.
Connect a switch to the PFSense LAN port.
Connect everything else including the cable running downstairs to the PFsense connected switch.
If you need more ports, connect the switch coming off the PFSense LAN port to another switch.
Use the existing ethernet cables to other rooms and attach the AP's.
IF you need the POE adapter for the Uni AP's, that'd be a switch on the main floor by the PFSense box. Then your Uni ap's connect to the POE capable switch. The POE capable switch to the PFSense box.
IF where you need an AP and its wired and you also need a switch, use the Belkin there. It'd be both a wireless AP and an wired switch.
That is what I'd recommend for now. Over time? You have time to pull some cables and change the topology of where stuff is placed.
Also over time can tackle the existing MoCA wireless extender use/setup.
Edit:
"pre-crimped one"
If you know how to put low voltage existing construction box in your sheet rock no need to buy pre-crimped. The network plates/pop in receptacles are a piece of cake. Color coded to get pairs matched correctly, etc.
-
Just an example.
https://www.amazon.com/BUPLDET-Port-Ethernet-Punch-Plate/dp/B08LDNT2KS/ref=sr_1_7?crid=2E54G6GJFRFT8&keywords=ethernet+cover+plate+jack&qid=1641657943&sprefix=ethernet+cover+plats+jacks%2Caps%2C88&sr=8-7
-
@jsmiddleton4 As always, thank you for your help! Hello, what a day! So, I did as you suggested and moved the PF Sense box in the main floor near the router, then grabbed an old 3Com 24port super stack switch I had to plug everything into. Wired devices are reachable from a wireless PC...so SUCCESS!!!!!!!!!!!
What I didnt mention above was I had a MIL-S2400S switch, that I tried to use to connect the modem and pf sense and realized some ports were bad on the switch but some were good...so i plugged everything in to the good ports, only to realize about half an hr later the switch kept dropping issues, so i removed it and plugged in the old 3Com I had (mentioned above) and its been working great since. Needless to say I am throwing that MIL-S2400S switch out! That whole process took a while because I went through and tested every port only to find out later it was rubbish from the start lol.
At least for the time being until I can run that cable then move things but I feel like that will be simple now that the main bulk of everything is working. I added my old belkin router as an AP to replace the Hitron coax extender.
I messed around w/that hitron extender and logged in and couldnt change anything, everything w/old settings was greyed out (which i expect that due to the modem being in bridge). I reset the hitron extender to fac. def. settings and still everything was greyed out and I couldnt make changes to it (even though it did have the facto ssid). That is fine so I unplugged that and put it off to the side and as mentioned setup my belkin router to be an AP. (and if needed it should suffice as a dumb switch to because there are a few ports on the back of it).
All that being said, here is the current setup that is allowing my wired devices to talk to wired.
That being said, I have no plugins installed in PF Sense and I was looking at this article, https://forum.netgate.com/topic/150293/view-all-connected-devices/2
to see how I can view all devices in PF Sense now that everything is talking to each other but im unclear on that article.Currently, in PF Sense these are what is displayed:
SERVICES/dhcp server/ lan, this is the only thing checked on that page and I have my subnet, subnet mask, and avaliable range set.
further down on the DNS Resolver/Gen. settings page:
I dont know if there is anything else to put on the DNS settings, everything is left as default from when PF Sense is originally installed. The only thing I ever did was the general basic setup of setting the range and enabling DHCP.
Note: I did not do anything w/the firewall settings, everything is literally default and as is which I hope is fine for now.
Now, its a matter of:
- How do I see all the devices connected (wired and wireless)?
- What packages should I install, to monitor bandwidth and devices, etc?
- I am curious, is there any alert that can tell you when a new device has tried to access your network?
- This concerns me, why am I getting this message when going to my PFSense box (hardwired) from my wireless pc?
I have also noticed this error when going to some sites from my wireless pc:
The part where it says 'not secure', as well as that warning in the center of the page is what I find concerning. I am guessing it's just a setting in PFSense but not sure and wanted to ask here since it only started once I got all this setup today.
-
The cert error when connecting to pfSense is expected because it's a self signed cert.
The second error looks like that site actually has an expired cert.Steve
-
Congrats again! Way to stick with it.
There’s some stuff that has to be right for DHCP6 to work so not surprised if its not working right off the bat.
Look at you… network topology expert!
Yes when the bulk is setup in a way that its as easy or straightforward as possible it is WAY easier to tweak things later on.
I don’t use DNSSEC by the way. Would at least be worth asking someone who would know, not me, if DNSSEC is triggering those alerts. I have several devices I have to tell Firefox its gonna be okay, go ahead and access the device. Only do so for stuff on my own network. I’d never do that if I was accessing a web site.
The firewall log tells you what is knocking on your door.
There are several packages which can tell you all sorts of stuff about your PFSense box, clients, usage, etc.
You ready to tackle DHCP6?
The Netgate doc is clear and easy to follow. The only thing is some ISP’s you have to pick some of the misc. options which are not on the step by step.
Edit: There’s a ton of video tutorials fro DHCP6 and pfsense too.
-
@stephenw10 Thank you!
-
@jsmiddleton4 Thanks! Not ready to tackle DHCP 6 yet. Id like to get plugins installed and some things configured first so I can actually see whats on my network and what devices are pulling bandwidth. Then tackle DHCP 6. I'll check out the firewall log.
-
-
It looks to me the only way to see if you can use your existing MoCA wireless extender is get another Ethernet to MoCA adapter, hook em up and see.
-
@jsmiddleton4 yeah i gave up on that extender. i just setup another AP instead.
Did you mean ntopng plugin or pfBlocker-NG Package plugin? -
Pf blocker Dev version.
It’d drive nuts so I’d probably order an adapter off Amazon, if didn’t work, send it back.
Reads like all the MoCA stuff is automatic. Only set up is for wireless options.
There are MoCA pairs that are designed to use a coax run like yours. Not too expensive but still there’s a cost.
If you can run Ethernet cabling always a better idea.
