Newbie - can't get two subnets to access each other
-
Hi johnpoz,
Your response was helpful.
I am able to ping other devices on the IOT_net from LAN_net. So it looks like the pfsense firewall rules are working.The original device that I was trying to access is a Wifi router that I'm using like an access point. So it's something specific to this wifi router that I can't access (or even ping).
I have turned off the firewall on the wifi router, but it's still not responding to any request from LAN_net. Maybe it's because the wifi router's WAN interface is turned off that it can't deal with requests from outside it's subnet?
I tried to add a static route to the Wifi router's LAN controls, so it goes through the Netgate firewall. But that didn't help.
I can access the wifi router from a computer inside IOT_Device net. Just can't access the wifi router from LAN_net.
-
@davidylau said in Newbie - can't get two subnets to access each other:
to access is a Wifi router that I'm using like an access point
Does this device have a gateway - most likely not.. You can run 3rd party firmware that allows for setting a gateway. Or you can source nat.. Reason you can not talk to that device is it doesn't know how to answer you, since it has no gateway set. I have plenty of threads here how to setup a source nat so you can.
-
It will be a routing problem. Unless that router has a dedicated Access Point mode it probably has no route back to the LAN subnet. Since when it's operating as a router it's default route will be via the WAN and that's probably not connected. Therefore it can only respond to traffic from inside it's own LAN subent (the IoT subnet here).
You might be able to add a static route to it but many devices like that are limited.
If you need to be able to access it from LAN you can add an outbound NAT rule in pfSense so that it sees traffic as coming from the pfSense IoT interface address and can reply.Steve
-
Sorry for the slow response, I spent the last couple of days fixing other connectivity issues.
Also sorry for this newbie request: Can somebody tell me if I wrote the Outbound NAT mapping incorrectly?
Reminder: LAN subnet = 192.168.99.x , IOT_Device subnet = 192.168.123.x
The Wifi router with disabled WAN interface is 192.168.123.252 . I’m trying to access it from LAN subnet.Below is the Outbound NAT mapping that I have tried, but no luck. I have also tried where the NAT’ed address is 192.168.123.5, an IO_Device subnet address that is outside of the DHCP range.
-
@davidylau why do you have this?
Leave those blank - tcp/udp/* is not a port..
-
Yeah, I would leave the protocol 'any' there too. No reason to restrict it to tcp/udp only and you won't be able to ping it with that. Also it doesn't need to be static port.
However I would expect to be able to hit the routers web interface with that in place...Steve
-
@stephenw10 good catch on the static - yeah that isn't something you would want/need either.
If you wanted to limited it to the port say your web gui is running on 443, that would be in the destination port.
What is odd is that pfsense didn't scream at him tcp/udp isn't a "port" prob should be some sort of validation check on that input..
-
That's not invalid, that's just how it shows an outbound NAT rule with the protocol set to TCP/UDP. There's an argument that's just confusing...
Steve
-
@stephenw10 ah - I get it.. So he set udp/tcp - so his ping test failed and thinks its not working is my guess then.
So sniff on your iot interface - now try and access your iot device from your lan - you should see the traffic coming from your iot IP address of pfsense.. I have gone over this multiple times - I know there is a thread where I specifically show when not source natting and when source natting what that sniff looks like.
-
Yup, if it was tested with ping it would have failed.
-
Hi stephenw10 and johnpoz,
I changed the NAT mapping protocol to "any", and now I can access the Wifi router from LAN net. Yay, it's working.
Thanks so much!
