Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Pfsense as lan router and port forwarding problems?

    Scheduled Pinned Locked Moved General pfSense Questions
    27 Posts 8 Posters 2.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      josephchrzempiec @marvosa
      last edited by

      @marvosa Thanks for the reply back. I called them and sked them about the bridge mode. They don't have it in there routers. I'm not sure whatelse I can do?

      Joseph

      1 Reply Last reply Reply Quote 0
      • P
        Patch @josephchrzempiec
        last edited by Patch

        @josephchrzempiec said in Pfsense as lan router and port forwarding problems?:

        My ISP have a modem/router all in one

        • What physical interface is the WAN, ie what comes into the ISP router? ADSL / VDSL / Fibre optic / Ethernet.

        • What is the ISP provided modem?

        • If the ISP modem does not provide bridge mode perhaps you could just use a different modem to enable you to connect your pfsense router directly.

        • if you are stuck with a double NAT you will need set up the port forwards in both routers

        J 1 Reply Last reply Reply Quote 0
        • J
          josephchrzempiec @Patch
          last edited by

          @patch My ISP is comcast, It's comcast fiber. The support lady said Well I don't see a way to put it in bridge mode. and the option is not in the modem/router. So I called again and had someone else looked into it. This is what they told me. Yes we can do bridge mode. However you modem/router doesn't have this feature in it. He also said this is very strange even the firmware is different from what they normally have on this model. They are going send me a new modem/router. I was second person in my town to get fiber from comcast.

          P.s.s Problem solved it seems this modem/router firmware is not the same as what they noramlly use. I guess I wasn't seeing things then when I didn't see it.

          I did look something else up on this model. Googlefiber uses the same modem/routers as well. But I can not confirm that is what the comcast guy told me.

          Joseph

          S JKnottJ 2 Replies Last reply Reply Quote 0
          • S
            SteveITS Galactic Empire @josephchrzempiec
            last edited by

            @josephchrzempiec If there is no bridge mode then another way to do this is to set a DMZ in the Comcast router so it forwards everything to your pfSense. So if the pfSense is 10.1.10.5, the Comcast router sets 10.1.10.5 as its DMZ. Then on your pfSense you also create NAT rules to forward port 443 to your web server.

            Alternately you can forward Comcast port 443 to 10.1.10.5:443 and then create another NAT rule on the pfSense to forward port 443 to your web server.

            Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
            When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
            Upvote ๐Ÿ‘ helpful posts!

            1 Reply Last reply Reply Quote 1
            • J
              josephchrzempiec
              last edited by josephchrzempiec

              Hello, I got my new modem/router in today. Wow that was fast. Found out they have a small office 5 minutes from me and I never known it, So I picked it up there. I was able to get it up and running. I also found out I not only got one Static ip address but I have block of 5. I totally forgot I paid for it.

              So I assigned a static ip to the pfsense router and it works. I'm noticing one thing. Sense My Pfsense router is a 192.168 address and my comcast fiber is on another static ip I'm able to ping between both and see both no matter which network it's on. Is there a way to stop that?

              Joseph

              S 1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                Prevent pfSense and Comcast pinging each other?

                I'm not sure why you would want to do that. You can add firewall rules in pfSense to block that if you really want to though.

                Steve

                1 Reply Last reply Reply Quote 0
                • S
                  SteveITS Galactic Empire @josephchrzempiec
                  last edited by

                  @josephchrzempiec If you're talking about pinging the Comcast 10.1.10.1 address that IP works, even when "bridged" and using a static IP on your router. It allows one to browse to the Comcast router to manage it. Also allows one to plug a laptop into their router to test, bypassing the customer router. But yes in some cases we block access to 10.1.10.1 from certain networks, allow from a management IP, etc.

                  Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                  When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                  Upvote ๐Ÿ‘ helpful posts!

                  J 1 Reply Last reply Reply Quote 0
                  • J
                    josephchrzempiec @SteveITS
                    last edited by josephchrzempiec

                    @steveits this modem/router haves a 10.0.0.1 address. How can I apply those rules? I know nothing about firewalls.

                    Joseph

                    S 1 Reply Last reply Reply Quote 0
                    • S
                      SteveITS Galactic Empire @josephchrzempiec
                      last edited by

                      @josephchrzempiec OK around here Comcast's default is a 10.1.10.x subnet.

                      re: rules, first I would take some time to learn more about firewalls so you don't lock yourself out. Second, write down what you're trying to accomplish, in words. Rules on an interface are processed in order. By default LAN is allowed to connect anywhere.

                      https://docs.netgate.com/pfsense/en/latest/firewall/fundamentals.html
                      for example rules (not that you need any of these): https://docs.netgate.com/pfsense/en/latest/recipes/example-basic-configuration.html

                      To restrict access to the Comcast router from LAN, something like this:

                      allow from my_ip to 10.0.0.1
                      block from LAN Net to 10.0.0.1

                      So you can see no one else on LAN except my_ip can connect to 10.0.0.1.

                      Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                      When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                      Upvote ๐Ÿ‘ helpful posts!

                      1 Reply Last reply Reply Quote 0
                      • J
                        josephchrzempiec
                        last edited by

                        @steveits said in Pfsense as lan router and port forwarding problems?:

                        https://docs.netgate.com/pfsense/en/latest/recipes/example-basic-configuration.html

                        Here are the following steps I tried from what I can see online and videos to block the address.

                        I went to firewall/rules/lan. I hit the add button.
                        Action: block
                        Interface: lan
                        address family: IPv4
                        Protocol: TCP/UDP
                        Source: Single host or alias Address 10.0.0.1
                        Deination: Any
                        discription: Block 10.0.01.

                        Is there anything I got wrong or need to change?

                        Joseph

                        P.s.s applying these rules and saving the change did not stop me from pining 10.0.0.1 address.

                        S stephenw10S 2 Replies Last reply Reply Quote 0
                        • S
                          SteveITS Galactic Empire @josephchrzempiec
                          last edited by

                          @josephchrzempiec
                          Pinging is ICMP not TCP or UDP. TCP would block, say, an HTTP connection.
                          Source is the source of the packet so would be the IP you want to block. So probably LAN Net.
                          Destination is where the packet is going, so 10.0.0.1.

                          Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                          When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                          Upvote ๐Ÿ‘ helpful posts!

                          1 Reply Last reply Reply Quote 1
                          • stephenw10S
                            stephenw10 Netgate Administrator @josephchrzempiec
                            last edited by

                            @josephchrzempiec said in Pfsense as lan router and port forwarding problems?:

                            Protocol: TCP/UDP

                            That does not include ICMP which ping uses.

                            1 Reply Last reply Reply Quote 0
                            • J
                              josephchrzempiec
                              last edited by josephchrzempiec

                              Hello , Thank you. I put LAN net in the source. and keep the destination at single host or alias with the address of 10.0.0.1. I have tried that and I'm still able to ping that address. Now I can not go to it but I can see it is there still.

                              I'm so confused. but Trying.

                              Joseph

                              S 1 Reply Last reply Reply Quote 0
                              • S
                                SteveITS Galactic Empire @josephchrzempiec
                                last edited by

                                @josephchrzempiec Did you change the Protocol to ICMP?

                                Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                                When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                                Upvote ๐Ÿ‘ helpful posts!

                                J 2 Replies Last reply Reply Quote 0
                                • J
                                  josephchrzempiec @SteveITS
                                  last edited by

                                  This post is deleted!
                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    josephchrzempiec @SteveITS
                                    last edited by

                                    @steveits I'm so dumb right now. I'm srry you said protocol ICMP. That is myfault there. I'm changing it now. Thank you

                                    Joseph

                                    1 Reply Last reply Reply Quote 0
                                    • J
                                      josephchrzempiec
                                      last edited by josephchrzempiec

                                      Just an update. Thank you all for the information and help. This is a great community I got it all blocked now. however I need to figure out how to block not only 10.0.0.1 but all the addresses. I just tried to ping 10.0.0.34 which my laptop is on and I was able to ping that as well. Is there a way to stop all the addresses in that range?

                                      Edit: I did mange to figure that out I changed Destination to network and the address 10.0.0.1 and it blocked everything on that.

                                      Joseph

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        The destination should really be 10.0.0.0/24 there like:
                                        Screenshot from 2022-07-09 02-21-53.png

                                        1 Reply Last reply Reply Quote 0
                                        • JKnottJ
                                          JKnott @josephchrzempiec
                                          last edited by

                                          @josephchrzempiec said in Pfsense as lan router and port forwarding problems?:

                                          The support lady said Well I don't see a way to put it in bridge mode. and the option is not in the modem/router.

                                          You can't always believe them. Post the model and maybe someone here can help you.

                                          PfSense running on Qotom mini PC
                                          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                          UniFi AC-Lite access point

                                          I haven't lost my mind. It's around here...somewhere...

                                          johnpozJ 1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator @JKnott
                                            last edited by johnpoz

                                            @jknott they already got a new isp device, and they have a block of 5 public IPs

                                            @josephchrzempiec said in Pfsense as lan router and port forwarding problems?:

                                            Hello, I got my new modem/router in today. Wow that was fast. Found out they have a small office 5 minutes from me and I never known it, So I picked it up there. I was able to get it up and running. I also found out I not only got one Static ip address but I have block of 5. I totally forgot I paid for it.
                                            So I assigned a static ip to the pfsense router and it works.

                                            But yeah I agree with your overall advice - quite possible that the 1st level support person when you call just doesn't have a clue ;) Never hurts to post exact model, etc. as there might well be a way to put in bridge mode that the support was just not aware of.

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                            J 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.