Access Point Admin portal different subnet help?
-
Hello all,
I have a network with two subnets:
192.168.1.1/24 main
192.168.3.1/24 VoIPI recently added a TpLink EAP660HD Access Point (POE).
I had to put it on the 192.168.3.1/24 subnet for POE and all is good.
EXCEPT, I can only access the admin portal for the 660HD if I am connected to the 192.168.3.1/24 subnet. How would I make it to where I can also access the admin portal from the 192.168.1.1/24 subnet?
I messed around with NAT Outbound some but to be honest I don't know what I am doing. On my old personal Edgerouter setup I had to do a masquerade for a different TpLink Access Point.
Thank you,
Josh -
@cgi2099 said in Access Point Admin portal different subnet help?:
I messed around with NAT Outbound some but to be honest I don't know what I am doing. On my old personal Edgerouter setup I had to do a masquerade for a different TpLink Access Point.
Way to complicated. You have a firewall : use it.
Add a firewall rule on the 192.168.1.1/24 'main' interface.
Source : LAN Net
Destination : VoiP Net - or nail it down to the 660 IP.
Destination port : the port used, probably 443 - and protocol TCPPut this rule on the top of the LAN interface list, before any block rules.
Now you can access https://192.168.3.x while your device is connected on LAN (using 192.168.1.y).
Keep in mind : this '660 AP' could block access to devices that are not in it's own 192.168.3.x network, check that.
-
Yes, the outbound NAT rule on VoIP would allow that if the AP blocks access from outside it's subnet or if it doesn't have a route back to 192.168.1.0/24 for some reason.
Assuming the firewall rules Main are passing the traffic then the 'correct' fix here is on the AP. Configure it to allow traffic from the Main subnet or add a route as required. Adding an OBN rule in pfSense will workaround the issue if you cannot do that in the AP for some reason.
Steve
-
I've tried all of the above except the OBN rule I think. Can you walk me through this? I tired what Gertjan said but this doesn't work.
What is weird is I can ping clients connected to the access point but cannot ping the AP itself. The only option on the 660HD is to enable layer3 management option but that didn't seem to help.
-
@cgi2099
Tp-Link just confirmed this cannot be setup at the AP level. It has to be done either on the router or switch, whichever it is connected too. -
@cgi2099 what part are you not understanding about the outbound nat rule?
Create a rule on your outbound nat page, like this
Lets say this AP was on my dmz network (192.168.3.0/24) at .100
And I wanted devices from my lan network 192.168.9.0/24 to be able to talk to it. Since this device is too stupid to have a gateway, or filters traffic that is not local you trick it into thinking your talking to it from the pfsense IP address on this network.
So change to hybrid mode and create an outbound nat on the interface that this AP is connected, in my example its my dmz interface.
Now any client trying to talk to 192.168.3.100 from the 192.168.9.0 network will get natted to pfsense IP on this interface - in my example 192.168.3.253
-
Switch Outbound NAT to Hybrid mode.
Add a new rule on the VoIP interface.
Source: network 192.168.1.0/24
Destination: network (the AP IP)/32Leave everything else as the defaults.
But you really should be able to allow the AP to reply directly to this and doing that would be a much nicer solution.
Steve
-
stephenw10 Netgate Administratorlast edited by stephenw10 Sep 28, 2022, 2:20 PM Sep 28, 2022, 2:19 PM
We are assuming you're trying to actually access the AP directly here but that is that a centrally managed device? Some sort of cloud management portal?
That's a real AP though. I'm sure it can be configured to allow access from a different subnet.
-
This worked great thank you :)
-
There is an option to set a gateway on the AP maybe this is it? I am scared if I set it to anything other than 192.168.3.1 I will lose access and have to factory reset.
-
@cgi2099
TpLink wants you to use there controller localhost software to manage APs on different subnets it looks like. That is what they told me to use.But the NAT outbound has it working which is good enough for me :)
-
@cgi2099 said in Access Point Admin portal different subnet help?:
I am scared if I set it to anything other than 192.168.3.1
what is pfsense IP address, why would you have it set anything other then your gateway - which I was assuming was pfsense. But yeah if its gateway is something else, then no wonder you can not talk to it through pfsense without the outbound nat - its sending it reply to its gateway.
-
To access pfSense I log into 192.168.1.1
I have one nic setup to 192.168.1.1/24
and one nic setup to 192.168.3.1/24
the other two nic's are not being used or assigned.
The POE switch is plugged into the 192.168.3.1 nic and the AP into a port on it, I assume that is why the AP assigned a 192.168.3.1 gateway?
So should this be set to 192.168.1.1 instead of 192.168.3.1?
-
@cgi2099 no the gateway would be 3.1 so its not that your ap doesn't know how to talk back, it just chooses not too..
-
Yup, that ^.
3.1 is the correct gateway. If it had no gateway at all it wouldn't have a route.
It must be blocking access based of the source.But if OBN is working for you....
Steve
-
Yes working great, thank ya'll so much :)!