unable to access ips on vlan after changing Gateway/dns

[comet424]

@viragomann
ah ok so i plugged in the computer in the poe switch and was able to access the cameras.. the gateway was saved as 192.168.0.1 but when i got into the cameras they were saved as 0.0.0.0

i not sure if the switch is a l3? whatever that means
all i know is it
CSS326-24G-2S+ MikroTik SwOS switch

so whats the best way to setup vlans i removed the network switch i had in the pfsense box a 4 port as i figure it was causing pfsense to go down where no network traffic... it was a realtek card and i read or was told in past realtek cards not really supported by pfsense even the computers onboard is a realtek... and intels on amazon are expensive... i trying now
10Gtek dual card..

but what do you or people to do keep cameras stable then as if pfsense goes down i still want my cameras working... is there like a fail over or is that something the network switch does? or do u need the 4 network card port so each one is a lan and not a vlan?

as i thought vlans was a good thing but not if pfsense goes down? but i new to vlans so i have no idea just started learning in the past week or 2

[comet424]

ive watched some youtube videos like the lawerance systems and the craft guy that drinks beers but maybe they got better smart switchs or i guess managed switchs u call them that are more reliable then what i have?

[comet424]

and or is it better to scrap vlans
and what be better is

192.168.0.1 - 192.168.100.254 range

and then you say 192.168.10.x is cameras and 192.168.20.x is iot devices and 192.168.0.x is non vpn and 192.168.5.x is vpn computers

but then there is no seperate dhcp server except for vlan or i guess different nics on the pfsense box...

learning as i go... and trying to understand things better

[viragomann]

@comet424
On an L3 you can create different subnets and it can act as a router like pfSense.
Maybe some are also capable doing a basic traffic filtering.

pfSense is designed to act as a router and gateway for all connected network segments, either hardware or VLANs.
A default gateway should never be shutdown. If its down, the devices cannot communicate with other network segments, meaning other VLANs here or with the internet.
It doesn't matter if you use VLANs or have the subnets on the NICs directly.

To avoid outages while you restart it, there are techniques like CARP. That means you need an second router, which take over the connections till the primary is up again.

[Jarhead]

@comet424
Viragomann meant to say a L3 switch, just a typo.

You don't want to scrap vlans, just set them up properly.
Honestly, with your setup, I would delete all those rules and start over, you have a mess there.

The cameras aren't going down when pfSense goes down, you just can't access them.
As long as your recorder is on the same subnet as the cameras they will still be recording.
If your switch goes down, then they are all down.

So set the gateways in the cams to the 10.1 and with the proper rules you will be able to access them from the LAN again. Take it from there and clean up that mess.

[viragomann]

@jarhead said in unable to access ips on vlan after changing Gateway/dns:

Viragomann meant to say a L3 switch, just a typo.

Yes, thx. I correct it above for clarity.

[comet424]

@viragomann
@Jarhead
ah ok ill look up this carp.. ill look that up.. and is that what they call high availabilty i heard before.. is that the same?

so thats why i was able to access my home assistant and iot devices.. everything is on the LAN so it can communicate.. i just broke my network into segements to isolate things as i didnt have vlan cabablilties.. i did it on the same network... but thats why i cant access other networks you need the pfsense to to from 192.168.0.1 to 192.168.10.1 and vise versa but the subnets they can communicate with each other on the same network.. but not to another..

and do you guys know if the 10gtek network cards anygood? and is there a way to monitor if a pfsense crashes as when i restart Pfsense it doesnt say it crashes.. but i dont have a monitor hooked up to the computer so that doesnt help things

and i cleaned up my lan rules a bit took away some of the grayed out as they were tests... and did i do the camera vlan rules right or mistakes there... and is it possible to make it so if someone unhooked the network cable at a camera and plugged into it.. they cant have access to cameras.. i know odds are never going to happen.. i just curious if thats possible.. like only the cameras id would be allowed and nothing else.. like a a list of there id numbers... i know never going to happen but always learning and figure asking cant hurt too..

[johnpoz]

@comet424 said in unable to access ips on vlan after changing Gateway/dns:

and is it possible to make it so if someone unhooked the network cable at a camera and plugged into it.. they cant have access to cameras.

There are ways to mitigate such action.. You're asking if someone just unplugged a device on a switch, and then say plugged their laptop into the switch would they have access to everything on that switch/vlan via the network right?

With the appropriate smart switch or fully managed switch there are a few things that could be done. Port security is a feature that prevents changing the device on a port, the mac of the device is set on the port, or the mac is learned from the first device plugged in - so that if the mac of the device changes, it wouldn't work.. Ie you unplugged a camera and plugged in a laptop.

You could also setup private vlans if your devices on this network don't really need to talk to each other, say cameras. Then even if some other device was plugged in - it wouldn't be able to talk to any other devices on the this network anyway.

You could setup 802.1x where any device on the network has to auth before its allowed to talk on the network. This would be NAC, and https://www.packetfence.org/ would be a good place to start if that is something you wanted to setup on your network. But the proper switch(es) would be required.

Pfsense wouldn't play a big part in such features. You could leverage say freeradius on pfsense for authing for 802.1x. With a dumb switching environment really the only thing you could do to try and mitigate someone just plugging in a device would be with dhcp limits. Ie don't hand out dhcp to unknown mac addresses.. This might prevent someone on accident plugging in device you haven't ok'd to be on the network. Static arp could be used to prevent someone from just plugging in a device and setting an IP and talking to pfsense, but this wouldn't stop the device from talking to other devices on the network/vlan unless you had setup say private vlans on your switch(es)..

None of this stuff prob makes much sense in a home setup, unless you're wanting to learn - as with any security measures they all come with costs. Be it with complexity, appropriate equipment, time in setup, user frustration or extra steps to get on the network, etc. Then there is the learning curve to implement such things.

[comet424]

@johnpoz
oh ok ya i have my cameras outside using those poe's so i was just pondering if you could protect yourself from anyone just unhooking and plugging into it.. i gonna hide the cable .. but was curious if it can be done... ill read up on it... even if i dont do stuff like that least i always learning
and i bet even when your a network administrator it frustrates you guys too.. probably have a team of people so when you get frustrated someone else can give a hand etc

i have a question i have these reolink cameras.. i set up the rules but its not working for the time sync... ntp in the reolink camera is 123 port it says using pool.ntp.org
my 2 rules doesnt sync.. says failed.. but my grayed out.. allow rule allows time sync is there somethine i did wrong just wont sync

[johnpoz]

@comet424 your ntp rule there on the top. For starters ntp is only ever udp. But those rules show no evaluations, see the 0/0 means nothing has hit that rule. So either your alias does not have the correct Ips of your cameras in them? or they are not using pfsense as their gateway, or they just haven't tried to sync time. If they are trying to use pool.ntp.org - maybe that is not resolving for them. I don't see any rules that allow them to say talk to pfsense for dns. What are the cameras using for dns? I don't see any rules that would allow them to use some external dns either.

your 2nd rule there is pretty pointless setting the source port, since your first rule would allow any source port anyway.

[Jarhead]

@comet424 To add, why not use the NTP server in pfSense and have them sync to it?

[comet424]

@jarhead
i have no idea how to set the pfsense one i did try

0.pfsense.pool.ntp.org i found in the pfsense services ntp and added it to the reolink camera
it didnt work
here some screen shots

so if ungray the 2nd allow i have.. it will sync when i press the sync button when i re gray it ... and try to sync.. she says failed on syncing does it mean its using a different port then 123 it says its using? as the reject line is increasing

[johnpoz]

@comet424 said in unable to access ips on vlan after changing Gateway/dns:

so if ungray the 2nd allow i have

well that would allow it to resolve pool.ntp.org, your pointing it to pfsense for dns - that 192.168.10.1 address.. But you have no rules to allow dns other than that allow all rule.

If all you want is for them to be able to sync time.. And not the actually use the internet. Might be better to just point them to pfsense IP for ntp. Then they need no dns nor any internet access at all.

But from your screenshot - they don't allow just putting in an IP for ntp server?

[comet424]

@johnpoz
ah ok. ya for now only want it to sync time no internet.. it does sync the time if i enable my 2nd line i have that opens up everything... so i figured maybe its really not on port 123?

the cameras do have "custom" under ntp server and you can enter a ntp server

do i use 192.168.10.1(camera network) or do i use 192.168.0.1 main address to pfsense?

oh and to get the pool.org id have to add dns port then you were meaning

[comet424]

i tried 192.168.0.1 and 192.168.10.1 it says succeded..

are both ok or is 1 the proper way to do it

[johnpoz]

@comet424 Just point it to pfsense IP on the camera vlan, 192.168.10.1 now you don't need any dns, and you could change your ntp rule to only allow to 123 udp on camera vlan address.

Either work because your rule for 123 allows it to go anywhere. But if your looking to block all access to anything other than ntp, only the pfsense IP on that vlan really needs to be allowed.

[comet424]

@johnpoz

oh ok so get rid of the rejects then? and i can fix that ill point all to 10.1

i have one last question for now with these camears

when i orginaly plugged them in they were all dhcp and host name came up with camera as the host name
i edited each one and set static ips
and i changed each name to like cam1 cam2 cam3 cam4
but it shows up blank now... is there something to run to force pfsense to get the host names.. i know doesnt matter for such a small amount of cameras but would be nice if it show up cam1 cam2 like it did when it was showing up camera as the host name

any special trick? or is a port i need to open like the 123 ntp

[johnpoz]

@comet424 said in unable to access ips on vlan after changing Gateway/dns:

i edited each one and set static ips

You set this were - on the camera or via a dhcp reservation?

If I look in my arp table stuff I have set for reservations show up with names.

example here are my alexas that all have dhcp reservations to always get the same IP.

If you want stuff that you setup static on the device to show up with a name, you could always just create a host override in unbound for that specific IP, so that it resolves to the name you want, ie cam1, cam2 etc..

But in the long run dhcp reservations are going to be a better option vs settings specific on the device. dhcp reservations would allow you to easy change the ip in the future without having to touch the device. Or change other stuff you might hand out via dhcp, like gateway or ntp, there are lots of options that might be useful to hand out via dhcp - be it your device takes advantage of them or not is another thing. But if you set dhcp reservations vs on the actual device - in the future if you want to change the whole network IP space its as simple as some adjustments on pfsense without having to touch each device. A simple reboot of the device should all that be required to get say the new IP, gateway, dns, etc. And if they are poe, that can be as simple as turning off poe on your switch for a second, etc.

[comet424]

@johnpoz i set the names in the Camera itself.. it has a section called "name" and they were all labeled camera

and the dhcp orginally in the arp table labled them "camera"
but i had changed the names in the cameras to
all from
camera

to cam1 cam2 so i figured the hostnames would change from camera to cam1 cam2 cam3
but it didnt especially after i did static ip

ill look up this dhcp reservation.

[comet424]

oh ok so dhcp is better

reason i went static incase pfsense goes down then cameras go down too... but then i learned about CARP

but figured if pfsense is down having static camera ips was better? always learning

and is dhcp reservation same meaning as "dhcp static mapping"