Pfsense and Router
-
This post is deleted! -
@viragomann What is better and safely regarding my topic question?
-
@antibiotic
That's not a question of better or safer for me, it's on your own proclivity, how you want it to configure.If you need incoming traffic for devices behind to second router and you forward it on pfSense to the router, you need to have a static IP on the .
But you can as well achieve this by a static mapping in the DHCP server settings and configure the router as DHCP client. -
@antibiotic
That's not a question of better or safer for me, it's on your own proclivity, how you want it to configure.If you need incoming traffic for devices behind to second router and you forward it on pfSense to the router, you need to have a static IP on it.
But you can as well achieve this by a static mapping in the DHCP server settings and configure the router as DHCP client. -
This post is deleted! -
@viragomann Generally asking about all of this , because wanna use ntopng for my local network and afraid will i see my home router itself there? My home router working as WiFi AP as well, will have records about WiFi connections in ntopng? Lets say my kids connected to WiFi on this router and will i see in ntopng , where they are going? If will use static IP on router as describe in your previous reply like a first option.
-
@antibiotic
As @chpalmer already suspected, your secondary router seems not to be configured as a router for the devices connected to it.
Obviously all connected ports of it are member of the LAN bridge (br-lan). Otherwise pfSense would could only hand out DHCP leases for the devices behind it if you have enabled to DHCP relay on the OpenWRT.If you want to run it as router, connect its WAN to pfSense, let the home router do the DHCP server for the devices connected to it (wifi or other) or enable the DHCP relay and disable the outbound NAT.
Then you have to configure the outbound NAT for the network behind the router on pfSense manually, cause pfSense doesn't know this network and add a static route on pfSense for the network and point it to the home routers WAN IP.
Then you will also see the IPs behind the home router on pfSense and can filter them.But if you whole intention is to use it for wifi and to connect other devices to its switch, you don't need to switch it in the router mode can and leave the connection as it is.
-
@viragomann said in Pfsense and Router:
Otherwise pfSense would could only hand out DHCP leases for the devices behind it if you have enabled to DHCP relay on the OpenWRT.
I think DHCP relay working , beacuse can see DHCP leases for the devices behind WiFi router. But Firewall - NAT Rules are completely empty on this router. Is it normal? If my whole intention is to use it for wifi and to connect other devices to its switch.
-
@antibiotic
We tried hard to find out if your OpenWrt is configured as a router or as a switch. But we cannot tell you. You should know this, since you had set it up .But simple to determine:
router: wifi devices are in a different subnet than the LAN interface.
switch: they are within the same subnet (L2) -
For the home router it sounds like you are using it to be your WiFi access to the network. If that is the case then set it as an Access Point in OpenWRT. That should disable DHCP on the router and still offer WiFi. Keep your connection to the pfSense box as a LAN to LAN connection. Set your router (which is now an Access Point) to get its IP from DHCP or set a static IP.
Your Access Point should now serve up WiFi and pass through requests for IP addresses to the pfSense box DHCP. This arrangement will collect the WiFi connections and pass them on to the pfSense firewall.
So for what is connected to what:
- Connect pfSense box to ISP on it’s WAN port
- Connect the WiFi Access Point (no longer a router) to pfSense via LAN port
- WiFi clients will connect to Access Point
-
It sounds like you're using the OpenWRT device just as a switch as access point. And in that case what you're seeing is expected and I would change nothing.
Steve
-
With OpenWRT you will be able also to create a so called WiFi extender or WiFi repeater, if you have done so, you
may be running now into the so called hidden station problem to point it to the not able to see the OpenWRT device from your pfSense.So in normal it would be the best thing to set up pfSense
at the WAN (behind ISP Modem) and setup the OpenWRT
as a WiFi AP in my eyes. So the AP gets also a IP address
and this will be normally static. All the routing is done by the pfSense alone. -
Big thanks' to all for useful tips!
