Plex through surfshark wireguard pfsense vpn
-
@Gblenn it is forwarded on pfsense, but my isp modem/router is not port forwarding to pfsense, so I’m wondering if that would be the problem
-
@jhmc93 Yes definitely, that would generally be a problem with any server or application that requires port forward.
Do you have to use your ISP's router at all? If your ISP only provides IP to a specific MAC address, you can always clone that and make pfsense look like it is the ISP router.
Otherwise, does your ISP router have something called "bridge mode" or "passthru mode"? If so, that will basically just pass on your public IP directly to WAN on pfsense.
If not, I'm guessing it should at least have DMZ, which essentially forwards all ports straight thru to pfsense. Preferably you should give pfsense a static IP since DMZ requires it to point to a specific IP on the ISP router LAN side.
Finally, if that is not available, you have to forward port 32400 to the IP of pfsense...
-
@Gblenn my ISP router is also my modem, so it’s gotta be running to provide my internet. Also my pfsense only has LAN ports but no WiFi access, so I use my WiFi devices on my ISP/ Modem router and my pfsense for my proxmox clusters that run my media servers.
I can use DMZ on my isp/ router so I’ll set that when I get home from my holiday. As right now I can only access my pfsense and proxmox servers. -
@jhmc93 Ah, so you are accessing pfsense remotely via your VPN? But then you should also be able to access your ISP router simply by adding it's IP range to the Allowed IP's list for your VPN client...
-
High risk though if you get it wrong!
-
@Gblenn I’m using Tailscale to access my pfsense
-
@jhmc93 said in Plex through surfshark wireguard pfsense vpn:
@Gblenn I’m using Tailscale to access my pfsense
Ok same thing though, you need to add the IP of the ISP router to the subnet routers' allowed IP's.
sudo tailscale up --advertise-routes=LAN-IP/24, ISP-router-IP/32 (or entire range)
And make sure it's also "approved" in the admin console. -
@Gblenn wouldn’t that be a security risk?
-
You only need to route the ISP routers internal subnet since that's how you would be accessing it.
However getting that config wrong could leave you unable to access anything until you get on site. That's the real risk IMO.
-
@stephenw10 IMO?, what if my machines are connected to lan pfsense is that command u put still valid for that ?
-
I didn't put a command. I would add it in the gui so you don't end up removing any other subnets you are routing.
-
@stephenw10 said in Plex through surfshark wireguard pfsense vpn:
I didn't put a command. I would add it in the gui so you don't end up removing any other subnets you are routing.
Yes you are right of course. I happen to run them on various Linux machines and execute the command sudo tailscale up with any additional settings.
In my case it's the --advertise-routes=xxx.xxx.xx.x/24,nnn.nnn.nn.n/24 which defines the subnets that I am allowing my clients to access.
If you deploy it in pfsense it's different. Simply click add and enter your ISP routers LAN IP or entire subnet after the existing subnets.
Then the subnets will be visible in the admin gui when you log into the tailscale admin console at https://login.tailscale.com
For your respective subnet router, on the right you can access and control which subnets will actually be allowed to be used.
-
@Gblenn but does a pc have to have Tailscale on the isp router/modem side for me to access it in my pfsense lan
-
No, pfSense is the client here. As long as it's WAN side subnet is routed by tailscale a remote client will be able to access it.
-
@stephenw10 how do I add the wan side in pfsense then?
-
As @Gblenn showed above. You need it to advertise that subnet to other tailscale clients that same as it's doing for the LAN.
But unless you really need this I would wait until you're on-site to revert any changes you might make accidentally.
-
@stephenw10 ok will have a go
-
@stephenw10 I have indirect connections on plex I don't know whether it's pfsense is causing it or not my setup is same as above
-
@jhmc93 What do you mean with "indirect connections"?
I tried reading through the thread to get back into the thinking here... Are you still running two separate networks with your wifi on the WAN side of pfsense?? Or have you cleaned it up so that you have everything on the correct side of pfsense?? -
@jhmc93 said in Plex through surfshark wireguard pfsense vpn:
my ISP router is also my modem, so it’s gotta be running to provide my internet. Also my pfsense only has LAN ports but no WiFi access, so I use my WiFi devices on my ISP/ Modem router and my pfsense for my proxmox clusters that run my media servers.
You are making your life hard imo.
Your system would be more maintainable if you-
Put your ISP Modem/Router in bridge mode, so it functions purely as a Modem
-
Use pfsense as your router / firewall for all your LAN
-
Use a dedicated device / Access point for your wifi
-
