• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Access Modem GUI Behind Firewall

NAT
firewall rules nat rules interface gui access modem
5
107
8.9k
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • G
    Globaltrader312 @patient0
    last edited by Jun 22, 2024, 10:23 PM

    @patient0

    you're connecting to the internet by PPPoE using the Vigor167, yes? yes
    Are you able to connect to the internet right now with the pfSense? yes with all 3 WAN interfaces
    On what interface is PPPoE set? bge1
    The VIGOR interface is assigned to the same interface as the PPPoE? yes bge1
    Can you see the modem MAC and/or IP in the ARP table (Diagnostics > ARP table" yes
    When you connected using the Mac, did you assign the IP to your Mac yourself or did it get one? And the IP your Mac got was .192.168.5.x not 192.168.1.5? 192.168.1.1 is the default network for the Vigor according to the docu.

    when i connect to the mac i assign the ip manually in the settings with 192.168.5.3 login-to-view

    P J 2 Replies Last reply Jun 22, 2024, 10:29 PM Reply Quote 0
    • P
      patient0 @Globaltrader312
      last edited by Jun 22, 2024, 10:29 PM

      @Globaltrader312 Ok, then I'm out of ideas.

      In the ARP table you only see your own IP/MAC but not of the modem. Below is mine:
      login-to-view.

      Is there a route for 192.168.5.0/24 in the routing table (Diagnostics > Routes)?

      login-to-view

      Did you connect your Mac to the same port on Vigor that you now use to connect the pfSense?

      G J 2 Replies Last reply Jun 22, 2024, 11:12 PM Reply Quote 0
      • J
        JonathanLee
        last edited by JonathanLee Jun 22, 2024, 11:07 PM Jun 22, 2024, 10:56 PM

        Please look at the bottom of the modem for the 48bit MAC address and please see what IP is assigned to it in the ARP table.

        Also try to see if the modem will issue a dhcp address if you set that interface to dhcp and not static, see if that populates the arp table entry.

        G 1 Reply Last reply Jun 22, 2024, 11:15 PM Reply Quote 0
        • G
          Globaltrader312 @patient0
          last edited by Jun 22, 2024, 11:12 PM

          @patient0

          no no entry in routes

          login-to-view

          and yes if I connect the Mac to the same port it works

          J 1 Reply Last reply Jun 22, 2024, 11:13 PM Reply Quote 0
          • J
            JonathanLee @Globaltrader312
            last edited by JonathanLee Jun 22, 2024, 11:17 PM Jun 22, 2024, 11:13 PM

            @Globaltrader312 what does your iMac get as an IP address when directly connected? That demarcation point maybe provides layer 3 address via dhcp directly from that modem to the connected device, if it’s working automatically with a direct connected device open a term window and try ifconfig, and or windows command dos prompt ipconfig. If might issue layer 3 by dhcp and you have it static set to the wrong subnet on interface configuration page.

            1 Reply Last reply Reply Quote 0
            • G
              Globaltrader312 @JonathanLee
              last edited by Jun 22, 2024, 11:15 PM

              @JonathanLee

              so the modem has no DHCP server activated but only modem mode and private IP is only assigned manually.

              direct connection with Mac on the same port with manual ip configuration

              with 192.168.5.3. GW 192.168.5.1 and Dns 192.168.5.1 works

              same as with my ER 6P and ER 12 I used before the only difference with ER 6P and ER 12 was that I always had to run a second cable to the vigor but only because it can't do 2 assigment on the same ETH port.

              J 1 Reply Last reply Jun 22, 2024, 11:19 PM Reply Quote 0
              • J
                JonathanLee @Globaltrader312
                last edited by JonathanLee Jun 22, 2024, 11:22 PM Jun 22, 2024, 11:19 PM

                @Globaltrader312 set the static with the last octet as .3 if that address works. It doesn’t show in the arp table that is weird to me. Are you using a rollover cable, I don’t know if that is a thing anymore however your modem might want a rollover cable. You can also try to spoof the MAC address of the iMac on the interface to test if the arp entry populates. That gateway is that what you have set statically on the interface also?

                G 1 Reply Last reply Jun 22, 2024, 11:23 PM Reply Quote 0
                • G
                  Globaltrader312 @JonathanLee
                  last edited by Jun 22, 2024, 11:23 PM

                  @JonathanLee

                  I use a normal Ethernet cable, nothing more.

                  see photo this is what it looks like on the mac when i connect directly.

                  login-to-view

                  J 2 Replies Last reply Jun 22, 2024, 11:26 PM Reply Quote 1
                  • J
                    JonathanLee @Globaltrader312
                    last edited by JonathanLee Jun 22, 2024, 11:32 PM Jun 22, 2024, 11:26 PM

                    @Globaltrader312
                    Upstream gateway?? None?
                    login-to-view

                    What about 5.1?

                    G 1 Reply Last reply Jun 22, 2024, 11:32 PM Reply Quote 0
                    • J
                      JonathanLee @patient0
                      last edited by Jun 22, 2024, 11:28 PM

                      @patient0 what is your upstream gateway set as?

                      1 Reply Last reply Reply Quote 0
                      • J
                        JonathanLee @Globaltrader312
                        last edited by Jun 22, 2024, 11:31 PM

                        @Globaltrader312 said in Access Modem GUI Behind Firewall:

                        @patient0

                        you're connecting to the internet by PPPoE using the Vigor167, yes? yes
                        Are you able to connect to the internet right now with the pfSense? yes with all 3 WAN interfaces
                        On what interface is PPPoE set? bge1
                        The VIGOR interface is assigned to the same interface as the PPPoE? yes bge1
                        Can you see the modem MAC and/or IP in the ARP table (Diagnostics > ARP table" yes
                        When you connected using the Mac, did you assign the IP to your Mac yourself or did it get one? And the IP your Mac got was .192.168.5.x not 192.168.1.5? 192.168.1.1 is the default network for the Vigor according to the docu.

                        when i connect to the mac i assign the ip manually in the settings with 192.168.5.3 login-to-view

                        Is the gateway in the same subnet? It seems like we are isolating it to the gateway, can you do a tracert command and see when it fails? And or turn on logging and see what shows up when you try a connection to the gui?

                        1 Reply Last reply Reply Quote 0
                        • G
                          Globaltrader312 @JonathanLee
                          last edited by Jun 22, 2024, 11:32 PM

                          @JonathanLee
                          yes i have not selected an upstream gateway as it says so in the instructionslogin-to-view login-to-view

                          J 1 Reply Last reply Jun 22, 2024, 11:35 PM Reply Quote 0
                          • J
                            JonathanLee @Globaltrader312
                            last edited by Jun 22, 2024, 11:35 PM

                            @Globaltrader312 5.0/24 shows bge1 interface. Do you have acls on bge1 ?

                            G 1 Reply Last reply Jun 22, 2024, 11:39 PM Reply Quote 0
                            • J
                              JonathanLee @Globaltrader312
                              last edited by Jun 22, 2024, 11:38 PM

                              @Globaltrader312 so it’s not the modem it’s a pfSense configuration mix up, we need to isolate the interface and gateway

                              1 Reply Last reply Reply Quote 0
                              • G
                                Globaltrader312 @JonathanLee
                                last edited by Globaltrader312 Jun 22, 2024, 11:41 PM Jun 22, 2024, 11:39 PM

                                @JonathanLee no i have not set an ACL because it is not in the instructions login-to-view

                                I have created an upstream gateway with 192.168.5.1 for testing purposes, but unfortunately this does not work either

                                i just don't understand why the access doesn't work i followed the instructions 100%.

                                could it be the multi WAN setup?

                                J 2 Replies Last reply Jun 22, 2024, 11:48 PM Reply Quote 1
                                • J
                                  JonathanLee @Globaltrader312
                                  last edited by Jun 22, 2024, 11:41 PM

                                  This post is deleted!
                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    JonathanLee @Globaltrader312
                                    last edited by JonathanLee Jun 23, 2024, 12:05 AM Jun 22, 2024, 11:48 PM

                                    @Globaltrader312 That is a lot of hops for just a link to the modem something is off with the gateway and or nat. You show the .5.0/24 on bge1 also. I have not watched the video. Correct me if I am wrong you are just attempting to access the GUI on the modem from the LAN however you have 3 WANs one is VOIP you are attempting to access the .5.0/24 network from the VIGOR interface, however this network resides in the routing table on the bge2 what is bridged with bge1?

                                    login-to-view
                                    (shows interface bge1)

                                    How did you bridge this connection?

                                    login-to-view
                                    (shows loopback interface not bge1)

                                    login-to-view
                                    (Shows vigor not bge1)

                                    login-to-view
                                    (vigor showing .5.2/24)

                                    login-to-view
                                    (your acl shows a source network that is different its 192.168.1.0/24 how does clients get layer 3 on the vigor interface of 1.0 if you have it set to 5.0/24??)

                                    Please show how bge1 is configured.. Does bge1 show any ACLs configured?

                                    Keep in mind I am just trying to isolate this in my head I wish I could see more but it is what it is. I am thinking that bge2 has a mix up as the trace route can't even see the first hop

                                    G 1 Reply Last reply Jun 23, 2024, 12:10 AM Reply Quote 0
                                    • J
                                      JonathanLee @Globaltrader312
                                      last edited by JonathanLee Jun 23, 2024, 12:09 AM Jun 23, 2024, 12:08 AM

                                      @Globaltrader312 also try this with the source address as vigor and other interfaces I think you can set it that way. You have it listed as lan

                                      We want to trace route it from the interface you are using see below
                                      login-to-view

                                      You try others or just lan?
                                      login-to-view

                                      1 Reply Last reply Reply Quote 0
                                      • G
                                        Globaltrader312 @JonathanLee
                                        last edited by Jun 23, 2024, 12:10 AM

                                        @JonathanLee

                                        so I have 3 WAN

                                        WAN 1 bge0 DHCP
                                        WAN2 bge1 pppoe
                                        WAN 3 bge 2 DHCP

                                        i am trying to access the GUI only via the additional interface vigor which is also assigned to bge1

                                        the video describes the multi wan and failover configuration.

                                        can it be that if I have assigned the gateway group in the firewall as described in the video ? see

                                        login-to-view

                                        I have made the firewall config exactly according to the instructions there is souce nat the address of the Lan Subnet of the Pfsense

                                        this is 192.168.1.0/24

                                        and as destination nat I have set the subnet of the Vigor 192.168.5.3/24 now

                                        login-to-view

                                        J 1 Reply Last reply Jun 23, 2024, 12:30 AM Reply Quote 0
                                        • J
                                          JonathanLee @Globaltrader312
                                          last edited by JonathanLee Jun 23, 2024, 12:42 AM Jun 23, 2024, 12:30 AM

                                          @Globaltrader312

                                          For the lan rule it shows gateway any try to change it to WAN2, and move that rule to the top, they work consecutively, so it hits the first matching rule and stops, you show no traffic on that rule at all yet, that might fix it. I am not gonna lie I didn’t watch the video I am looking for isolating the issue it doesn’t show any hops on trace route change the order of that rule and see if that starts to show some logs. I think it hits that first rule and that is pushing it to the wrong gateway.

                                          Move this rule to the top.
                                          login-to-view

                                          It shows 0/0 bytes, so it is never reaching that rule. Put it on top to test it again and make sure it starts to show bytes the other any any rules are getting hit first thus gwv4 gateway is getting that request. Or fix the source addresses for the other rules

                                          G 1 Reply Last reply Jun 23, 2024, 12:42 AM Reply Quote 0
                                          33 out of 107
                                          • First post
                                            33/107
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.