Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Access Modem GUI Behind Firewall

    NAT
    firewall rules nat rules interface gui access modem
    5
    107
    9.0k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • G
      Globaltrader312 @patient0
      last edited by

      @patient0

      you're connecting to the internet by PPPoE using the Vigor167, yes? yes
      Are you able to connect to the internet right now with the pfSense? yes with all 3 WAN interfaces
      On what interface is PPPoE set? bge1
      The VIGOR interface is assigned to the same interface as the PPPoE? yes bge1
      Can you see the modem MAC and/or IP in the ARP table (Diagnostics > ARP table" yes
      When you connected using the Mac, did you assign the IP to your Mac yourself or did it get one? And the IP your Mac got was .192.168.5.x not 192.168.1.5? 192.168.1.1 is the default network for the Vigor according to the docu.

      when i connect to the mac i assign the ip manually in the settings with 192.168.5.3 Bildschirmfoto 2024-06-23 um 00.22.27.png

      patient0P JonathanLeeJ 2 Replies Last reply Reply Quote 0
      • patient0P
        patient0 @Globaltrader312
        last edited by

        @Globaltrader312 Ok, then I'm out of ideas.

        In the ARP table you only see your own IP/MAC but not of the modem. Below is mine:
        Screenshot 2024-06-23 at 00.25.48.png.

        Is there a route for 192.168.5.0/24 in the routing table (Diagnostics > Routes)?

        Screenshot 2024-06-23 at 00.28.03.png

        Did you connect your Mac to the same port on Vigor that you now use to connect the pfSense?

        G JonathanLeeJ 2 Replies Last reply Reply Quote 0
        • JonathanLeeJ
          JonathanLee
          last edited by JonathanLee

          Please look at the bottom of the modem for the 48bit MAC address and please see what IP is assigned to it in the ARP table.

          Also try to see if the modem will issue a dhcp address if you set that interface to dhcp and not static, see if that populates the arp table entry.

          G 1 Reply Last reply Reply Quote 0
          • G
            Globaltrader312 @patient0
            last edited by

            @patient0

            no no entry in routes

            Bildschirmfoto 2024-06-23 um 01.11.34.png

            and yes if I connect the Mac to the same port it works

            JonathanLeeJ 1 Reply Last reply Reply Quote 0
            • JonathanLeeJ
              JonathanLee @Globaltrader312
              last edited by JonathanLee

              @Globaltrader312 what does your iMac get as an IP address when directly connected? That demarcation point maybe provides layer 3 address via dhcp directly from that modem to the connected device, if it’s working automatically with a direct connected device open a term window and try ifconfig, and or windows command dos prompt ipconfig. If might issue layer 3 by dhcp and you have it static set to the wrong subnet on interface configuration page.

              1 Reply Last reply Reply Quote 0
              • G
                Globaltrader312 @JonathanLee
                last edited by

                @JonathanLee

                so the modem has no DHCP server activated but only modem mode and private IP is only assigned manually.

                direct connection with Mac on the same port with manual ip configuration

                with 192.168.5.3. GW 192.168.5.1 and Dns 192.168.5.1 works

                same as with my ER 6P and ER 12 I used before the only difference with ER 6P and ER 12 was that I always had to run a second cable to the vigor but only because it can't do 2 assigment on the same ETH port.

                JonathanLeeJ 1 Reply Last reply Reply Quote 0
                • JonathanLeeJ
                  JonathanLee @Globaltrader312
                  last edited by JonathanLee

                  @Globaltrader312 set the static with the last octet as .3 if that address works. It doesn’t show in the arp table that is weird to me. Are you using a rollover cable, I don’t know if that is a thing anymore however your modem might want a rollover cable. You can also try to spoof the MAC address of the iMac on the interface to test if the arp entry populates. That gateway is that what you have set statically on the interface also?

                  G 1 Reply Last reply Reply Quote 0
                  • G
                    Globaltrader312 @JonathanLee
                    last edited by

                    @JonathanLee

                    I use a normal Ethernet cable, nothing more.

                    see photo this is what it looks like on the mac when i connect directly.

                    Bildschirmfoto 2024-06-23 um 01.18.31.png

                    JonathanLeeJ 2 Replies Last reply Reply Quote 1
                    • JonathanLeeJ
                      JonathanLee @Globaltrader312
                      last edited by JonathanLee

                      @Globaltrader312
                      Upstream gateway?? None?
                      IMG_0859.jpeg

                      What about 5.1?

                      G 1 Reply Last reply Reply Quote 0
                      • JonathanLeeJ
                        JonathanLee @patient0
                        last edited by

                        @patient0 what is your upstream gateway set as?

                        1 Reply Last reply Reply Quote 0
                        • JonathanLeeJ
                          JonathanLee @Globaltrader312
                          last edited by

                          @Globaltrader312 said in Access Modem GUI Behind Firewall:

                          @patient0

                          you're connecting to the internet by PPPoE using the Vigor167, yes? yes
                          Are you able to connect to the internet right now with the pfSense? yes with all 3 WAN interfaces
                          On what interface is PPPoE set? bge1
                          The VIGOR interface is assigned to the same interface as the PPPoE? yes bge1
                          Can you see the modem MAC and/or IP in the ARP table (Diagnostics > ARP table" yes
                          When you connected using the Mac, did you assign the IP to your Mac yourself or did it get one? And the IP your Mac got was .192.168.5.x not 192.168.1.5? 192.168.1.1 is the default network for the Vigor according to the docu.

                          when i connect to the mac i assign the ip manually in the settings with 192.168.5.3 Bildschirmfoto 2024-06-23 um 00.22.27.png

                          Is the gateway in the same subnet? It seems like we are isolating it to the gateway, can you do a tracert command and see when it fails? And or turn on logging and see what shows up when you try a connection to the gui?

                          1 Reply Last reply Reply Quote 0
                          • G
                            Globaltrader312 @JonathanLee
                            last edited by

                            @JonathanLee
                            yes i have not selected an upstream gateway as it says so in the instructionsBildschirmfoto 2024-06-23 um 01.29.39.png Bildschirmfoto 2024-06-23 um 01.32.16.png

                            JonathanLeeJ 1 Reply Last reply Reply Quote 0
                            • JonathanLeeJ
                              JonathanLee @Globaltrader312
                              last edited by

                              @Globaltrader312 5.0/24 shows bge1 interface. Do you have acls on bge1 ?

                              G 1 Reply Last reply Reply Quote 0
                              • JonathanLeeJ
                                JonathanLee @Globaltrader312
                                last edited by

                                @Globaltrader312 so it’s not the modem it’s a pfSense configuration mix up, we need to isolate the interface and gateway

                                1 Reply Last reply Reply Quote 0
                                • G
                                  Globaltrader312 @JonathanLee
                                  last edited by Globaltrader312

                                  @JonathanLee no i have not set an ACL because it is not in the instructions Bildschirmfoto 2024-06-23 um 01.39.20.png

                                  I have created an upstream gateway with 192.168.5.1 for testing purposes, but unfortunately this does not work either

                                  i just don't understand why the access doesn't work i followed the instructions 100%.

                                  could it be the multi WAN setup?

                                  JonathanLeeJ 2 Replies Last reply Reply Quote 1
                                  • JonathanLeeJ
                                    JonathanLee @Globaltrader312
                                    last edited by

                                    This post is deleted!
                                    1 Reply Last reply Reply Quote 0
                                    • JonathanLeeJ
                                      JonathanLee @Globaltrader312
                                      last edited by JonathanLee

                                      @Globaltrader312 That is a lot of hops for just a link to the modem something is off with the gateway and or nat. You show the .5.0/24 on bge1 also. I have not watched the video. Correct me if I am wrong you are just attempting to access the GUI on the modem from the LAN however you have 3 WANs one is VOIP you are attempting to access the .5.0/24 network from the VIGOR interface, however this network resides in the routing table on the bge2 what is bridged with bge1?

                                      Screenshot 2024-06-22 at 16.49.10.png
                                      (shows interface bge1)

                                      How did you bridge this connection?

                                      Screenshot 2024-06-22 at 16.51.34.png
                                      (shows loopback interface not bge1)

                                      Screenshot 2024-06-22 at 16.54.55.png
                                      (Shows vigor not bge1)

                                      Screenshot 2024-06-22 at 16.58.37.png
                                      (vigor showing .5.2/24)

                                      Screenshot 2024-06-22 at 16.59.25.png
                                      (your acl shows a source network that is different its 192.168.1.0/24 how does clients get layer 3 on the vigor interface of 1.0 if you have it set to 5.0/24??)

                                      Please show how bge1 is configured.. Does bge1 show any ACLs configured?

                                      Keep in mind I am just trying to isolate this in my head I wish I could see more but it is what it is. I am thinking that bge2 has a mix up as the trace route can't even see the first hop

                                      G 1 Reply Last reply Reply Quote 0
                                      • JonathanLeeJ
                                        JonathanLee @Globaltrader312
                                        last edited by JonathanLee

                                        @Globaltrader312 also try this with the source address as vigor and other interfaces I think you can set it that way. You have it listed as lan

                                        We want to trace route it from the interface you are using see below
                                        Screenshot 2024-06-22 at 17.08.40.png

                                        You try others or just lan?
                                        Screenshot 2024-06-22 at 17.09.24.png

                                        1 Reply Last reply Reply Quote 0
                                        • G
                                          Globaltrader312 @JonathanLee
                                          last edited by

                                          @JonathanLee

                                          so I have 3 WAN

                                          WAN 1 bge0 DHCP
                                          WAN2 bge1 pppoe
                                          WAN 3 bge 2 DHCP

                                          i am trying to access the GUI only via the additional interface vigor which is also assigned to bge1

                                          the video describes the multi wan and failover configuration.

                                          can it be that if I have assigned the gateway group in the firewall as described in the video ? see

                                          Bildschirmfoto 2024-06-23 um 01.58.29.png

                                          I have made the firewall config exactly according to the instructions there is souce nat the address of the Lan Subnet of the Pfsense

                                          this is 192.168.1.0/24

                                          and as destination nat I have set the subnet of the Vigor 192.168.5.3/24 now

                                          Bildschirmfoto 2024-06-23 um 02.10.38.png

                                          JonathanLeeJ 1 Reply Last reply Reply Quote 0
                                          • JonathanLeeJ
                                            JonathanLee @Globaltrader312
                                            last edited by JonathanLee

                                            @Globaltrader312

                                            For the lan rule it shows gateway any try to change it to WAN2, and move that rule to the top, they work consecutively, so it hits the first matching rule and stops, you show no traffic on that rule at all yet, that might fix it. I am not gonna lie I didn’t watch the video I am looking for isolating the issue it doesn’t show any hops on trace route change the order of that rule and see if that starts to show some logs. I think it hits that first rule and that is pushing it to the wrong gateway.

                                            Move this rule to the top.
                                            IMG_0860.jpeg

                                            It shows 0/0 bytes, so it is never reaching that rule. Put it on top to test it again and make sure it starts to show bytes the other any any rules are getting hit first thus gwv4 gateway is getting that request. Or fix the source addresses for the other rules

                                            G 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.