Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Secondary separate LAN on OPT1 with WAN access

    Scheduled Pinned Locked Moved General pfSense Questions
    10 Posts 2 Posters 394 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F
      Fandangos
      last edited by Fandangos

      Hello everyone,

      I'm trying to wrap my head around this and understand how to do this properly.
      The setup here is as follow:

      WAN and LAN properly configured on pfSense and working without any problem.
      Now I have a igc2 port and an old router here that I want to use for a complete separate network.

      my main LAN on igc1 is set to 10.27.33.xxx range of ips.
      pfSense gateway is 10.27.33.1.

      So the new LAN (OPT1) I'm setting DHCP on and setting the ip as 192.168.0.1/24
      the router is in bridge mode with DHCP disabled and set to 192.168.0.197.

      Is it possible to have 2 LANs like this?
      Right now I can't get any IP when connecting over WIFI to this new router.

      What I want in the end is: have a separate LAN that everything under in can see each other and can also access internet but can not see the 10.27.33.xxx LAN.

      EDIT:

      I had to enable the DHCP server on OPT1.
      And set OPT1 to static IPv4 as 192.168.0.1.

      Ok, it's working and now I can connect to it and get an ip address on this other network.

      Now.. I need to figure out how to let it access WAN, including unbound DNS and pfblockerNG.

      F 1 Reply Last reply Reply Quote 0
      • F
        Fandangos @Fandangos
        last edited by

        This are my settings on firewall:

        968fb18e-055f-444d-a1f0-47df2b7108fd-image.png

        I can access LAN <-> OPT1 which is what I did not want but I can't get internet to work on OPT1.

        pinging 8.8.8.8 isn't working either. So it's not a DNS forwarder issue which is configured to input ALL interfaces and output to ALL interfaces.

        F 1 Reply Last reply Reply Quote 0
        • F
          Fandangos @Fandangos
          last edited by

          Did a packet capture when trying to ping 8.8.8.8

          and

          23:38:21.591747 ARP, Request who-has 8.8.8.8 tell 192.168.0.10, length 46
          23:38:22.132178 ARP, Request who-has 8.8.8.8 tell 192.168.0.10, length 46
          23:38:23.136584 ARP, Request who-has 8.8.8.8 tell 192.168.0.10, length 46
          23:38:24.134020 ARP, Request who-has 8.8.8.8 tell 192.168.0.10, length 46
          23:38:25.130533 ARP, Request who-has 8.8.8.8 tell 192.168.0.10, length 46
          23:38:26.120836 ARP, Request who-has 8.8.8.8 tell 192.168.0.10, length 46
          23:38:27.131531 ARP, Request who-has 8.8.8.8 tell 192.168.0.10, length 46
          23:38:28.124257 ARP, Request who-has 8.8.8.8 tell 192.168.0.10, length 46
          23:38:29.125770 ARP, Request who-has 8.8.8.8 tell 192.168.0.10, length 46
          23:38:30.128332 ARP, Request who-has 8.8.8.8 tell 192.168.0.10, length 46
          23:38:31.128601 ARP, Request who-has 8.8.8.8 tell 192.168.0.10, length 46
          23:38:32.124133 ARP, Request who-has 8.8.8.8 tell 192.168.0.10, length 46
          23:38:36.435784 IP 192.168.0.10.57956 > 192.168.0.1.53: UDP, length 36
          23:38:36.435995 IP 192.168.0.1.53 > 192.168.0.10.57956: UDP, length 12
          23:38:36.439121 IP 192.168.0.10.62011 > 192.168.0.1.53: UDP, length 36
          23:38:36.439125 IP 192.168.0.10.63713 > 192.168.0.1.53: UDP, length 36
          23:38:36.439220 IP 192.168.0.1.53 > 192.168.0.10.62011: UDP, length 12
          23:38:36.439225 IP 192.168.0.1.53 > 192.168.0.10.63713: UDP, length 12
          23:38:36.452486 IP 192.168.0.10.63475 > 192.168.0.1.53: UDP, length 36
          23:38:36.452547 IP 192.168.0.1.53 > 192.168.0.10.63475: UDP, length 12
          23:38:36.455896 IP 192.168.0.10.63475 > 192.168.0.1.53: UDP, length 36
          23:38:36.455945 IP 192.168.0.1.53 > 192.168.0.10.63475: UDP, length 12
          23:38:36.459264 IP 192.168.0.10.63475 > 192.168.0.1.53: UDP, length 36
          23:38:36.459315 IP 192.168.0.1.53 > 192.168.0.10.63475: UDP, length 12
          23:38:36.462737 IP 192.168.0.10.63475 > 192.168.0.1.53: UDP, length 36
          23:38:36.462781 IP 192.168.0.1.53 > 192.168.0.10.63475: UDP, length 12
          23:38:36.466126 IP 192.168.0.10.63475 > 192.168.0.1.53: UDP, length 36
          23:38:36.466170 IP 192.168.0.1.53 > 192.168.0.10.63475: UDP, length 12
          23:38:36.469195 IP 192.168.0.10.50363 > 192.168.0.1.53: UDP, length 36
          23:38:36.469243 IP 192.168.0.1.53 > 192.168.0.10.50363: UDP, length 12
          23:38:36.472204 IP 192.168.0.10.50349 > 192.168.0.1.53: UDP, length 36
          23:38:36.472224 IP 192.168.0.10.53015 > 192.168.0.1.53: UDP, length 36
          23:38:36.472260 IP 192.168.0.1.53 > 192.168.0.10.50349: UDP, length 12
          23:38:36.472312 IP 192.168.0.1.53 > 192.168.0.10.53015: UDP, length 12
          23:38:36.475274 IP 192.168.0.10.61481 > 192.168.0.1.53: UDP, length 36
          23:38:36.475283 IP 192.168.0.10.54480 > 192.168.0.1.53: UDP, length 36
          23:38:36.475347 IP 192.168.0.1.53 > 192.168.0.10.61481: UDP, length 12
          23:38:36.475357 IP 192.168.0.1.53 > 192.168.0.10.54480: UDP, length 12
          23:38:36.478302 IP 192.168.0.10.54480 > 192.168.0.1.53: UDP, length 36
          23:38:36.478348 IP 192.168.0.1.53 > 192.168.0.10.54480: UDP, length 12
          23:38:36.481302 IP 192.168.0.10.54480 > 192.168.0.1.53: UDP, length 36
          23:38:36.481360 IP 192.168.0.1.53 > 192.168.0.10.54480: UDP, length 12
          23:38:36.484347 IP 192.168.0.10.54480 > 192.168.0.1.53: UDP, length 36
          23:38:36.484393 IP 192.168.0.1.53 > 192.168.0.10.54480: UDP, length 12
          23:38:36.487355 IP 192.168.0.10.54480 > 192.168.0.1.53: UDP, length 36
          23:38:36.487405 IP 192.168.0.1.53 > 192.168.0.10.54480: UDP, length 12

          DNS Resolver is excepted to receive at port 53..

          So still no idea what is going on here.

          F 1 Reply Last reply Reply Quote 0
          • F
            Fandangos @Fandangos
            last edited by

            Finally got it working!

            Had to reload DNS Resolver and it started working.
            Now I need to create proper rules to block access from one LAN to another and only have WAN access on OPT1.

            S 1 Reply Last reply Reply Quote 0
            • S
              SteveITS Galactic Empire @Fandangos
              last edited by

              @Fandangos this should help :)

              https://docs.netgate.com/pfsense/en/latest/solutions/netgate-4200/opt-lan.html

              DNS Resolver needs to know about/bind to the new interface.

              You probably don’t want to access WAN subnet, but the Internet (any).

              Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
              When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
              Upvote 👍 helpful posts!

              F 1 Reply Last reply Reply Quote 1
              • F
                Fandangos @SteveITS
                last edited by

                @SteveITS said in Secondary separate LAN on OPT1 with WAN access:

                https://docs.netgate.com/pfsense/en/latest/solutions/netgate-4200/opt-lan.html

                This is exactly what I was looking for!

                c1a17809-d58a-441b-96cb-4f17bb39d38d-image.png

                Now I can access from LAN to OPT1 but OPT1 can NOT access LAN and have internet access!

                I guess this isn't possible since it's not the gateway (pfsense) that controls the traffic inside a LAN but is it possible to block any client on this network to connect to each other?

                S 1 Reply Last reply Reply Quote 0
                • S
                  SteveITS Galactic Empire @Fandangos
                  last edited by

                  @Fandangos If you want OPT to access LAN then disable the privatenets block rule.

                  Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                  When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                  Upvote 👍 helpful posts!

                  F 1 Reply Last reply Reply Quote 0
                  • F
                    Fandangos @SteveITS
                    last edited by Fandangos

                    @SteveITS

                    actually what I want is for each device to not be able to see each other which is not possible without a manged switch.

                    But.. my router has this guest network option:

                    88c05862-ad94-495f-ad72-e2e80fb53cde-image.png

                    That prevents each device from accessing each other under the same guest network.

                    But for this to work I need to have DHCP server enabled on my router that is now just an access point in bridge mode.

                    Is it possible to have a router to connect with it's WAN port to pfsense, receive and IP, have a "sub" DHCP server and enable this feature?

                    Or this will cause more problems than it should?

                    S 1 Reply Last reply Reply Quote 0
                    • S
                      SteveITS Galactic Empire @Fandangos
                      last edited by

                      @Fandangos said in Secondary separate LAN on OPT1 with WAN access:

                      Is it possible to have a router to connect with it's WAN port to pfsense, receive and IP, have a "sub" DHCP server and enable this feature?

                      Sure. It's just its own network at that point so it can have its own router.

                      However you won't be able to prevent the guests from accessing LAN, and have the non-guests access LAN. If the TP-Link provides NAT then they are all the same "WAN" IP coming from the TP-Link.

                      Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                      When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                      Upvote 👍 helpful posts!

                      F 1 Reply Last reply Reply Quote 2
                      • F
                        Fandangos @SteveITS
                        last edited by

                        @SteveITS

                        Thank you for answering all my questions.

                        I just found a managed smart switch that I'll try to create a few VLANs here.
                        This forum always helps even if I'm too confused to properly put out my doubts.

                        So thank you.

                        1 Reply Last reply Reply Quote 1
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.