Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Routing to 192.168.100.1 (cable modem) across pfSense WAN interface

    Scheduled Pinned Locked Moved General pfSense Questions
    15 Posts 6 Posters 992 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • chpalmerC
      chpalmer @jhg
      last edited by

      @jhg pfsense does not block outbound connections to any address by default. 192.168.100.1 is a very popular address for cable modems and works in every instance I have ever been employed to work on.

      In some cases though the ISP can block your access or even make it so the modem cannot respond upstream out of the network (192.168.100.0/24) so that the only way you can see it is being on that network. Steve's recommendation above would get by that..

      But to drill that in.. pfsense by default will allow you to see your cable modem's GUI from devices behind pfsense.

      Triggering snowflakes one by one..
      Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

      J 1 Reply Last reply Reply Quote 0
      • J
        jhg @chpalmer
        last edited by

        @chpalmer said in Routing to 10.0.0.1 (cable modem) across pfSense WAN interface:

        @jhg pfsense does not block outbound connections to any address by default. 192.168.100.1 is a very popular address for cable modems and works in every instance I have ever been employed to work on.

        In some cases though the ISP can block your access or even make it so the modem cannot respond upstream out of the network (192.168.100.0/24) so that the only way you can see it is being on that network. Steve's recommendation above would get by that..

        But to drill that in.. pfsense by default will allow you to see your cable modem's GUI from devices behind pfsense.

        That's always worked for Xfinity modems because they'll accept incoming traffic on their LAN port from any address. I stopped paying Comcast's rental fee and bought a Hitron CODA56 (which works great). However, it requires the traffic to its web interface to have a source IP in the 192.168.100.0/24 netblock, and refuses to respond to anything else. This is documented in various places including Hitron's FAQs.

        I did get it working after reading the "fine print" in the VIP setup page.

        pfSense CE on Beelink EQ12 (N100 CPU, dual 2.5Gbe Intel NICs)
        Hitron CODA56 - Comcast 2.5Gb cable

        1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          Yes a lot of cable modems will respond on the management IP without needing a VIP like that because pfSense will NAT to it's WAN address and the modem knows where that is. Most PPPoE modems cannot though as the PPPoE connection bypasses it entirely.

          I would have expected /24 to work there since that's in the subnet.

          J 1 Reply Last reply Reply Quote 1
          • J
            jhg @stephenw10
            last edited by

            @stephenw10 said in Routing to 10.0.0.1 (cable modem) across pfSense WAN interface:

            I would have expected /24 to work there since that's in the subnet.

            That's what I thought until I went back and read this:
            2024-07-09_17-28-50.PNG

            pfSense CE on Beelink EQ12 (N100 CPU, dual 2.5Gbe Intel NICs)
            Hitron CODA56 - Comcast 2.5Gb cable

            K 1 Reply Last reply Reply Quote 1
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              The only thing that should matter there is that the device you're trying to connect to is inside the subnet defined by the mask so it's able to ARP for it. If it was a much smaller mask the target device might not be able to reply but that isn't the case here.

              J 1 Reply Last reply Reply Quote 0
              • K
                kurtz_p @jhg
                last edited by kurtz_p

                @jhg Thank you, I verified my WAN interface subnet matched it with the Virtual IP address and it I could get to the modem. Without this little bit of information it would not work.

                1 Reply Last reply Reply Quote 0
                • J
                  jhg @stephenw10
                  last edited by

                  @stephenw10 said in Routing to 10.0.0.1 (cable modem) across pfSense WAN interface:

                  The only thing that should matter there is that the device you're trying to connect to is inside the subnet defined by the mask so it's able to ARP for it. If it was a much smaller mask the target device might not be able to reply but that isn't the case here.

                  I agree it shouldn't matter, but for some reason it does.

                  pfSense CE on Beelink EQ12 (N100 CPU, dual 2.5Gbe Intel NICs)
                  Hitron CODA56 - Comcast 2.5Gb cable

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    Hmm, weird. I can't see how the modem would know or care what the client mask is.

                    johnpozJ 1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @stephenw10
                      last edited by johnpoz

                      Not sure what you think is happening here.. But I access my cable modem on 192.168.100.1 and mask of my public IP makes no difference.. How would it..

                      Mask doesn't matter anyway when 2 devices that talk to each other.. You can for sure can have a mismatch and still talk, as long as both devices think the other device is on their local network..

                      You could for sure have say a 192.168.100.1 and .2 talk to each other when one had a /24 mask and the other had a /25 or /16 or whatever.. Where you run into trouble is when one side doesn't think the other IP is on its own network.

                      The mask on my vip is /24 and the mask I get on my public IP is a /20

                      vip.jpg
                      mask.jpg

                      I ran into something weird a while back where disable reply to on my floating rule above my deny other rfc1918 being a good netizen and blocking noise from entering the internet.

                      disablerply.jpg

                      But It makes no sense that mask on your wan interface, or mask on your vip would matter in the least as long as the modem thinks your vip is on the same network as it. And when pfsense is wanting to talk to the 100.1 that it thinks that is on the same network as its vip.

                      modem.jpg

                      edit.. btw I just removed the vip and disabled my outbound rules for both the vip and blocking the rfc, no outbound nat rule to my vip, etc.. And I can still talk to my cable modem..

                      vipgone.jpg

                      I just had those in there because I was helping someone else out that was having the weirdness about the replyto and wanted to be able to replicate his setup..

                      modemip.jpg

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      K 1 Reply Last reply Reply Quote 1
                      • K
                        kurtz_p @johnpoz
                        last edited by

                        @johnpoz I don't think it matter now either, because I changed the mask to 192.168.100.0/24 and Virtual IP to the same and it works. I think the web interface on the Hiltron CODA56 running SW Version 7.3.5.0.1b5 seems like its goes unresponsive. I rebooted the modem and the web interface was back. Seems like they had issue with older code, but pfsense is working as it should.

                        1 Reply Last reply Reply Quote 1
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.