Layer 2 connection issue with Android to PC app
-
I see. People would usually have a dedicated router and put that behind the pfsense instead of having a modem/router combo sitting in front of it. I was planning on grabbing a router/AP already anyway eventually. Hopefully I can ask around here for the best way to set that up with the 1100 when I get there. @johnpoz
Also I believe the program uses port 4444 by default and I think I can change that.
-
@sessh well unless your blocking access on port 4444 in pfsense, your device on your lan where the default rules are any any should be able to talk to your phone/tablet on your wifi on the wan IP 192.168.0.x from its 192.168.1.x address.
What you wouldn't be able to do is talk from your wifi network to something behind pfsense on its lan without setting up a port forward.
You already have a router pfsense - you just need an AP.. I would suggest something that can do vlans.. So in the future if you want you can create multiple wifi networks that are on different networks.
the only reason a device on your lan say 192.168.1.x couldn't talk to 192.168.0.x:4444 would be if you altered the default lan rules. Or doing some sort of policy routing where your sending traffic on your pfsense lan out some vpn or something.
-
@johnpoz That's the thing though. I haven't changed any of the rules, I assume you're talking about the rules in Firewall / Rules / LAN in the pfsense UI right? It's all default. I had an issue where I needed to reinstall pfsense via USB which went successfully, so whatever got set during that process is what it's set at now. I didn't manually change anything myself. Even before having that issue, out of the box, this issue was present.
I actually can't even log into the modem's UI because it's at 192.168.0.39
-
So if I have this right, you're saying that unless I changed the default rules (I haven't), 192.168.0.3:4444 should have no issues connecting through the 1100. Yet this isn't working.
Am I to assume there are no rules or settings that can be put into place to allow this connection to happen or even to allow certain IP addresses from the 192.168.0.x network to pass through by the 1100? The only option is to buy a router/AP (I use those interchangeably because I am under the impression that almost all routers you can buy today can function as an AP) and that's all? It doesn't seem like that option would allow me to connect to the modem UI via 192.168.0.39 either based on this conversation. There's really no options here to make this work other than just removing the 1100 entirely?
-
@sessh said in Layer 2 connection issue with Android to PC app:
So if I have this right, you're saying that unless I changed the default rules (I haven't), 192.168.0.3:4444 should have no issues connecting through the 1100. Yet this isn't working.
No, johnpoz is saying you should have no issue connecting TO 192.168.0.3:4444 residing on the WAN side (LAN of Arris) FROM a browser on your pfsense LAN (192.168.1.NNN). Since this is an outgoing connection and similar to you accessing any webpage on the internet.
I actually can't even log into the modem's UI because it's at 192.168.0.39
This is strange however... and you are positive this is the IP of the modem? And is the WAN IP on pfsense also in the 192.168.0.N subnet, or do you have a public IP perhaps?
Am I to assume there are no rules or settings that can be put into place to allow this connection to happen or even to allow certain IP addresses from the 192.168.0.x network to pass through by the 1100?
It should work as long as the connection is inititated from inside pfsense (LAN side). However, for anything to connect with something on the LAN side of pfsense, you need to start opening ports. So if you had the PC on the 192.168.0 side, you would create a NAT rule opening port 4444 towards 192.168.1.3 (Android phone). Since this seems to be the direction Sweech is working?
The only option is to buy a router/AP (I use those interchangeably because I am under the impression that almost >all routers you can buy today can function as an AP) and that's all? It doesn't seem like that option would allow >me to connect to the modem UI via 192.168.0.39 either based on this conversation. There's really no options here >to make this work other than just removing the 1100 entirely?
As already pointed out, when upgrading to pfsense, you probably want to make use of it for everything, not just LAN connections. This would typically mean that you move wifi so that it resides on the LAN side of pfsense. Commonly some form of AP is used (as the are often cheaper than routers even if routers can function as APs). It also means turning off wifi on the ISP provided device, or in some cases ditching it alltogether and connecting directly into pfsense. Alternatively you turn on bridge mode on the Arris, which would give you a public IP on pfsense.
And as I already said, it's strange that you can't connect to the Arris UI, there shouldn't be anything blocking that.
-
@sessh the only think I could think of why you couldn't access the UI of your router in front of pfsense, is put it into bridge mode and pfsense gets a public IP? Or your using maybe a PPPoE type of connection on pfsense. Or you policy routing?
Does pfsense wan have an IP on the 192.168.0 network?
Oh other thing that could cause a problem is the mask on the 192.168 networks - are they both /24?
-
Ok wait.. just to clarify something before going further. When you say:
@johnpoz Or doing some sort of policy routing where your sending traffic on your pfsense lan out some vpn or something.
.. are you referring to having a VPN installed on the 1100 or having one involved at all on any of the devices connected to the 1100 LAN? I assumed it was the former, but there is one on the PC and one the phone (on 192.168.0). However, I have both Sweech and one of the browsers on the PC in split tunneling mode, so it shouldn't be affecting anything when using that browser? Is that wrong? I just verified that the one browser is using my real IP with the correct location. Even using that one, I still can't connect to 192.168.0.39.
The PC is connected via Ethernet to the 1100, so the PC is on the 192.168.1 side. The phone is on the 192.168.0 side along with the Arris. On the main pfsense Dashboard page where it lists the Interfaces on the bottom right, it says the WAN is 192.168.0.4 and the LAN is on 192.168.1.1.
I can connect to 192.168.0.39 and Sweech if I connect to the Arris via Ethernet or wireless using a laptop and I can access 192.168.0.39 from the phone, but then I can't connect to the 1100. It's either one or the other. So, I am positive that 192.168.0.39 is the IP to log into the Arris.
So provided there's no issues with that, I will try creating that NAT rule to open a port for Sweech.
-
@sessh Hmm, the split tunnel may not cover 192.168.0 network, only the 192.168.1 that the PC actually knows about. So what happens if you disable the VPN completely on the PC? I have that exact problem with my work PC...
-
@sessh said in Layer 2 connection issue with Android to PC app:
So provided there's no issues with that, I will try creating that NAT rule to open a port for Sweech.
you don't need a port forward for something on your lan talking to your wireless device.. But yeah a vpn on that device would mess that access.
Also if your going to create a port forward from your wifi to your lan behind pfsense, the vpn on the device on your lan would still mess with that.. And you would have to access your 192.168.0.x IP of pfsense wan that you forward to the 192.168.1.x on your pfsense lan.
-
@sessh said in Layer 2 connection issue with Android to PC app:
Ok wait.. just to clarify something before going further. When you say:
@johnpoz Or doing some sort of policy routing where your sending traffic on your pfsense lan out some vpn or something.
.. are you referring to having a VPN installed on the 1100 or having one involved at all on any of the devices connected to the 1100 LAN? I assumed it was the former, but there is one on the PC and one the phone (on 192.168.0). However, I have both Sweech and one of the browsers on the PC in split tunneling mode, so it shouldn't be affecting anything when using that browser? Is that wrong? I just verified that the one browser is using my real IP with the correct location. Even using that one, I still can't connect to 192.168.0.39.
If you are able to edit the settings for the VPN, then on the phone, you might need to add the 192.168.1.0/24 network to the IP range to EXCLUDE from VPN. And on the PC you definitely have to do the same, but here it is 192.168.0.0/24 network that should be excluded.
But a quicker way to test is from the PC where you simply disable the VPN and then try to log on to the Arris. -
@Gblenn said
Hmm, the split tunnel may not cover 192.168.0 network, only the 192.168.1 that the PC actually knows about. So what happens if you disable the VPN completely on the PC? I have that exact problem with my work PC...
This was correct. When i disable the VPN and try to access the Arris or Sweech, it allows me to do it from the PC. I use NordVPN and unfortunately, they don't seem to have made it easy to whitelist IP addresses at least on Windows. (I'm not yet on to Linux, but soon!) I might just switch VPN providers, I've kinda been looking for a reason anyway. It seems other VPNs make this a lot easier to do.
At any rate, I'm glad you guys were able to help me at least find out why this is happening even if I can't fix it via VPN whitelisting. Networking has always been a hole in my tech knowledge base, so perhaps it's time to improve on that. :)
-
@sessh and if you moved your wifi behind pfsense, you could just easy setup your vpn on pfsense, and then route whatever traffic/devices you want out the vpn via simple policy route. And not have any issues with your device talking to each other for stuff like this app, or any other thing. Unless you wanted to put them on different networks and actually firewall what they can do between your networks via firewall rules on pfsense.
-
@johnpoz I was considering that, but I would then lose the per-app split tunneling if I took it off the PC/Phone.
I will move the wifi behind pfsense when I get a chance. For a small home network, is there anything you (or anyone else here) would suggest AP wise?
If I put the VPN on the 1100, you're saying I could use simple policy routes to have full control over which devices used the VPN and which would be excluded from it? Kinda like tunneling? Would I even be able to select IP ranges to exclude like what was suggested above via the VPN?
-
@sessh said in Layer 2 connection issue with Android to PC app:
I will move the wifi behind pfsense when I get a chance. For a small home network, is there anything you (or anyone else here) would suggest AP wise?
@sessh What type and I guess "size" of AP depends a bit on what your home looks like, size and number of floors? And whether or not you have ethernet cabling anywhere?
You will get the best coverage and quality by doing some planning, and perhaps use more than one AP. Like opposite corners of the house and perhaps different floors, and that sort of thing.I use TPLink Omada AP's at home and Unifi at our vacation home. They seem pretty equal from a radio perspective, but I do think the Omada is slightly easier to manage.
Unifi on the other hand has a much more active community and forum's. You can host the controller SW for both systems on a VM or a and Raspberry Pi.
Like johnpoz suggested earlier, get a managed switch (Omada or Unifi) and perhaps with PoE, since that will give you more flexibility towards adding VLAN's and of course power your AP's.I don't like mesh systems, but perhaps the very latest and more expensive one's are ok.
I have never used NordVPN but their website sais they have Route Based Split Tunnel... So on Windows you should go to Settings, Split Tunnel and then Select Type. If that allows you to add an IP range, you could try to add the 192.168.0.0/24 network and see if things work. On Android you can select which apps to exclude, like the Sweech app...
-
@sessh said in Layer 2 connection issue with Android to PC app:
Would I even be able to select IP ranges to exclude like what was suggested above via the VPN?
Yes.. what uses or doesn't use the vpn would be simple firewall rules on pfsense.
https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html#policy-routing-configuration
-
@johnpoz said in Layer 2 connection issue with Android to PC app:
@sessh said in Layer 2 connection issue with Android to PC app:
Would I even be able to select IP ranges to exclude like what was suggested above via the VPN?
Yes.. what uses or doesn't use the vpn would be simple firewall rules on pfsense.
https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html#policy-routing-configuration
I guess the one thing that will prove more challenging is the tunneling per "app" that NordVPN can do when installed in the phone/PC.
Should be possible using pfblockerng to get the server IP's from ASN's to use in the policies. But it is a bit of work and at least I have found it challenging and a bit of hit and miss. But perhaps if one can flip it around and use only for a few applications to be excluded, it could work.
-
Will get TPLink Omada then when I'm ready to do that. Also this PC is still on Win7 (I've had difficulty pulling myself away from it, I love it) and will next be on Linux Mint, so the NordVPN software for WIn7 does not have the route tunneling feature, only app tunneling. Their software for Linux doesn't even have Split Tunneling at all, so I'd have to switch to something like Surfshark maybe. I was seeing people on Win10 posting stuff about how they couldn't figure out how to whitelist with Nord, but maybe that feature was a newer addition to the software. Either way, I see it's now included on Win10 and 11 in the UI.
Wow really? Tunneling per app is actually possible using pfsense? That's interesting. I only have a few things I use the tunneling for though. If that's possible, a killswitch should be workable too.
-
@sessh said in Layer 2 connection issue with Android to PC app:
Tunneling per app is actually possible using pfsense?
No, not sure where you got that Idea - you can policy route on anything you can get a firewall to trigger on, source IP or port, destination IP or port, protocol tcp/udp etc. Any combination of those.
But you can't say hey if chrome browser traffic route out a tunnel.. You could say anything going to 443 route out the tunnel.. But pfsense can't know if that is a browser creating that traffic, or some other app. etc.
You could say anything going to 443 to this IP or network route out the tunnel, etc. Anything else going to 443 don't route out the tunnel, etc.
If your so concerned about your isp seeing where your going, why not just route all traffic out the vpn?
-
@johnpoz I guess it was me who "gave sessh that idea".. talking about the use of pfBlocker, ASN and Alias to route based on destination IP.
Say for example you want to route everything except Netflix and YouTube via the VPN. Then you could exclude any traffic going to their servers. But you need help from pfblocker to figure out all the possible IP's, from their respective ASN's...And in that way you are at least mimicking the ability to "split tunnel" based on application...
-
@Gblenn true, if you know what networks application X wants to talk to - sure you can policy route based on that.