Layer 2 connection issue with Android to PC app
-
@sessh said in Layer 2 connection issue with Android to PC app:
So if I have this right, you're saying that unless I changed the default rules (I haven't), 192.168.0.3:4444 should have no issues connecting through the 1100. Yet this isn't working.
No, johnpoz is saying you should have no issue connecting TO 192.168.0.3:4444 residing on the WAN side (LAN of Arris) FROM a browser on your pfsense LAN (192.168.1.NNN). Since this is an outgoing connection and similar to you accessing any webpage on the internet.
I actually can't even log into the modem's UI because it's at 192.168.0.39
This is strange however... and you are positive this is the IP of the modem? And is the WAN IP on pfsense also in the 192.168.0.N subnet, or do you have a public IP perhaps?
Am I to assume there are no rules or settings that can be put into place to allow this connection to happen or even to allow certain IP addresses from the 192.168.0.x network to pass through by the 1100?
It should work as long as the connection is inititated from inside pfsense (LAN side). However, for anything to connect with something on the LAN side of pfsense, you need to start opening ports. So if you had the PC on the 192.168.0 side, you would create a NAT rule opening port 4444 towards 192.168.1.3 (Android phone). Since this seems to be the direction Sweech is working?
The only option is to buy a router/AP (I use those interchangeably because I am under the impression that almost >all routers you can buy today can function as an AP) and that's all? It doesn't seem like that option would allow >me to connect to the modem UI via 192.168.0.39 either based on this conversation. There's really no options here >to make this work other than just removing the 1100 entirely?
As already pointed out, when upgrading to pfsense, you probably want to make use of it for everything, not just LAN connections. This would typically mean that you move wifi so that it resides on the LAN side of pfsense. Commonly some form of AP is used (as the are often cheaper than routers even if routers can function as APs). It also means turning off wifi on the ISP provided device, or in some cases ditching it alltogether and connecting directly into pfsense. Alternatively you turn on bridge mode on the Arris, which would give you a public IP on pfsense.
And as I already said, it's strange that you can't connect to the Arris UI, there shouldn't be anything blocking that.
-
@sessh the only think I could think of why you couldn't access the UI of your router in front of pfsense, is put it into bridge mode and pfsense gets a public IP? Or your using maybe a PPPoE type of connection on pfsense. Or you policy routing?
Does pfsense wan have an IP on the 192.168.0 network?
Oh other thing that could cause a problem is the mask on the 192.168 networks - are they both /24?
-
Ok wait.. just to clarify something before going further. When you say:
@johnpoz Or doing some sort of policy routing where your sending traffic on your pfsense lan out some vpn or something.
.. are you referring to having a VPN installed on the 1100 or having one involved at all on any of the devices connected to the 1100 LAN? I assumed it was the former, but there is one on the PC and one the phone (on 192.168.0). However, I have both Sweech and one of the browsers on the PC in split tunneling mode, so it shouldn't be affecting anything when using that browser? Is that wrong? I just verified that the one browser is using my real IP with the correct location. Even using that one, I still can't connect to 192.168.0.39.
The PC is connected via Ethernet to the 1100, so the PC is on the 192.168.1 side. The phone is on the 192.168.0 side along with the Arris. On the main pfsense Dashboard page where it lists the Interfaces on the bottom right, it says the WAN is 192.168.0.4 and the LAN is on 192.168.1.1.
I can connect to 192.168.0.39 and Sweech if I connect to the Arris via Ethernet or wireless using a laptop and I can access 192.168.0.39 from the phone, but then I can't connect to the 1100. It's either one or the other. So, I am positive that 192.168.0.39 is the IP to log into the Arris.
So provided there's no issues with that, I will try creating that NAT rule to open a port for Sweech.
-
@sessh Hmm, the split tunnel may not cover 192.168.0 network, only the 192.168.1 that the PC actually knows about. So what happens if you disable the VPN completely on the PC? I have that exact problem with my work PC...
-
@sessh said in Layer 2 connection issue with Android to PC app:
So provided there's no issues with that, I will try creating that NAT rule to open a port for Sweech.
you don't need a port forward for something on your lan talking to your wireless device.. But yeah a vpn on that device would mess that access.
Also if your going to create a port forward from your wifi to your lan behind pfsense, the vpn on the device on your lan would still mess with that.. And you would have to access your 192.168.0.x IP of pfsense wan that you forward to the 192.168.1.x on your pfsense lan.
-
@sessh said in Layer 2 connection issue with Android to PC app:
Ok wait.. just to clarify something before going further. When you say:
@johnpoz Or doing some sort of policy routing where your sending traffic on your pfsense lan out some vpn or something.
.. are you referring to having a VPN installed on the 1100 or having one involved at all on any of the devices connected to the 1100 LAN? I assumed it was the former, but there is one on the PC and one the phone (on 192.168.0). However, I have both Sweech and one of the browsers on the PC in split tunneling mode, so it shouldn't be affecting anything when using that browser? Is that wrong? I just verified that the one browser is using my real IP with the correct location. Even using that one, I still can't connect to 192.168.0.39.
If you are able to edit the settings for the VPN, then on the phone, you might need to add the 192.168.1.0/24 network to the IP range to EXCLUDE from VPN. And on the PC you definitely have to do the same, but here it is 192.168.0.0/24 network that should be excluded.
But a quicker way to test is from the PC where you simply disable the VPN and then try to log on to the Arris. -
@Gblenn said
Hmm, the split tunnel may not cover 192.168.0 network, only the 192.168.1 that the PC actually knows about. So what happens if you disable the VPN completely on the PC? I have that exact problem with my work PC...
This was correct. When i disable the VPN and try to access the Arris or Sweech, it allows me to do it from the PC. I use NordVPN and unfortunately, they don't seem to have made it easy to whitelist IP addresses at least on Windows. (I'm not yet on to Linux, but soon!) I might just switch VPN providers, I've kinda been looking for a reason anyway. It seems other VPNs make this a lot easier to do.
At any rate, I'm glad you guys were able to help me at least find out why this is happening even if I can't fix it via VPN whitelisting. Networking has always been a hole in my tech knowledge base, so perhaps it's time to improve on that. :)
-
@sessh and if you moved your wifi behind pfsense, you could just easy setup your vpn on pfsense, and then route whatever traffic/devices you want out the vpn via simple policy route. And not have any issues with your device talking to each other for stuff like this app, or any other thing. Unless you wanted to put them on different networks and actually firewall what they can do between your networks via firewall rules on pfsense.
-
@johnpoz I was considering that, but I would then lose the per-app split tunneling if I took it off the PC/Phone.
I will move the wifi behind pfsense when I get a chance. For a small home network, is there anything you (or anyone else here) would suggest AP wise?
If I put the VPN on the 1100, you're saying I could use simple policy routes to have full control over which devices used the VPN and which would be excluded from it? Kinda like tunneling? Would I even be able to select IP ranges to exclude like what was suggested above via the VPN?
-
@sessh said in Layer 2 connection issue with Android to PC app:
I will move the wifi behind pfsense when I get a chance. For a small home network, is there anything you (or anyone else here) would suggest AP wise?
@sessh What type and I guess "size" of AP depends a bit on what your home looks like, size and number of floors? And whether or not you have ethernet cabling anywhere?
You will get the best coverage and quality by doing some planning, and perhaps use more than one AP. Like opposite corners of the house and perhaps different floors, and that sort of thing.I use TPLink Omada AP's at home and Unifi at our vacation home. They seem pretty equal from a radio perspective, but I do think the Omada is slightly easier to manage.
Unifi on the other hand has a much more active community and forum's. You can host the controller SW for both systems on a VM or a and Raspberry Pi.
Like johnpoz suggested earlier, get a managed switch (Omada or Unifi) and perhaps with PoE, since that will give you more flexibility towards adding VLAN's and of course power your AP's.I don't like mesh systems, but perhaps the very latest and more expensive one's are ok.
I have never used NordVPN but their website sais they have Route Based Split Tunnel... So on Windows you should go to Settings, Split Tunnel and then Select Type. If that allows you to add an IP range, you could try to add the 192.168.0.0/24 network and see if things work. On Android you can select which apps to exclude, like the Sweech app...
-
@sessh said in Layer 2 connection issue with Android to PC app:
Would I even be able to select IP ranges to exclude like what was suggested above via the VPN?
Yes.. what uses or doesn't use the vpn would be simple firewall rules on pfsense.
https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html#policy-routing-configuration
-
@johnpoz said in Layer 2 connection issue with Android to PC app:
@sessh said in Layer 2 connection issue with Android to PC app:
Would I even be able to select IP ranges to exclude like what was suggested above via the VPN?
Yes.. what uses or doesn't use the vpn would be simple firewall rules on pfsense.
https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html#policy-routing-configuration
I guess the one thing that will prove more challenging is the tunneling per "app" that NordVPN can do when installed in the phone/PC.
Should be possible using pfblockerng to get the server IP's from ASN's to use in the policies. But it is a bit of work and at least I have found it challenging and a bit of hit and miss. But perhaps if one can flip it around and use only for a few applications to be excluded, it could work.
-
Will get TPLink Omada then when I'm ready to do that. Also this PC is still on Win7 (I've had difficulty pulling myself away from it, I love it) and will next be on Linux Mint, so the NordVPN software for WIn7 does not have the route tunneling feature, only app tunneling. Their software for Linux doesn't even have Split Tunneling at all, so I'd have to switch to something like Surfshark maybe. I was seeing people on Win10 posting stuff about how they couldn't figure out how to whitelist with Nord, but maybe that feature was a newer addition to the software. Either way, I see it's now included on Win10 and 11 in the UI.
Wow really? Tunneling per app is actually possible using pfsense? That's interesting. I only have a few things I use the tunneling for though. If that's possible, a killswitch should be workable too.
-
@sessh said in Layer 2 connection issue with Android to PC app:
Tunneling per app is actually possible using pfsense?
No, not sure where you got that Idea - you can policy route on anything you can get a firewall to trigger on, source IP or port, destination IP or port, protocol tcp/udp etc. Any combination of those.
But you can't say hey if chrome browser traffic route out a tunnel.. You could say anything going to 443 route out the tunnel.. But pfsense can't know if that is a browser creating that traffic, or some other app. etc.
You could say anything going to 443 to this IP or network route out the tunnel, etc. Anything else going to 443 don't route out the tunnel, etc.
If your so concerned about your isp seeing where your going, why not just route all traffic out the vpn?
-
@johnpoz I guess it was me who "gave sessh that idea".. talking about the use of pfBlocker, ASN and Alias to route based on destination IP.
Say for example you want to route everything except Netflix and YouTube via the VPN. Then you could exclude any traffic going to their servers. But you need help from pfblocker to figure out all the possible IP's, from their respective ASN's...And in that way you are at least mimicking the ability to "split tunnel" based on application...
-
@Gblenn true, if you know what networks application X wants to talk to - sure you can policy route based on that.
-
Yeah i was referring to the pfBlocker/ASN/Alias thing Gblenn was talking about. My original intention was to do what you guys are suggesting and put the VPN on the Netgate, but I then realized I would lose some of the perks that the desktop/mobile app gave me (Tunneling, Killswitch etc).. but if those are possible to set up using pfBlocker/ASN/Alias, that sounds fun. When/if I decide to go that route, I may tag you in a new thread here and try to get that working.
I would want to exclude some devices from it, but I see that's possible too. I was considering getting SlingTV along with NHL Center Ice and I'd want to have that going through the VPN to get around local blackouts. Knowing all of this is possible was certainly worth it to learn. Really appreciate you guys taking the time to explain things to me.
-
@sessh you mention killswitch, that is also possible in pfsense, where if the vpn goes down - traffic that is suppose to go out the vpn will just die and not go out your normal internet connection.
-
@sessh said in Layer 2 connection issue with Android to PC app:
I would want to exclude some devices from it, but I see that's possible too. I was considering getting SlingTV along with NHL Center Ice and I'd want to have that going through the VPN to get around local blackouts.
It's quite simple as long as it has to do with all traffic related to a device (or it's IP rather). Then it doesn't matter if it's a SlingTV, GoogleTV or a PC even. Policy routing based on it's IP can send all traffic via the VPN, or exclude it from the VPN (if default is to use VPN for the entire home network).
And as johnpoz points out, if the tunnel goes down, traffic can be blocked so that it doesn't "leak"...
The difficult part is when you want to take some of the traffic from one IP, like when it's a PC or even a Google TV but only some selected streaming services and not others.
That's where you need to know the servers they connect to instead, and there can be many IP's... And the task to figure those IP's out can be done by pfblockerng, which can provide Aliases listing all IP's related to the ASN's that you need to provide. Again there can be multiple ASN's for some services even...I have played around a little with this and found it to be quite the challenge, and basically gave up. I wasn't after routing, but rather blocking and there are other simpler tools to use for that... depending on your needs.
-
Man that does sound like a pain. It also doesn't sound possible to really do per app tunneling like a dedicated VPN app can do particularly for things like web browsers whereas with something like Sweech that uses a narrow host address range plus a specific port number, it would be a piece of cake. I suppose I'd have to keep the desktop app for the PC, but the phone should be ok with it since it's just one app that needs to be configured.
