ATT Internet AIr

[ahole4sure]

@stephenw10
I guess I'm still confused since "forwarding" is still a sub-section under the main page of DNS Resolver and is a sub-setting under enabling DNS Resolver
From the explanantion as I understand it - it's like the setting page allows you to enable unbound or DNS Resolver and then bypass it (or disable it) all on the same page ??

[stephenw10]

There are two DNS services that can be enabled in pSense.

The 'DNS Resolver' is Unbound and that resolves directly but can be set to forward also.
The 'DNS Forwarder' is dnsmasq. It's what pfSense used by default in much older versions and is included for compatibility. It can only run as forwarder.

[ahole4sure]

@stephenw10
So whats the differnece beteween DNS Forwarder (which I do NOT have enabled ) and the DNS Query Forwarding - enable forwarding mode , which I do have enabled ??

[stephenw10]

Both will forward queries. dnsmasq is included for backwards compatibility with much older configs.

Unbound is a lot more flexible and powerful, even in forwarding mode. If you are using dns based filtering via pfBlocker-NG that can only use Unbound for example.

[ahole4sure]

@tman222
Hey sorry to bug you again - I was hoping you could answer some questions about your setup. I have tried diligently to get info about my “internet Air for Business” device and today the tech support rep that I finally was able to speak to state and read to me the disclaimer - “this device will support IP passthrough”.

I think because of this I am not able to obtain a public IP address when this device is connected to my pFsense router - thus the 192.168.2.2 address that I am getting with DHCP despite enabling the DMZ.

I run a few services behind my firewall that for failover to truly be functional I not only need the outgoing internet access but the incoming connection to those services is almost as essential!

Probably related - I was testing today and when I failed the primary internet WAN2 my DDNS service came up with an entirely differnt IP address than the one I would obtain my going to whatismyIP But even if went to cloudflare and manually set the IP address for my services domain names I was still unable to access them from outside.

Maybe you could share which “Internet Air” device you have had success with and the settings you have used for that device to get IP passthrough. Maybe I could trade mine for the type youare using

Thanks

[stephenw10]

If the DMZ works correctly then all traffic will be passed to pfSense and can be passed to something behind it. Since those services are already working behind pfSense in a private subnet they should work fine in that situation.

[ahole4sure]

@stephenw10 I think the big term here is IF!
How do I determine if DMZ is working correctly? The pfsense box only reports the local private IP for the ATT gateway - no public address.
Also if I fail the main internet , WAN2, then when I go to the DDNS page the IP address that is reported to Cloudflare is different than the IP address I get when I go to whatismyIP on a LAN computer. And different still than the IP report on the "status" page for the ATT gateway.

But most importantly when I turn off the DDNS function and manually change the Cloudflare DNS IP address for any of my services behind my HAProxy I am not able to reach them from outside. And I even have one service that is not behind Haproxy and just has a port forward (set in both the WAN and WAN2 rules) and I am not able to reach it either.

[stephenw10]

Send some traffic to the public IP and see if it arrives at pfSense.

Either send traffic directly from some other connection (cell phone etc) or use a port checker site. Then check the firewall logs in pfSense. Or run a pcap for that directly on the WAN.

[ahole4sure]

@stephenw10
Thanks again for help - I guess I should be more patient , failovbut I have only 2 hairs left lol

I have failed the main WAN2. The WAN is active and I get a differnt
is not IP address when I check whatsmyip on a LAN PC. The same IP (this time) appears in the DDNS. I try with a port checker on my phone port 443, and port 32400 which should be open AND I see no denials.

I think my ATT gateway is not forwarding into pfsense

[stephenw10]

You shouldn't have to failover to test it. Just use the public IP that the AT&T router has to test against.

That DMZ setting should override any NAT forwards you have set there, everything should be forwarded to 192.168.2.2.

You won't see it blocked in the firewall logs if you have rules to pass it though. You can enable logging on those pass rules though. Or test against a port you are not forwarding in pfSense so it will be blocked and appear in the logs.

[ahole4sure]

@stephenw10 Best I can tell nothing is getting through the ATT gateway
I can ping the "public" address of the ATT gateway but ~~seems to be making its way though the ATT gateway to the pfsense block -- nothing in the logs would indicate blocking ports that aren;t open and nothing gets through ports that supposedly are open.
And ALL port test say closed

[stephenw10]

Hmm, well that's not good. Something else that has to be applied in the AT&T router? Is the WAN IP it has actually a public IP?

[ahole4sure]

@stephenw10
Yes I believe it is
I can ping it publicly but can't get anything past the ATT router. I have DMZ set yo 192.168.2.2 but clearly its not getting there

I spoke to an upper level ATT guy late this afternoon - he said he would try to get me a "static IP" address , maybe that will help

[tman222]

@ahole4sure said in ATT Internet AIr:

@tman222
Hey sorry to bug you again - I was hoping you could answer some questions about your setup. I have tried diligently to get info about my “internet Air for Business” device and today the tech support rep that I finally was able to speak to state and read to me the disclaimer - “this device will support IP passthrough”.

I think because of this I am not able to obtain a public IP address when this device is connected to my pFsense router - thus the 192.168.2.2 address that I am getting with DHCP despite enabling the DMZ.

I run a few services behind my firewall that for failover to truly be functional I not only need the outgoing internet access but the incoming connection to those services is almost as essential!

Probably related - I was testing today and when I failed the primary internet WAN2 my DDNS service came up with an entirely differnt IP address than the one I would obtain my going to whatismyIP But even if went to cloudflare and manually set the IP address for my services domain names I was still unable to access them from outside.

Maybe you could share which “Internet Air” device you have had success with and the settings you have used for that device to get IP passthrough. Maybe I could trade mine for the type youare using

Thanks

Hi @ahole4sure

The gateway I received (for Internet Air residential service) was the CGW450-400. In the management interface under Firewall settings it has a separate IP Passthrough section where everything can be up. Does the gateway you received on the business side not have a section for IP Passthrough in the management interface settings somewhere?

Also, I wanted to confirm whether you are indeed receiving a public IP address from AT&T or whether it is Carrier-Grade NAT (CGNAT)? I have read that the Internet Air service uses both.

https://en.wikipedia.org/wiki/Carrier-grade_NAT

If you do not have a public IP address (i.e. it is CGNAT), I would call AT&T again and see if they can switch it. If you do have a public IP address and the gateway you received does not allow IP passthrough (I'd doublecheck with AT&T on this as well), there is always the option to explore purchasing a third party cellular gateway with IP passthrough support and using it with the SIM card that's currently in the AT&T gateway (assuming it's easy enough to access).

Hope this helps.

[ahole4sure]

@tman222

I think you have offered some very good advice and insight. I finally spoke to a manager late Friday afternoon and it was unclear whether my device will allow IP pass through or not BUT suggested that we put in for a static IP address (to possibly see if pass through could happen)
He also suggested that we could a different modem with the SIM card as well.

Do you have any knowledge of current best options for a 5g modem? Don’t really need WiFi but need a good antenna for optimum reception

[tman222]

@ahole4sure said in ATT Internet AIr:

@tman222

I think you have offered some very good advice and insight. I finally spoke to a manager late Friday afternoon and it was unclear whether my device will allow IP pass through or not BUT suggested that we put in for a static IP address (to possibly see if pass through could happen)
He also suggested that we could a different modem with the SIM card as well.

Do you have any knowledge of current best options for a 5g modem? Don’t really need WiFi but need a good antenna for optimum reception

Hi @ahole4sure - I'm admittedly not an expert on this subject, but here is a good video that compares a few different options for third party 5G cellular gateways (to help give you some idea):

https://www.youtube.com/watch?v=tDhxeUm3EqI

I've actually looked at the Chester Tech units myself, but couldn't really justify the expense given that the AT&T provided CGW450-400 gateway works fine and has a fairly strong signal to the tower already.

Hope this helps.

[ahole4sure]

@tman222 @stephenw10
Hey guys , it's me again! I finally got the primary solution to my problem -- I talked the ATT folks into taking the "business" (oxymoron imo) Intenet Air device back. We are going to use a Netgear Nighthawk M7 device - some sort of promo, new (for fastest 5G) AND allows IP Passthrough.

The minute I connected and enable IP Pasthrough on the device - pFsense reported the static public IP address that ATT had given me and all of the incoming services worked great!
THANKS for the help so far!
Moral is ATT "Internet Air for Business" (latest release) does not allow for IP Passthrough and not a good option for failover if using pFsense.

Now my question is this - on the front of the M7 gateway it states that you should be able to reach the settings page at the local address I initially set it up with - 192.168.2.1 (remembering that my pfsense is recognizing the M7 as a public IP) -- however, I can't seem to access the device from a LAN (192.168.1.x) device. I enabled an "alias" (of 192.168.2.1) for the WAN but still no joy.

Suggestions??

[tman222]

@ahole4sure said in ATT Internet AIr:

@tman222 @stephenw10
Hey guys , it's me again! I finally got the primary solution to my problem -- I talked the ATT folks into taking the "business" (oxymoron imo) Intenet Air device back. We are going to use a Netgear Nighthawk M7 device - some sort of promo, new (for fastest 5G) AND allows IP Passthrough.

The minute I connected and enable IP Pasthrough on the device - pFsense reported the static public IP address that ATT had given me and all of the incoming services worked great!
THANKS for the help so far!
Moral is ATT "Internet Air for Business" (latest release) does not allow for IP Passthrough and not a good option for failover if using pFsense.

Now my question is this - on the front of the M7 gateway it states that you should be able to reach the settings page at the local address I initially set it up with - 192.168.2.1 (remembering that my pfsense is recognizing the M7 as a public IP) -- however, I can't seem to access the device from a LAN (192.168.1.x) device. I enabled an "alias" (of 192.168.2.1) for the WAN but still no joy.

Suggestions??

Hi @ahole4sure - great to hear you got IP Passthrough to work by using a third party cellular gateway. How does the performance compare of the Netgear vs. AT&T gateway, do you see any improvement?

Assuming you have a public IP now on the second WAN interface for AT&T Internet Air, these instructions from @stephenw10 in the first post will work to access the gateway's configuration webpage. It's a combination of creating a VIP (virtual IP) and adding an outbound NAT rule:

https://forum.netgate.com/topic/137747/access-to-the-modem-web-page

Hope this helps.

[stephenw10]

Nice! Yup you probably need a VIP in the subnet and NAT rule so the nighthawk has a route to reply.

[ahole4sure]

@tman222 @stephenw10
Thanks guys
For an Orthopedic surgeon this is a humbling process!! -- sure am thankful for your expertise

Here is what I have
I am able to ping 192.168.2.1 but not reach the gateway interface