Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    ATT Internet AIr

    Scheduled Pinned Locked Moved General pfSense Questions
    290 Posts 5 Posters 47.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      tman222 @ahole4sure
      last edited by

      @ahole4sure said in ATT Internet AIr:

      @tman222 @stephenw10
      Hey guys , it's me again! I finally got the primary solution to my problem -- I talked the ATT folks into taking the "business" (oxymoron imo) Intenet Air device back. We are going to use a Netgear Nighthawk M7 device - some sort of promo, new (for fastest 5G) AND allows IP Passthrough.

      The minute I connected and enable IP Pasthrough on the device - pFsense reported the static public IP address that ATT had given me and all of the incoming services worked great!
      THANKS for the help so far!
      Moral is ATT "Internet Air for Business" (latest release) does not allow for IP Passthrough and not a good option for failover if using pFsense.

      Now my question is this - on the front of the M7 gateway it states that you should be able to reach the settings page at the local address I initially set it up with - 192.168.2.1 (remembering that my pfsense is recognizing the M7 as a public IP) -- however, I can't seem to access the device from a LAN (192.168.1.x) device. I enabled an "alias" (of 192.168.2.1) for the WAN but still no joy.

      Suggestions??

      Hi @ahole4sure - great to hear you got IP Passthrough to work by using a third party cellular gateway. How does the performance compare of the Netgear vs. AT&T gateway, do you see any improvement?

      Assuming you have a public IP now on the second WAN interface for AT&T Internet Air, these instructions from @stephenw10 in the first post will work to access the gateway's configuration webpage. It's a combination of creating a VIP (virtual IP) and adding an outbound NAT rule:

      https://forum.netgate.com/topic/137747/access-to-the-modem-web-page

      Hope this helps.

      A 1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        Nice! Yup you probably need a VIP in the subnet and NAT rule so the nighthawk has a route to reply.

        1 Reply Last reply Reply Quote 0
        • A
          ahole4sure @tman222
          last edited by

          @tman222 @stephenw10
          Thanks guys
          For an Orthopedic surgeon this is a humbling process!! -- sure am thankful for your expertise

          Here is what I have
          I am able to ping 192.168.2.1 but not reach the gateway interface
          Screenshot 2024-11-10 165845.png Screenshot 2024-11-10 165706.png

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            The translation address in the outbound NAT rule needs to be the VIP not the WAN address. And that needs to be on the WAN. It's applied to traffic as it leaves the WAN interface.

            That rule you have above it seems odd, that shouldn't ever be required. Those are manually added outbound NAT rules?

            A 1 Reply Last reply Reply Quote 0
            • A
              ahole4sure @stephenw10
              last edited by

              @stephenw10
              Yes that is manually created based on the suggestions that I needed to create a outbound rule

              Is my VIP created correctly? My gateway says on the front that I can access the settings page by going to http://192.168.2.1 (so it would insinuate that it is infact accesible)

              Can you tell me how to create the outbound rule correctly - clearly I am not thinking about things correctly

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                The VIP is good as long as the Nighthawk is using a different IP in the 192.168.2.0/24 subnet.

                A 3 Replies Last reply Reply Quote 0
                • A
                  ahole4sure @stephenw10
                  last edited by

                  @stephenw10
                  So the Nighthawk is using 192.168.2.1
                  So my VIP needs to be somehting differnet in that subnet , like 192.168.2.10 ?

                  Then I gotta figure out the outbound rule thing

                  1 Reply Last reply Reply Quote 0
                  • A
                    ahole4sure @stephenw10
                    last edited by

                    @stephenw10
                    Should the VIP be setup on the WAN or the LAN interface??
                    Sorry probably sounds dumb

                    1 Reply Last reply Reply Quote 0
                    • A
                      ahole4sure @stephenw10
                      last edited by

                      @stephenw10 ok this finally worked --- look ok??

                      Screenshot 2024-11-10 175019.png Screenshot 2024-11-10 175001.png Screenshot 2024-11-10 174945.png Screenshot 2024-11-10 174930.png

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        Yup exactly like that. 👍

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S
                          stephenw10 Netgate Administrator
                          last edited by

                          Though the source port should be empty because that's the port the client uses to connect from which is usually some high numbered random port.

                          Also you should se https (or both) if the router supports it.

                          A 1 Reply Last reply Reply Quote 0
                          • A
                            ahole4sure @stephenw10
                            last edited by

                            @stephenw10
                            So freaking weird
                            I made the change of the source port and then I could no longer access http://192.168.2.1
                            I can still ping the address

                            So weird - I tried changing it back and it still wouldn't work
                            hitting my head lolImage 11-10-24 at 6.32 PM.jpeg Image 11-10-24 at 6.32 PM (1).jpeg Image 11-10-24 at 6.33 PM.jpeg

                            1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              Hmm, odd. Try removing the ports entirely. There's no real reason to specify a port there, all traffic between LAN and the modem would need to be NAT'd.

                              A 1 Reply Last reply Reply Quote 0
                              • A
                                ahole4sure @stephenw10
                                last edited by

                                @stephenw10 Well I tried to remove all the port entries and still no success

                                Whats really odd is that if I activate my Wireguard VPN into my network -- viola , I have access to http://192.168.2.1. (notice in my settings for the tunnel I have allowed IP ranges including 192.168.2.0/24

                                1 Reply Last reply Reply Quote 0
                                • stephenw10S
                                  stephenw10 Netgate Administrator
                                  last edited by

                                  Hmm, almost sounds like that NAT rule is actually breaking the connection. Since with the source port set to 80 it would not have been matching the traffic.

                                  Try disabling the rule.

                                  A 2 Replies Last reply Reply Quote 0
                                  • A
                                    ahole4sure @stephenw10
                                    last edited by

                                    @stephenw10 OMG!! That worked - after all that

                                    Thanks again

                                    1 Reply Last reply Reply Quote 0
                                    • A
                                      ahole4sure @stephenw10
                                      last edited by

                                      @stephenw10 Oddly I changed back to "Auto Mode" for Outbound NAT and it still workedImage 11-10-24 at 7.23 PM.jpeg

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        Hmm, interesting! That still using 192.168.2.1 to access it? It seems like the Nighthawk has a route to the public IP then. In which case that's no problem.

                                        A 1 Reply Last reply Reply Quote 0
                                        • A
                                          ahole4sure @stephenw10
                                          last edited by

                                          @stephenw10 yes still using 192.168.2.1

                                          1 Reply Last reply Reply Quote 0
                                          • stephenw10S
                                            stephenw10 Netgate Administrator
                                            last edited by

                                            Should be fine then. Some modems do not require a NAT rules and can use the public IP on WAN to reply to.

                                            A 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.