Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    ATT Internet AIr

    Scheduled Pinned Locked Moved General pfSense Questions
    290 Posts 5 Posters 46.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S
      stephenw10 Netgate Administrator
      last edited by

      Yup exactly like that. 👍

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        Though the source port should be empty because that's the port the client uses to connect from which is usually some high numbered random port.

        Also you should se https (or both) if the router supports it.

        A 1 Reply Last reply Reply Quote 0
        • A
          ahole4sure @stephenw10
          last edited by

          @stephenw10
          So freaking weird
          I made the change of the source port and then I could no longer access http://192.168.2.1
          I can still ping the address

          So weird - I tried changing it back and it still wouldn't work
          hitting my head lolImage 11-10-24 at 6.32 PM.jpeg Image 11-10-24 at 6.32 PM (1).jpeg Image 11-10-24 at 6.33 PM.jpeg

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            Hmm, odd. Try removing the ports entirely. There's no real reason to specify a port there, all traffic between LAN and the modem would need to be NAT'd.

            A 1 Reply Last reply Reply Quote 0
            • A
              ahole4sure @stephenw10
              last edited by

              @stephenw10 Well I tried to remove all the port entries and still no success

              Whats really odd is that if I activate my Wireguard VPN into my network -- viola , I have access to http://192.168.2.1. (notice in my settings for the tunnel I have allowed IP ranges including 192.168.2.0/24

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                Hmm, almost sounds like that NAT rule is actually breaking the connection. Since with the source port set to 80 it would not have been matching the traffic.

                Try disabling the rule.

                A 2 Replies Last reply Reply Quote 0
                • A
                  ahole4sure @stephenw10
                  last edited by

                  @stephenw10 OMG!! That worked - after all that

                  Thanks again

                  1 Reply Last reply Reply Quote 0
                  • A
                    ahole4sure @stephenw10
                    last edited by

                    @stephenw10 Oddly I changed back to "Auto Mode" for Outbound NAT and it still workedImage 11-10-24 at 7.23 PM.jpeg

                    1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by

                      Hmm, interesting! That still using 192.168.2.1 to access it? It seems like the Nighthawk has a route to the public IP then. In which case that's no problem.

                      A 1 Reply Last reply Reply Quote 0
                      • A
                        ahole4sure @stephenw10
                        last edited by

                        @stephenw10 yes still using 192.168.2.1

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S
                          stephenw10 Netgate Administrator
                          last edited by

                          Should be fine then. Some modems do not require a NAT rules and can use the public IP on WAN to reply to.

                          A 1 Reply Last reply Reply Quote 0
                          • A
                            ahole4sure @stephenw10
                            last edited by

                            @stephenw10
                            Now that I have survived that ordeal , lol (with you help) - I have to replicate the process at our second location.

                            My pfsense device at that location only has 4 ethernet ports just like the one I have at location 1 - however, at location 2, I have all 4 ports used as per the pics. 2 are for security camera ports, one for and eero wifi and 1 for my NAS.

                            I have them on differnt networks.

                            What would be the best way to salvage my current equipment and still setup a failover internet (second WAN)? since my ports are filled
                            Image 11-12-24 at 11.43 AM.jpeg Image 11-12-24 at 11.58 AM.jpeg

                            A 1 Reply Last reply Reply Quote 0
                            • A
                              ahole4sure @ahole4sure
                              last edited by

                              @ahole4sure Image 11-12-24 at 11.54 AM.jpeg Image 11-12-24 at 11.54 AM (1).jpeg Image 11-12-24 at 11.55 AM.jpeg Image 11-12-24 at 11.55 AM.jpeg

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                Add a VLAN capable switch and use it to separate some ports is what I would do there.

                                It might be possible to use the eero device to do that if it supports VLANs.

                                I assume you need to be able to filter between those three interal interfaces with different rules for each?

                                A 1 Reply Last reply Reply Quote 1
                                • A
                                  ahole4sure @stephenw10
                                  last edited by

                                  @stephenw10
                                  Haven’t used VLAN for this but wanted to make sure == I could buy this $20 switch
                                  Change maybe my pFsense Camera interface to a VLAN parent interface?
                                  Connect to one of the switch ports
                                  And then have one port assigned as the Camera VLAN
                                  And then could I assign another VLAN port as the WAN2 connection for my ATT failover ??

                                  Would that work? Can a VLAN port be used as a WAN connection

                                  IMG_0847.jpeg

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    Yes exactly like that. The ports on the switch can be configured as access ports on different VLANs. The link to pfSense can carry all the VLANs. pfSense treats the VLANs as separate interfaces. And yes it can be a WAN, or any interface type.

                                    A 2 Replies Last reply Reply Quote 0
                                    • A
                                      ahole4sure @stephenw10
                                      last edited by

                                      @stephenw10 Perfect. thanks

                                      1 Reply Last reply Reply Quote 0
                                      • A
                                        ahole4sure @stephenw10
                                        last edited by

                                        @stephenw10

                                        Currently at my primary business location I have cameras on the same subnet as other devices - like the NAS, etc. My second business location as you might remember from above discussion has cameras on a seperate subnet.
                                        Ideally I would like to keep acessing my cameras with the Synology Surveillance station which is within my network. However an alternative is to use the camera manufacturer software - but that requires a port forward., to be accessed externally.

                                        Is there a way to open several LAN IP addresses to a specific port - or even entire subnet to a particular port ? Or do a I need to change each individual camera to a non-default individual port?

                                        Just trying to be the safest possible if I end up opening another port externally

                                        1 Reply Last reply Reply Quote 0
                                        • stephenw10S
                                          stephenw10 Netgate Administrator
                                          last edited by

                                          Hmm, well I would avoid opening port forwards to each camera like that if at all possible. Especially if they are on the same subnet as other local resources.

                                          To do it you would need to use a different external port for each camera and forward that to the internal camera IP. That way they can all be forwarded from the same external IP. But don't do that!

                                          A 1 Reply Last reply Reply Quote 0
                                          • A
                                            ahole4sure @stephenw10
                                            last edited by

                                            @stephenw10
                                            OK. Maybe I better just keep doing the VPN connection and use of surveillance station which is part of the Symbology NAS
                                            If that is the case and a VPN is used for external access with no open external ports is there really a strong security reason to have the cameras on a different subnet?

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.