Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    ATT Internet AIr

    Scheduled Pinned Locked Moved General pfSense Questions
    290 Posts 5 Posters 46.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      ahole4sure @stephenw10
      last edited by

      @stephenw10

      Thanks again
      I made the changes that I thought you suggested. It appears things worked - my testing with both the ATT devices gave some squirrley results as far as consistency but I think it at least worked.

      What didn't happen was that with the modem connected through the switch and setting the VLAN(10) interface to DHCP it still didn't recieve the IP address (Local or public) and didn't create a gateway. However , it seemed to work when I gave the VLAN10 interface the static public IP address and created a gateway. No problem - I just wanted to make sure the slight different behavior (vs when I connected the ATT modem to a fixed port) wasn't due to me still not having the switch set up correctly??Screenshot 2024-11-21 145041.png Screenshot 2024-11-21 150752.png Screenshot 2024-11-21 150502.png Screenshot 2024-11-21 150542.png Screenshot 2024-11-21 150724.png

      G 1 Reply Last reply Reply Quote 0
      • G
        Gblenn @ahole4sure
        last edited by Gblenn

        @ahole4sure I think you could perhaps make things a bit simpler than what you are looking at now.

        I am using an LTE router as my failover WAN, and I have quite a few VLANs for Cameras, Guestwifi, VoIP and so on. However, I only have 3 ports on my pfsense, but even if I had more, I doubt I'd use more...

        The way I have it set up is with two separate ports only used for the respective WAN connections, and then one single LAN port, carrying all VLANs. So what I would propose, is something like this adjusted picture, which I also suspect will help you getting your ATT connection a bit simpler to set up, is this:

        1a0611c5-1828-46c1-a00d-7b994f35f617-image.png

        In your switch you set port 1 as TRUNK, with all VLAN ID's as TAGGED. Then you simply set each port on the switch to the VLAN you need, Port 2 could be 20 UNTAGGED, Port 3 is 10 UNTAGGED and Port 4 is perhaps default 1 (your main LAN?).

        If you have more switches involved in your network you need to connect them together. And if you need VLAN's to carry over to the next swtich, that is done via TRUNK ports. Meaning that all VLAN ID's that you want to be passed along have to be TAGGED on those ports, in both switches. Since port 3 is UNTAGGED, you can connect a dumb switch to it and attach any number of cameras, and they will all be part of the Camera VLAN (without knowing it themselves...).

        Since the ATT Modem is a 5G modem, you may want to place it somewhere with a really good connection, provided you have cabling for it in your home. If you don't have a cable that is unused, meaning it's already used for something else like an AP or so, you can use VLAN to "tunnel" the ATT WAN connection to the pfsense port.
        If you put a VLAN capable switch also at the location where the ATT modem sits, you can create a switch only VLAN ID (say 100) and set the ATT connected port to 100 UNTAGGED. Include ID 100 in the TRUNK that connects the switches, and then set the port connecting into pfsense to 100 UNTAGGED.

        You don't have to do anything with VLANs on the second WAN port... VLAN ID 100 is only known and used by the switches, and becomes a switch within the switches only for "tunneling" the that extra WAN connection.

        This is what I do in order to have my LTE modem on the top floor and the switch connecting the floors is not the one directly connected to pfsense.

        A 1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          If pfSense pulls a lease via DHCP when connected directly to the modem it should also do so when connected via the switch.

          Since you have set ports 3, 4 and 5 to be access ports of VLAN20 the PVID needs to be 20 on all three of them.

          1 Reply Last reply Reply Quote 0
          • A
            ahole4sure @Gblenn
            last edited by

            @Gblenn @stephenw10

            Thank you both for chiming in so quickly!! Really helpful thoughts because I have a full switch up in the ceiling area for the cameras and re-designing my network with another or new VLAN capable switch up in the ceiling for the modem might be the way to go - thanks @Gblenn for the thoughts.

            My real issue now is that I don't understand why my ATT modem set to passthough mode is not sending the IP address through the VLAN to the pfsense with the interface set to DHCP mode ?? (like I thought I remembered it doing for the first ATT modem I setup a couple weeks ago)

            Does a modem device set to pass through "normally" send the info through to the router it's connected to?? I seem to remember that with my cable/fiber modem I had the manually set the IP address for the interface. But I swear that I remember the first ATT modem pushing through the IP.

            And apologies for the weirdness of my situation partly induced by my second location being 5 hr drive away - would require drive, hotel stay, etc if I can't get this troubleshooting done remotely and by testing

            G 1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              Yes I would expect it to allow pfSense to pull a lease from AT&T directly. But I think you need to confirm that with a direct connection.

              If you got any part of the VLAN or switch setup wrong it would just fail entirely. Since you are seeing ping responses to it (with high latency) it is passing traffic so the switch/vlan config is almost certainly correct.

              1 Reply Last reply Reply Quote 0
              • G
                Gblenn @ahole4sure
                last edited by Gblenn

                @ahole4sure I think you are right in your assumption that the modem should pass through the IP from the ISP if it's in bridge mode. It may however also make use of VLAN for the management interface? Check the manual?

                In this picture I see that you have not assigned the parent interface igb3, only VLAN 10?

                d109cac3-397a-41fe-94a2-8d35bab1d36e-image.png

                And this should work, and it should receive an IP from ATT and pass traffic.. But I would have removed that assignment and use the parent interface igb3 as is instead. Simply setting it up like you did with igb0.
                One thing that may mess things up is that you also have VLAN 1 on ports 1 and 2. So you could end up having some other device on the switch picking up the IP from ATT?? If you clean it up and remove any other VLAN membership than VLAN 10 on port 1 and 2.

                Or, perhaps the intent is to actually use the secondary WAN port also for LAN traffic? Although you have more than enough ports so I can't see that it's necessary...

                Perhaps a better understanding of your desired setup would be good?

                WAN1 - Fiber connection (igb0)
                WAN2 - 5G connection set up as failover (igb2 to be used once you are through testing?)
                LAN - this is default VLAN tag 1 on all switches. Is this what you called EeroLAN in the drawing?

                VLAN 10 to be used only to pass along the 5G modem connection.
                VLAN 20 is for Cameras
                VLAN NN for NAS??

                A 1 Reply Last reply Reply Quote 0
                • A
                  ahole4sure @Gblenn
                  last edited by

                  @Gblenn The pics above , I believe , explain what is needed. Bottom line I have had a network setup for 2 years running flawlessly. The problem was that we decided we needed failover internet after a recent outage (and resultant business loss). The issue was that all 4 ports on the pfsense device were full
                  So we decided to at the switch and utilize VLANs to turn one port on the pfsense into 2 ports ...
                  1 - for the addnl WAN
                  and the 2nd) - for the orginal Camera LAN that was already connected to the port on the pfsense originally

                  Since that port will be utilized as a trunk for both the new WAN and the existing Camera LAN I am not clear on how I should "assign" the parent interface ??? Maybe @stephenw10 could offer insight on this as well. I understand that the parent interface can remain assigned - but how do you assign a parent interface??

                  G 1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    You don't need to assign the parent interface if you are using two VLANs for the two subnets.

                    You would only assign the parent if you want the trunk link to carry untagged traffic and my preference is to avoid that if possible. And it's certainly possible here.

                    A 3 Replies Last reply Reply Quote 0
                    • G
                      Gblenn @ahole4sure
                      last edited by

                      @ahole4sure said in ATT Internet AIr:

                      Since that port will be utilized as a trunk for both the new WAN and the existing Camera LAN I am not clear on how I should "assign" the parent interface ??? Maybe @stephenw10 could offer insight on this as well. I understand that the parent interface can remain assigned - but how do you assign a parent interface??

                      Like @stephenw10 is saying, you don't have to. It was just my idea of putting all VLAN's on one interface, which included your default LAN. But that would also mean having untagged traffic on that trunk, which isnt' really best practice I suppose...

                      If you want to use that port for both Camera and ATT WAN, I guess you are missing VLAN 20 on the pfsense side. So that needs to be added like you did with VLAN 10.

                      1 Reply Last reply Reply Quote 0
                      • A
                        ahole4sure @stephenw10
                        last edited by ahole4sure

                        @stephenw10
                        Again thank you for your help!
                        This is probably a continued VLAN question but I think there is some pfsense general stuff going on.

                        I finally got the 2 Failover modems to connect to the pfsense as intended - BUT it took hours of experimentation.
                        Main question(or topic) is that I just couldn't get DHCP to work for creating (and maintaining) the interface and esp the gateway -- it seemed to have to do with assigning the parent interface (or not) and possibly some weird MAC addresses showing up (maybe it was the MAC address of the switch port (not really sure) ...
                        the only way I seemed to have a stable configuration was to set the VLAN interface to static , create a "static" gateway, and then HAD to delete the gateway that was auto created by the DHCP initially
                        Note: the DHCP config of the VLAN interface worked initially but then the created gateway started showing weird addresses (not even on my network) like 192.168.224.1 (see FIRST PIC ) ( the subsequent remaining pics are the working setup that ended up after static config)

                        Any ideas why the DHCP setup / config is failing? Is it MAC address issues? When a DHCP server doles out an address to VLAN what MAC address does it see? Does it see the parent interface MAC address? And what if the parent MAC address is configured and then used as a VLAN trunk - is the same MAC address used for the parent and the VLAN interface??

                        I can use the static as long as ATT is willing to keep providing static addrress for my modem. So that's not the end of the world but it would be nice to understand the process for the future ..... I even have a third location with much different network for later

                        IMG_0243.jpg

                        Screenshot 2024-11-24 092730.png Screenshot 2024-11-24 092751.png Screenshot 2024-11-24 092818.png Screenshot 2024-11-24 092839.png Screenshot 2024-11-24 092909.png Screenshot 2024-11-24 093014.png Screenshot 2024-11-24 093059.png Screenshot 2024-11-24 093448.png Screenshot 2024-11-24 093504.png

                        1 Reply Last reply Reply Quote 0
                        • A
                          ahole4sure @stephenw10
                          last edited by

                          @stephenw10
                          here are the rest of screenshots

                          Screenshot 2024-11-24 093544.png Screenshot 2024-11-24 093636.png Screenshot 2024-11-24 093700.png

                          1 Reply Last reply Reply Quote 0
                          • A
                            ahole4sure @stephenw10
                            last edited by

                            @stephenw10
                            Here are the rest

                            Screenshot 2024-11-24 093733.png Screenshot 2024-11-24 094419.png Screenshot 2024-11-24 094438.png

                            G 1 Reply Last reply Reply Quote 0
                            • G
                              Gblenn @ahole4sure
                              last edited by

                              @ahole4sure That very last part, "Use mobile router as DHCP server"... why is that turned on?

                              A 1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                Yeah seems like it should be pulling a lease from a remote dhcp server at AT*&T somewhere. But that gateway you're getting is outside the range of both....

                                A 1 Reply Last reply Reply Quote 0
                                • A
                                  ahole4sure @Gblenn
                                  last edited by

                                  @Gblenn
                                  When I was testing on the parent port, if I turned off the modem DHCP server it didn’t send the DHCP info for the interface

                                  1 Reply Last reply Reply Quote 0
                                  • A
                                    ahole4sure @stephenw10
                                    last edited by

                                    @stephenw10
                                    I know. Weird…
                                    Is the DHCP info for the interface something that pulled or initiated from the pfsense. Or is it something “sent” from the modem

                                    G 1 Reply Last reply Reply Quote 0
                                    • G
                                      Gblenn @ahole4sure
                                      last edited by Gblenn

                                      @ahole4sure DHCP is always "pulled" by clients through a DHCP request sent as a broadcast message reaching all servers (and clients) on a network. Which means that both the ATT modem and your ISP gateway will respond... Given the latency difference, it's not unlikely that the ATT modem will almost always "win". Regardless, make sure it is turned off in the modem.

                                      I was looking at some info on setting those ATT modems up and it seems like there's more to it than simply "turning on passthrough"? Like choosing DHCP dynamic or fixed, where in the case of fixed you are required to input the MAC of your pfsense interface.

                                      However, the MAC showing in your picture (B0-19-21 etc) is not the MAC you have from pfsense ending with ..68:43. In fact, based on those three octets, it looks like the ATT modem has actually picked up the MAC of your TPLink switch.
                                      So I'm suspecting this may be the cause of your problem...

                                      Also, wrt static or dynamic IP from ATT, my guess is they are providing you with a (very) dynamic IP. Typically in mobile networks IP's get released to the "pool" pretty much immediately after a device releases it. So static here probably means it is one single device that should be receiving the IP, in case there are more than one connected to the modem. Which you actually have since the TPLink switch is also a device that can request IP via DHCP...

                                      1 Reply Last reply Reply Quote 1
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        Well spotted! Yeah that MAC for the pass through looks wrong.

                                        A 1 Reply Last reply Reply Quote 0
                                        • A
                                          ahole4sure @stephenw10
                                          last edited by

                                          @stephenw10 @Gblenn

                                          Man I am so appreciative of you all helping !!!
                                          I have been pulling my hair out -- didn't see you posts unitl after I had done some more changes based on google (lol - one of my friend's wives is not allowed to google -- it can get you in trouble BUT)

                                          I tried enabling ipv6 and look what happened :
                                          My ipv4 gateway came back online
                                          The problem I was having was that in my testing (again I have to send this setup 5 physical hours away form me) - a power off (like with a power failure) would lead to my ATT gateway going offline and then getting "lost"

                                          I am very unfamiliar with ipv6 -- this is really weird
                                          Thoughts please

                                          Image 11-25-24 at 8.06 AM.jpeg Image 11-25-24 at 8.06 AM (1).jpeg Image 11-25-24 at 8.07 AM.jpeg Image 11-25-24 at 8.07 AM (1).jpeg

                                          G 1 Reply Last reply Reply Quote 0
                                          • G
                                            Gblenn @ahole4sure
                                            last edited by Gblenn

                                            @ahole4sure

                                            @ahole4sure said in ATT Internet AIr:

                                            I am very unfamiliar with ipv6 -- this is really weird
                                            Thoughts please

                                            I don't use IPv6 so I'm speculating here but I'm assuming you didn't have to make any other changes, like entering the correct MAC in the ATT modem? But with IPv6 things work different, so it may work even if the modem was set to only hand out IP to that specific MAC. As far as I understand it, Pfsense could have figured out an IP based on the network prefix or some router advertisment from the ATT modem?? I'm sure @stephenw10 knows this and can explain?

                                            But, I'm thinking there is a risk that your TPLink may still pick up that IPv4 address when it eventually requests a renewal?? So I'd go back and make sure to put the pfsense MAC in there asap.

                                            And while you are at it, you could try to turn off IPv6 in pfsense and see if things work also on IPv4... with the correct MAC in the modem.

                                            A 2 Replies Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.