Local DNS Records on different subnet
-
I'm not sure what you're asking there.
You can set this up and it will work. It's not really a security issue because you control both subnets and are behind NAT from your ISPs router.
But it is a setup that will almost certainly cause problems in the future unless you understand exactly what is happening and allow for it.
-
@stephenw10 so I put a firewall rule under WAN , any source and destination is my traefik server should it be my pihole? because it didn't resolve to anythin
-
In the screenshot above you showed that whatever the resource is successfully resolved to a 10.84.x.x IP address. There's no need to hide those addresses they are in a private subnet and only valid locally to you.
The reason the client cannot reach it is that it needs a static route to that subnet via the pfSense WAN IP.
And pfSense needs a pass rule on WAN, at a minimum, from the client IP address in the WAN subnet to the server IP address in the LAN subnet. It probably needs only to pass TCP but I would set the protocol to any as a test so you can try pinging it.
-
@stephenw10 so under WAN firewall create a rule source “any” destination “any“?
-
@jhmc93 Your going to have nothing but problems trying to do it with devices on your pfsense wan.. For starters your going to need a route on your upstream router. And then even with a route your traffic is going to be asymetrical because you have host on your transit network.
Put your devices behind pfsense is a much simpler and elegant solution.
-
@johnpoz can’t do that unfortunately
-
@jhmc93 said in Local DNS Records on different subnet:
@stephenw10 so under WAN firewall create a rule source “any” destination “any“?
You could do that as a test but a better rule would be:
Source: WAN subnet
Destination: LAN subnetIt could be narrower still like:
Source: the client IP address (or an alias with all clients)
Destination: the server IP address in the LAN.Generally the more precise you make the rules the better. But to just test you have added the route correctly just passing all traffic would work.
-
@stephenw10 what server should I point it to my traefik server or the pihole one?
-
The pihole is being used as DNS only and it's on the WAN side. The client is resolving against that because you manually configured it to do so.
It is resolving the traefik server to an IP address in the LAN but cannot reach it currently.
So the destination should be the traefik server IP address in the LAN subnet.
-
-
@johnpoz so my pfsense Doesn't have a WiFi card do broadcast a WiFi signal, I probably could connect a third party router, but there's an issue with that also, the pfsense instance I have running is more of a side firewall device for my media servers. Plus the connection from the ISP router is ran through a ethernet powerline plug and then into pfsense which is in a different location.
@stephenw10 I will try that and let you know how it goes thanks.
-
@jhmc93 Just get a real AP, or any 20$ wifi router can be used as just an AP..
Running wifi actually on some pfsense box would never be a good idea. Freebsd and wifi don't play nice.
-
@johnpoz so because I says that pfsense runs off an ethernet powerline plug, I currently have 1GB connection into my home, because of pfsense being ran off the plug in a different room I've seen the max speed of 60mbps when I've ran a speed test
-
That's pretty bad for powerline Ethernet. I've seen them pass 1G without issue. If they're new enough.
Somethings you have to try to work-around. But somethings you don't and if you can avoid it your life will be much easier!
-
@jhmc93 well I would really look to correcting that.. Either different powerline adapters or best is run an actual wire.. Move pfsense if you have to, etc.
But why would anyone paying for gig want any devices anywhere on their network only seeing 60mbps? If it was a limit of your wifi ok, but slow wifi these days is 200mbps not 60...
-
@johnpoz that's why I use my main stuff like laptop, pc, game consoles, phone, tablet etc offf my isp wifi or hardwired directly into isp router so I get the full speed, as for the pfsense side I wanted to keep that separate just for my server usage.
@stephenw10 I think the wiring in my house is old so it kinda slows the download speed down, as I have checked through TP Link app it talking to the other powerline plug at 253mb but slows down when hits pfsense
-
@jhmc93 said in Local DNS Records on different subnet:
other powerline plug at 253mb
yeah that number is like phy in wifi, your never going to actually get to that speed.
-
@stephenw10 I haven't resolved this issue my firewall rules are the following, this is being tried on a test machine but I'm unable to ping the machine off my laptopp on my isp router to the linux ubuntu server or connect via ssh? what am I doing wrong?
-
If you're still trying to connect from a laptop in the pfSense WAN subnet to a server in the LAN subnet the primary thing you need is a route to allow it.
That probably means adding a static route to the laptop directly. It has to be a route to the LAN subnet via the pfSense WAN address.
Without that the laptop will send that traffic via it;s default gateway which is the ISP router. And that probably has no idea where to route it so will either drops it or send it to the ISP... where it will be dropped.
-
@stephenw10 so what your saying is I need to add a static ip to the laptop on the isp side?,
As u can see I did a route in that screenshot above but my laptop is getting it IP from the DHCP server on isp side
