Wireless on same subnet while using a non-PfSense DHCP Server
-
i know it works for sure when i create a subnet for it. and i used 192.168.1.1 instead of 192.168.0.1 and i was able to get internet, network shares everything.
We just would rather have it on the same subnet. I mean even when it is on the same subnet I can connect to the network and I can get our DHCP server to give it a free IP but we just cant get online or access any network resources. It refreshes the proper DNS and points to the right gateway as well but like I said it will not let us connect to the internet at all but it has a valid open IP from our separate DHCP server.
Even if I enable DHCP on the OPT1 it connects to the wireless network and it gives me the right IP in the range I give it but it still doesnt let us get online. Thats where were stuck.
-
in the dns and gateway settings point to YOUR DNS SERVER AND YOUR GATEWAY
so if you have w2k3 - us that as the dns server in dhcp server options on your WIRELESS ap interface.
if your gateway is a router then set the gateway for your PFS box to that router, and leave gateway blank on the dhcp server options on your WIRELESS ap interface. -
ok I'll try all of those suggestions and let you know how it goes.
-
We just would rather have it on the same subnet. I mean even when it is on the same subnet I can connect to the network and I can get our DHCP server to give it a free IP but we just cant get online or access any network resources. It refreshes the proper DNS and points to the right gateway as well but like I said it will not let us connect to the internet at all but it has a valid open IP from our separate DHCP server.
Even if I enable DHCP on the OPT1 it connects to the wireless network and it gives me the right IP in the range I give it but it still doesnt let us get online. Thats where were stuck.
Configure the interface so it is bridged to your LAN interface, then create rules to allow the traffic. You need to explicitly create a rule to allow DHCP in addition to rule(s) to allow other traffic. Depending on how strict your LAN ruleset is you may need to adjust the rules there as well.
If you've done this and it's still not working, let's see what your rules do look like.
-
Can you give me a example or give me the information that I would need to set that sort of rule up?
-
Here's what I have set up at one install. It uses a DHCP server running on the pfSense box, but since DHCP is broadcast traffic it should work with an external DHCP server as well (obviously it must be on the LAN segment). The DHCP rule is a bit less granular than it could be, and obviously the allow all rule is less than optimal, but this config should work. As mentioned, you'll need to bridge the interfaces as well.
-
ok ya we tried bridging it as well at one point but we didnt create any rules. thanks alot I'll give your suggestion a try and let you know how it goes.
-
I posed screenshots of my Rules for my LAN device and my Opt1 (Wireless AP). OPT1 is bridged with LAN.
I havent put the box live again since yesterday, just wanted insight on these rules before I do go live with it.
 -
If you don't want traffic to be able to pass from the wireless LAN to the wired LAN, I would prefer to explicitly create a block or reject rule. The effect is the same, but it's more 'self documenting' than letting that traffic default out. Put all your reject rules first, then you can get rid of the 'not LAN subnet' destination specification.
This is more personal preference than anything (I don't like using NOTs in my firewall rules, or letting traffic intentionally hit the policy rules) as your ruleset should work as you expect.
-
Well I can get DHCP to give me Ip's when I conenct devices to my AP, which is OPT1. But I cant access network shares or the Internet. So thats why I'm just asking what rule I need to put in place to be able to access the web and get network access. I also need to know where I add the rules. Thanks.
-
It may be the NOT LAN Net rule that's causing the problem, it's probably blocking traffic to the default gateway (on the LAN net), and what you're seeing makes sense. Keep things simple when testing, and just add an allow all rule and see if that works before you try anything else.
Though really, if you want the WLAN and LAN segregated, it makes a lot more sense to just have a separate subnet. If the machines on the segment can't talk to each other, why do they need to use the same DHCP, seems a bit of a strange requirement.
-
Forgive me for this but a quick google:
http://geekswithblogs.net/TSCustomiser/archive/2007/05/09/112357.aspx
you need certain port forwarded to get funtionality,netbios 137 and 138 and 139
smb (shares) 445
dns 53 -
Yea, I'm not too sure to be honest. It's what my boss wants done. I will try removing that rule and see if that helps at all. Thanks guys.
-
Thanks Omen, appreciate that man.