Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Routing between two pfsense boxes via wireless bridge

    Scheduled Pinned Locked Moved Routing and Multi WAN
    14 Posts 3 Posters 6.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • GruensFroeschliG
      GruensFroeschli
      last edited by

      I think you mixed the concepts of routing and bridging and because of this confused yourself.

      It is not possible to bridge a WLAN interface in Infrastructure (client) mode.
      Also with a bridge you have the same subnet on both sides of the bridge.

      You configured a subnet between the two sites so already setup a routed scenario.

      Could you maybe post screenshots of your firewall rules?
      Did you enable logging for the allow rule on the OPT interface?

      We do what we must, because we can.

      Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

      1 Reply Last reply Reply Quote 0
      • D
        drummer_adair
        last edited by

        @GruensFroeschli:

        I think you mixed the concepts of routing and bridging and because of this confused yourself.

        It is not possible to bridge a WLAN interface in Infrastructure (client) mode.
        Also with a bridge you have the same subnet on both sides of the bridge.

        You configured a subnet between the two sites so already setup a routed scenario.

        Could you maybe post screenshots of your firewall rules?
        Did you enable logging for the allow rule on the OPT interface?

        Ok you may be right but I'm pretty sure I understand what is going on, but maybe not? So please help me understand if I am wrong.

        I think what you think I am doing is hanging an actual WLAN adapter off the back of my pfsense box, but that is not the case.
        This is an ethernet connection to a wifi radio 40' in the air on a tower at my house. connected to another radio on a tower at my friends house that also come in to his box via ethernet.

        Really all I'm attempting is this
        http://forum.pfsense.org/index.php/topic,19991.0.html

        my crossover cable just happens to be me a 3 mile wireless link that is functional.

        I can post screen shots of my firewall rules for the LAN and OPT1 interfaces but all your going to see is a bunch of any's all the way across.
        I noticed on another project that having broad any rules didn't work correctly (it might have been me doing something wrong at the time) but now I always try to build rules that are as specific as possible. So I had 4-5 various rules on the OPT1 interfaces allowing traffic from all the various subnets to each others various subnet. With logging enabled on each rule I diligently watched the logs on both sides show me I had traffic passing in one box, over the link and returning but never leaving the LAN interface to ping a local host. I ended up removing all the individual rules in case i didn't  have something ordered right and just going back to * * * * * * for LAN and OPT1.

        Again the setup works except for the fact I can't reach hosts on the LAN from either side. However I can, for example ping the LAN and OPT1 interfaces of each router from either side.

        1 Reply Last reply Reply Quote 0
        • D
          danswartz
          last edited by

          Can you run something like wireshark on a PC on one LAN and then try pinging that host from the other side and see if anything at all shows up?  The firewall packet logging doesn't seem to be useful since you know you can see each pfsense's LAN.

          1 Reply Last reply Reply Quote 0
          • D
            drummer_adair
            last edited by

            Thanks danswartz, I had not thought about that. I will set this up and get back with results.

            Adair

            1 Reply Last reply Reply Quote 0
            • D
              drummer_adair
              last edited by

              I'm waiting for the other end of the link to get connected back up correctly to fully test.

              But a ping from my wireless device back to my desktop was failing, I fired up wireshark and saw that the ping was reaching my desktop but my desktop was not responding…...Yep you guessed it, bone head move. Windows firewall was blocking the pings. I turned if off and can ping my desktop thru my router from my wireless bridge.
              This tells me that PF is setup correctly and should mean everything will work ok once the link is back up.

              Damn windows!

              I will test and post back a final outcome.

              Next time I will test pinging hostes other than windows devices!

              Thanks,
              Adair

              1 Reply Last reply Reply Quote 0
              • D
                danswartz
                last edited by

                good to hear!  everything i was seeing looked 'impossible' :)

                1 Reply Last reply Reply Quote 0
                • D
                  drummer_adair
                  last edited by

                  @danswartz:

                  good to hear!  everything i was seeing looked 'impossible' :)

                  Why do you say 'impossible'?

                  1 Reply Last reply Reply Quote 0
                  • D
                    danswartz
                    last edited by

                    I mean it all looked correct - i couldn't see how you could be pinging the LAN IP of  the pfsense but not the host, given what the rules and such looked like.

                    1 Reply Last reply Reply Quote 0
                    • D
                      drummer_adair
                      last edited by

                      Now I have everything setup just like before and when I try to ping the a host on the other LAN I get a TTL expired in transit..
                      Trace routing shows the ip address of the OPT interface of my router.
                      From either side I can ping the bridge IP's and bridge interface but not the LAN router or any host IP's.

                      this is beginning to get really frustrating.

                      Adair

                      1 Reply Last reply Reply Quote 0
                      • D
                        danswartz
                        last edited by

                        What I wanted to see was the results of a wireshark trace on the host on the remote LAN when you try pinging…

                        1 Reply Last reply Reply Quote 0
                        • D
                          drummer_adair
                          last edited by

                          That's just it, I can't even get as far as I was getting before.
                          Before I could ping the LAN interface of the each others router but not a host on the LAN (because of the windows firewall)
                          I'll still do some captures with wireshark later.

                          Thanks,
                          Adair

                          1 Reply Last reply Reply Quote 0
                          • D
                            drummer_adair
                            last edited by

                            This is old but I now have this working. (it's actually been working for awhile, just didn't think to update the thread)

                            I had two major problems the entire time I was trying to get this working

                            First with the Ubiquity Bullets you have to put them in Client/Server WDS mode in order for them to do layer two bridging. DOH!

                            Second, at someone in a midst all the testing I screwed my my static route to the other subnet.

                            What I needed was LAN  192.168.2.0/24 via 172.16.10.2.
                            172.16.10.2 being the pfsense routers opt interface on the other side of the bridge.

                            Somehow I had put 172.16.10.3 (my routers opt interface address)

                            Getting the bullets our of a semi/mini nat mode and putting the correct routing statement on each pfsense box fixed everything right up!

                            1 Reply Last reply Reply Quote 0
                            • D
                              danswartz
                              last edited by

                              Cool.

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.