Need help with hardware setup please.
-
RIPv1&v2 on LAN, WAN or BOTH?
-
LAN side, sorry I didn't know it would ask which interface.
-
No worries… I changed the settings that you had suggested.
I've now done the following:
1. Plugged in Tomato next to the modem/server.
2. Connected the MODEM to the WAN port on the Tomato router.
3. Connected the LAN PORT 1 to the switch in with the same cable/port the Modem use to use.
4. Changed the pfSense connection type FROM PPPoE to STATIC.
5. Set a STATIC IP address for the pfSense box to 192.168.99.2
6. Saved and applied settings in pfSense.Now... My network behind pfSense is still fully functional. I can ssh into the pfSense box, go to shell and ping 192.168.X.1 (1, 2, 3 & 4).
I can ping 192.168.99.1 (Tomato/MLPPP).
But that is as far as I can go. I tried to ping the IP 8.8.8.8 and it would not work. I believe this is Google? Anyway... It seems that pfSense can ping as far as the Tomato router but not outside of it.
Any suggestions?
-
So you can SSH in from the outside all the way to the pfsense box and can ping the Tomato LAN side from inside your network but you basically can't surf? Do you have a default gateway configured on pfsense (should be 192.168.99.1)? If not that's your problem. It sounds like the routing in Tomato is working correctly but I'm looking into it just in case it isn't.
-
Sorry I guess that is a mis-communication on my part.
Right now I can have two setups:
Setup 1: Hard-wired into my switch which is routed through pfSense. My pfSense is configured to STATIC IP's. I have assigned an IP address of 192.168.1.200 to my laptop. The other subnets are for the other VM's which are currectly shutdown (ie. Zimbra & Trixbox)
Setup 2: I can use my iPhone (tethered) to obtain an IP address from the "outside" to try and connect into my network.
SETUP # 1:
When I'm hard-wired in under setup #1 I have the IP address of 192.168.1.200 and I can login to the pfSense router. I can ping 192.168.1.1 without a problem. When I go to the browser and try that IP it brings me to the pfSense router. However, from my laptop under this setting, I cannot ping the other subnets on my network anymore (2, 3 & 4).Under this setup I can ssh into 192.168.1.1:22 and use my pfSense login/password and get to the commandline menu. From there I select option #8 and go into the shell. From the pfSense box, I'm able to ping ALL the subnets that are configured in pfSense. I tried pinging 192.168.99.1 (Tomato Router) and I can successfully do that too. However, I can't get "outside" of my modem.
SETUP # 2:
When I'm tethered through my iPhone (Setup 2), I get a completely different IP address and try pinging my modem (static IP provided by TekSavvy) and I get no response. Even though I have turned on the remote access. In addition, I tried to wirelessly connect to the Tomato router but because it is /30 I am not getting a valid IP address (I think that is the reason why anyway).My next step is that I'm going to take my laptop down to the Tomato router and unplug the switch from LAN Port #1 and try connecting to it through my laptop. Maybe, I'll be able to login to the Tomato router and test to see if the MLPPP is logging in correctly and connecting to the internet.
-
Definitely verify with your laptop connected to the Tomato router you are getting access. You will need to re-enable NAT and the firewall else you will have to configure a static route. The fact you can't ping the Tomato router from outside with a tethered connection is worrisome. That indicates Tomato is still firewalling the connection (or NAT is still on), or the DSL circuit isn't connected for some reason. Skip ping for now, Tomato could be ignoring it. With your tethered connection can you access the web interface for Tomato from the outside?
For setup 1 that makes sense. You are getting to the pfsense box like you should be. You said the other subnets are VMs on ESXi are are shutdown right now so unless pfsense has an IP or ESXi has an IP in one of those additional subnets I wouldn't expect you to be able to ping them. And depending on how pfsense is setup to handle traffic between the subnets you might need a firewall rule in place to allow communication if pfsense is acting as the router (which it should be).
-
Wow, how did I miss this? I looked at your route table again, you have no route going OUT, no route on the WAN interface to send internet traffic to Teksavvy. Either you have an issue with the connection or Tomato isn't building the routing table correctly (that route should automatically be added by the PPPoE session if I'm not mistaken).
-
Okay… Just got back upstairs.
I successfully connected to the Tomato router. I unplugged the cable connecting the pfSense box (cable going to the switch) and put a cable connecting Port # 1 on the Tomato router to my laptop. I created a Static IP in my laptop as 192.168.99.2 and was able to ping 192.168.99.1 and I was also able to successfully login via the web interface (locally, not tethered).
When I logged into the Tomato router it showed that the PPPoE MLPPP connection had been established.
I turned on the sshd from within Tomato and logged into the Tomato router via Putty at 192.168.99.1:22. From within the Tomato shell I was able to ping outside 8.8.8.8. I then tested to make sure that the DNS was working and successfully pinged www.google.ca
I kept everything connected and went into the command line of my laptop and tried pinging 8.8.8.8 and it wouldn't work. I could successfully ping 192.168.99.1 (Tomato) but not past that point.
I just tried pinging the Tomato router from the outside again and it worked! I was able to remotely login to the Tomato router. Now, all I have to do is see if it is working from the wired network.
From the wired network on my laptop:
192.168.4.1 -> pfsense - I can login no problem
192.168.4.1 -> putty - from within shell of pfsense - I can ping 192.168.99.1 (Tomato router) and all other subnets
192.168.1.1 -> default gateway for LAN and when I go there I also get pfSense
192.168.99.1 -> I can ping here, but for some reason when I go there I get the pfSense login screen and not the Tomato login screen.I CANNOT past the Tomato router from the inside out.
So, it seems that Tomato is correctly establishing an internet PPPoE w/ MLPPP connection. I've got Tomato running on a specific port for remote connections, and pfSense running on another port. When I put in the port for pfSense, I get timed out.
It seems to me that Tomato is blocking access in and out.
-
I've posted a new screenshot for Tomato. The original screenshot was from when I was just configuring it without the PPPoE connected. This one is from the current setup as explained.
-
Good, you have connectivity then. It also looks like it has correctly built the routing table. As I said unless you re-enable NAT/firewall on Tomato you won't get online even from the laptop connected directly to it. It needs NAT somewhere to translate.
It sounds like RIP isn't configuring the routes like it should, or pfsense isn't running RIP. You will need to configure a static route in Tomato. Leave NAT/firewall in Tomato off and connect pfsense back to Tomato LAN side. Go to the static routing section of Tomato and add a route for each of your four LAN networks behind pfsense.
In your screenshot you have a few fields to fill out for each static route. Destination, Gateway, Subnet, Metric and Interface.
For destination put in 192.168.1.0 (and subsequently 2.0, 3.0 and 4.0), gateway is always going to be 192.168.99.2, subnet is always going to be 255.255.255.0 assuming each of them is a full class C, metric should be 1 IIRC but if that doesn't work try 0, Interface will be LAN.
To break that down for each one it will be as follows:
192.168.1.0 192.168.99.2 255.255.255.0 1 LAN
192.168.2.0 192.168.99.2 255.255.255.0 1 LAN
192.168.3.0 192.168.99.2 255.255.255.0 1 LAN
192.168.4.0 192.168.99.2 255.255.255.0 1 LANTry that and let me know if it works.
-
Okay… Still not working. I did figure out that a week or so ago I setup a temporary VM under the 192.168.99.x subnet that I was testing with. So, I have changed the Tomato IP to 192.168.199.1 and the pfSense to 192.168.199.2 and have updated all those routes you gave me to use pfSense 192.168.199.2 as the gateway.
Question: In order to use 1.0, 2.0, 3.0 and 4.0 in the routing table and tell Tomato to use 192.168.199.2 as the gateway, doesn't the gateway have to actually be accessible to/from the internet?
I have taken some screenshots of my pfSense and Tomato setups. I'm not sure what to do from here.
I think that the firewall rules on the Tomato router are correct. I haven't changed anything on the pfSense router other than the STATIC IP address of the pfSense box to 192.168.199.2.
Any ideas? Same situation. I can access the Tomato router from the tethered connection, I can access the pfSense router from within the LAN, but I cannot access pfSense from the tethered connection and I cannot access Tomato from within the LAN. I can ping the Tomato router from within the pfSense shell (192.168.199.1 - is pingable). I changed the subnet from 255.255.255.252 to 255.255.255.0 to test if the wireless internet was accessible, and it was. Therefore, if connected wirelessly to the Tomato Router, I can get full access to the internet. However, for somereason the pfSense box is not accessing the internet. I have set the default gateway on the pfSense box to 192.168.199.1
Here are the screenshots:
-
Ok first a question. In digging up Teksavvy's MLPPP stuff, it seems you can order different types of static IPs, a /32, /30, /29 etc. Do you know what you have? I'm also seeing that the PPP session should be getting a different address from your assigned static IP, is that correct? If so there's something different I want to do.
In regards to the current setup, I'm not sure if I mentioned it (I know I thought about it but whether it actually got typed out is another matter lol) but you need to change the operating mode from gateway to router in the "Advanced > Routing" section under miscellaneous (same section where you turned on RIP). Also, remove any and all port forwards, you don't need them on the Tomato box.
-
Question 1: TekSavvy's subnet settings? I don't have a clue. I just know that I have a static ip. That's it. I think there is only one.
There were no port forwarding rules setup at all, those were just examples. When they are active there is an "on" next to them. However, I deleted all of them just to be safe. I went back to the routing page and changed the mode to Router instead of "Gateway" (no you hadn't said it yet). So, RIPv1&v2 is still set to LAN and the mode is now Router.
Problem: After rebooting the Tomato router, now I can't get in from the outside (tethered).
-
Hmmm then you likely only have the one address. It appears you can get a routed subnet, in addition to a static IP. I know it's likely not what you have and would require some modifications on your end but a more "proper" way to solve this would be with a routed subnet of at least a /30 size. The WAN IP on Tomato would be whatever, doesn't need to be static. Then your routed subnet gets assigned to the LAN side of Tomato and the WAN side of pfsense. Basically exactly what we've done here but using publicly routable IP addresses, not private addresses. Private addresses by design won't route over the public internet but with proper static routes in place it should. You would have a static route on the Tomato router to take care of "incoming" and the default gateway on the pfsense to take care of "outgoing". Both of which you have configured.
Here's a thread I found that talks about Tomato MLPPP through Teksavvy with an additional router behind Tomato: http://www.dslreports.com/forum/r24416860-How-do-I-use-Tomato-MLPPP-for-MLPPP-only-with-no-NAT-. That's also where I discovered they have separate routable subnets in addition to the static WAN IP. I know you probably want to put your network back to a working state and wrap things up, I'll continue researching this. Maybe someone with more Tomato experience will know what's up. As far as I can tell pfsense is configured correctly but it's stopping at Tomato, possibly due to some oddity with the private address range being used between the two. I'm not trying to draw people away from the pfsense forum but maybe try posting in the Teksavvy forum on DSL Reports, chances are they know whats going on.
-
Okay… Good news. After playing with it for the last hour or two, I decided to go through step by step and double check everything.
Because I could connect to Tomato from the tethered connection, I knew there was no problem with the MLPPP connection. So, I changed the subnet to 255.255.255.0 and enabled DHCP on the Tomato router again. I was able to connect to the internet from both a wired connection and wireless connection through the Tomato router.
Unfortunately, I still couldn't connect to the internet from within pfSense. So, I reset the default gateway again (which I did before) to 192.168.199.1 and voila, I had internet. Go figure.
Now... My next question.
My current setup is like this:
MODEM ---> Tomato ---> pfSense ---> LANMy LAN is now fully accessible. My question is the security of the network as it is. If I connect computers to the wireless part of Tomato, they are in front of the firewall (pfSense). Is this a bad idea? I run PC Tools on all my desktops/laptops in the house so there is a firewall in place. Is that secure enough?
Or, would it be better to buy another wireless router, hook it up inside the LAN and turn off the wireless feature of the Tomato router?
-
You know I've had issues like that too where the gateway was checked and triple checked but it wasn't till actually modifying it, or re-saving it that it stuck. If you can get online from Tomato on wireless then it is most likely running NAT (unless your laptop is getting a public IP which would be odd). If Tomato is running NAT you've got a problem because pfsense is running NAT as well. NAT by itself is bad for some apps but two NATs back to back is bad for almost everything except basic HTTP. From what I can gather changing the operating mode from Gateway to Router should disable NAT. Unless of course RIP is creating the necessary routes in place of NAT? Either way yes a separate AP behind pfsense would be ideal. Unfortunately I'm not sure if it's even possible to detect double NAT.
Regardless, I'm glad it's working finally.
-
Another issue has popped up which might be caused by the double NAT thing.
My OpenVPN session into my LAN is no longer working. It was working before I placed Tomato in front.
I just tried to go in and change it back to "Router" instead of "Gateway" but when I did, I lost connectivity again (both ways) to the internet. I was no longer able to get to Tomato via the tethered connection and I was no longer able to get to the internet from the LAN (or the Tomato router).
-
Correction.
With mode set to "Router" instead of gateway:
- Wireless connection: Can login to Tomato router, no internet
- Tomato ping: Tomato CAN ping 8.8.8.8 successfully.
- pfSense (within LAN): Cannot ping outside of the Tomato router
With mode set to "Gateway"
- Wireless connection: available.
- Tethered connection: Cannot connect to Tomato
- pfSense (within LAN): internet connectivity available
- OpenVPN: not available
-
Wait you set the mode to Gateway instead of Router to get online? That will definitely turn on NAT in Tomato. Sounds like there's still a bug to iron out. OpenVPN support may be flaky anyway due to pfsense not having a public IP, I'm not positive about that. Out of curiosity, what chance is there in getting a routed /30 subnet (or bigger if you want more addresses to play with) from Teksavvy? I know it's going to cost you money but if you swap the static IP for a routed /30 subnet it might work out price wise and it would make things more "kosher".
-
TekSavvy said they can do it almost instanteously. So it's not difficult at all.
I have the Static IP because at somepoint I'm going to be running some servers that are publicly available (work related). I thought it would be better to have a static IP instead of dynamic one using dynDNS or something.
Also, if I remember correctly, but I could be wrong with this, a Static IP was necessary for MLPPP to work.
I just on the phone with TekSavvy now to double check the Static IP thing and to order a /30 subnet.
What do I need to do now?