Need help with hardware setup please.
-
Wow, how did I miss this? I looked at your route table again, you have no route going OUT, no route on the WAN interface to send internet traffic to Teksavvy. Either you have an issue with the connection or Tomato isn't building the routing table correctly (that route should automatically be added by the PPPoE session if I'm not mistaken).
-
Okay… Just got back upstairs.
I successfully connected to the Tomato router. I unplugged the cable connecting the pfSense box (cable going to the switch) and put a cable connecting Port # 1 on the Tomato router to my laptop. I created a Static IP in my laptop as 192.168.99.2 and was able to ping 192.168.99.1 and I was also able to successfully login via the web interface (locally, not tethered).
When I logged into the Tomato router it showed that the PPPoE MLPPP connection had been established.
I turned on the sshd from within Tomato and logged into the Tomato router via Putty at 192.168.99.1:22. From within the Tomato shell I was able to ping outside 8.8.8.8. I then tested to make sure that the DNS was working and successfully pinged www.google.ca
I kept everything connected and went into the command line of my laptop and tried pinging 8.8.8.8 and it wouldn't work. I could successfully ping 192.168.99.1 (Tomato) but not past that point.
I just tried pinging the Tomato router from the outside again and it worked! I was able to remotely login to the Tomato router. Now, all I have to do is see if it is working from the wired network.
From the wired network on my laptop:
192.168.4.1 -> pfsense - I can login no problem
192.168.4.1 -> putty - from within shell of pfsense - I can ping 192.168.99.1 (Tomato router) and all other subnets
192.168.1.1 -> default gateway for LAN and when I go there I also get pfSense
192.168.99.1 -> I can ping here, but for some reason when I go there I get the pfSense login screen and not the Tomato login screen.I CANNOT past the Tomato router from the inside out.
So, it seems that Tomato is correctly establishing an internet PPPoE w/ MLPPP connection. I've got Tomato running on a specific port for remote connections, and pfSense running on another port. When I put in the port for pfSense, I get timed out.
It seems to me that Tomato is blocking access in and out.
-
I've posted a new screenshot for Tomato. The original screenshot was from when I was just configuring it without the PPPoE connected. This one is from the current setup as explained.
-
Good, you have connectivity then. It also looks like it has correctly built the routing table. As I said unless you re-enable NAT/firewall on Tomato you won't get online even from the laptop connected directly to it. It needs NAT somewhere to translate.
It sounds like RIP isn't configuring the routes like it should, or pfsense isn't running RIP. You will need to configure a static route in Tomato. Leave NAT/firewall in Tomato off and connect pfsense back to Tomato LAN side. Go to the static routing section of Tomato and add a route for each of your four LAN networks behind pfsense.
In your screenshot you have a few fields to fill out for each static route. Destination, Gateway, Subnet, Metric and Interface.
For destination put in 192.168.1.0 (and subsequently 2.0, 3.0 and 4.0), gateway is always going to be 192.168.99.2, subnet is always going to be 255.255.255.0 assuming each of them is a full class C, metric should be 1 IIRC but if that doesn't work try 0, Interface will be LAN.
To break that down for each one it will be as follows:
192.168.1.0 192.168.99.2 255.255.255.0 1 LAN
192.168.2.0 192.168.99.2 255.255.255.0 1 LAN
192.168.3.0 192.168.99.2 255.255.255.0 1 LAN
192.168.4.0 192.168.99.2 255.255.255.0 1 LANTry that and let me know if it works.
-
Okay… Still not working. I did figure out that a week or so ago I setup a temporary VM under the 192.168.99.x subnet that I was testing with. So, I have changed the Tomato IP to 192.168.199.1 and the pfSense to 192.168.199.2 and have updated all those routes you gave me to use pfSense 192.168.199.2 as the gateway.
Question: In order to use 1.0, 2.0, 3.0 and 4.0 in the routing table and tell Tomato to use 192.168.199.2 as the gateway, doesn't the gateway have to actually be accessible to/from the internet?
I have taken some screenshots of my pfSense and Tomato setups. I'm not sure what to do from here.
I think that the firewall rules on the Tomato router are correct. I haven't changed anything on the pfSense router other than the STATIC IP address of the pfSense box to 192.168.199.2.
Any ideas? Same situation. I can access the Tomato router from the tethered connection, I can access the pfSense router from within the LAN, but I cannot access pfSense from the tethered connection and I cannot access Tomato from within the LAN. I can ping the Tomato router from within the pfSense shell (192.168.199.1 - is pingable). I changed the subnet from 255.255.255.252 to 255.255.255.0 to test if the wireless internet was accessible, and it was. Therefore, if connected wirelessly to the Tomato Router, I can get full access to the internet. However, for somereason the pfSense box is not accessing the internet. I have set the default gateway on the pfSense box to 192.168.199.1
Here are the screenshots:
-
Ok first a question. In digging up Teksavvy's MLPPP stuff, it seems you can order different types of static IPs, a /32, /30, /29 etc. Do you know what you have? I'm also seeing that the PPP session should be getting a different address from your assigned static IP, is that correct? If so there's something different I want to do.
In regards to the current setup, I'm not sure if I mentioned it (I know I thought about it but whether it actually got typed out is another matter lol) but you need to change the operating mode from gateway to router in the "Advanced > Routing" section under miscellaneous (same section where you turned on RIP). Also, remove any and all port forwards, you don't need them on the Tomato box.
-
Question 1: TekSavvy's subnet settings? I don't have a clue. I just know that I have a static ip. That's it. I think there is only one.
There were no port forwarding rules setup at all, those were just examples. When they are active there is an "on" next to them. However, I deleted all of them just to be safe. I went back to the routing page and changed the mode to Router instead of "Gateway" (no you hadn't said it yet). So, RIPv1&v2 is still set to LAN and the mode is now Router.
Problem: After rebooting the Tomato router, now I can't get in from the outside (tethered).
-
Hmmm then you likely only have the one address. It appears you can get a routed subnet, in addition to a static IP. I know it's likely not what you have and would require some modifications on your end but a more "proper" way to solve this would be with a routed subnet of at least a /30 size. The WAN IP on Tomato would be whatever, doesn't need to be static. Then your routed subnet gets assigned to the LAN side of Tomato and the WAN side of pfsense. Basically exactly what we've done here but using publicly routable IP addresses, not private addresses. Private addresses by design won't route over the public internet but with proper static routes in place it should. You would have a static route on the Tomato router to take care of "incoming" and the default gateway on the pfsense to take care of "outgoing". Both of which you have configured.
Here's a thread I found that talks about Tomato MLPPP through Teksavvy with an additional router behind Tomato: http://www.dslreports.com/forum/r24416860-How-do-I-use-Tomato-MLPPP-for-MLPPP-only-with-no-NAT-. That's also where I discovered they have separate routable subnets in addition to the static WAN IP. I know you probably want to put your network back to a working state and wrap things up, I'll continue researching this. Maybe someone with more Tomato experience will know what's up. As far as I can tell pfsense is configured correctly but it's stopping at Tomato, possibly due to some oddity with the private address range being used between the two. I'm not trying to draw people away from the pfsense forum but maybe try posting in the Teksavvy forum on DSL Reports, chances are they know whats going on.
-
Okay… Good news. After playing with it for the last hour or two, I decided to go through step by step and double check everything.
Because I could connect to Tomato from the tethered connection, I knew there was no problem with the MLPPP connection. So, I changed the subnet to 255.255.255.0 and enabled DHCP on the Tomato router again. I was able to connect to the internet from both a wired connection and wireless connection through the Tomato router.
Unfortunately, I still couldn't connect to the internet from within pfSense. So, I reset the default gateway again (which I did before) to 192.168.199.1 and voila, I had internet. Go figure.
Now... My next question.
My current setup is like this:
MODEM ---> Tomato ---> pfSense ---> LANMy LAN is now fully accessible. My question is the security of the network as it is. If I connect computers to the wireless part of Tomato, they are in front of the firewall (pfSense). Is this a bad idea? I run PC Tools on all my desktops/laptops in the house so there is a firewall in place. Is that secure enough?
Or, would it be better to buy another wireless router, hook it up inside the LAN and turn off the wireless feature of the Tomato router?
-
You know I've had issues like that too where the gateway was checked and triple checked but it wasn't till actually modifying it, or re-saving it that it stuck. If you can get online from Tomato on wireless then it is most likely running NAT (unless your laptop is getting a public IP which would be odd). If Tomato is running NAT you've got a problem because pfsense is running NAT as well. NAT by itself is bad for some apps but two NATs back to back is bad for almost everything except basic HTTP. From what I can gather changing the operating mode from Gateway to Router should disable NAT. Unless of course RIP is creating the necessary routes in place of NAT? Either way yes a separate AP behind pfsense would be ideal. Unfortunately I'm not sure if it's even possible to detect double NAT.
Regardless, I'm glad it's working finally.
-
Another issue has popped up which might be caused by the double NAT thing.
My OpenVPN session into my LAN is no longer working. It was working before I placed Tomato in front.
I just tried to go in and change it back to "Router" instead of "Gateway" but when I did, I lost connectivity again (both ways) to the internet. I was no longer able to get to Tomato via the tethered connection and I was no longer able to get to the internet from the LAN (or the Tomato router).
-
Correction.
With mode set to "Router" instead of gateway:
- Wireless connection: Can login to Tomato router, no internet
- Tomato ping: Tomato CAN ping 8.8.8.8 successfully.
- pfSense (within LAN): Cannot ping outside of the Tomato router
With mode set to "Gateway"
- Wireless connection: available.
- Tethered connection: Cannot connect to Tomato
- pfSense (within LAN): internet connectivity available
- OpenVPN: not available
-
Wait you set the mode to Gateway instead of Router to get online? That will definitely turn on NAT in Tomato. Sounds like there's still a bug to iron out. OpenVPN support may be flaky anyway due to pfsense not having a public IP, I'm not positive about that. Out of curiosity, what chance is there in getting a routed /30 subnet (or bigger if you want more addresses to play with) from Teksavvy? I know it's going to cost you money but if you swap the static IP for a routed /30 subnet it might work out price wise and it would make things more "kosher".
-
TekSavvy said they can do it almost instanteously. So it's not difficult at all.
I have the Static IP because at somepoint I'm going to be running some servers that are publicly available (work related). I thought it would be better to have a static IP instead of dynamic one using dynDNS or something.
Also, if I remember correctly, but I could be wrong with this, a Static IP was necessary for MLPPP to work.
I just on the phone with TekSavvy now to double check the Static IP thing and to order a /30 subnet.
What do I need to do now?
-
Just got off the phone with TekSavvy and they confirmed while the static IP is not required with the MLPPP it is basically free. MLPPP is $4 per month whether you get the dynamic IP or the static IP, so I took the static IP.
I just ordered a /30 subnet. He gave me two IP addresses. However, of the two, he said one was a broadcast IP address and the other was a usable IP address. I'm a little confused with that as I thought /30 meant you could have 2 IP addresses.
Anyway… I await your instructions on how to configure this.
-
Yeah for sure a static IP is best for servers. Then sometimes you get things like a DHCP based cable modem service and your IP won't change unless they rescope the DHCP server or you leave the modem off for a week or so. So MLPPP basically includes a static IP. Sounds like Bellsouth a few years ago. You could get a 3 Mbps tier or a 6 Mbps tier, the 6 included a static IP. You could add a static IP to the 3 tier but the cost was the same as just upgrading to 6. Guess what most everyone did lol.
What did you get from Teksavvy on the /30 block? A /30 is 4 addresses, starting at 0 you would have 0 as the "network" address, 1 and 2 as host addresses and 3 as the "broadcast" address. A /32 which would almost certainly not be used would give you only one host address (think loopback address). So in that case you would assign the x.x.x.1 address to the Tomato LAN side and the x.x.x.2 address to pfsense WAN side with pfsense's WAN gateway being x.x.x.1. You'll need to set Tomato back into Router mode to disable NAT and the firewall.
From what I'm seeing on that DSL Reports thread I linked you to, the Tomato WAN will get it's static IP as usual, you can use it for remotely configuring Tomato if you want, won't really need it for anything. Since pfsense will have a publicly routed IP it shouldn't have ANY problems with OpenVPN or anything. Also forcing a public IP on Tomato's LAN side should give it the hint that it doesn't need to go behind your back and do NAT or something when you've told it not to. I think the issue we were running into before was Tomato doing something funky because we had a private IP inbetween and technically it's not supposed to be in a route.
-
The rep at TekSavvy did say "first usable IP" but then only gave me one. I don't know if it is a security risk to post the IP at this time so I will just do this:
x.x.x.240 -> broadcast
x.x.x.241 -> first usable IP addressSo, if I understand correctly, the following should work?
Tomato WAN -> Will aquire the static IP like normal
Tomato LAN -> x.x.x.241 (first usable IP)
pfSense WAN - x.x.x.242I would then set the default gateway for the pfSense WAN to x.x.x.241 and change it back to Router mode.
Is this correct?
-
Usually /30 subnets go like this
x.x.x.240 network name, unusable
x.x.x.241 you can use it
x.x.x.242 gateway, this is isp's use
x.x.x.243 broadcast, unusableBut i might be wrong here also
-
With a properly functioning firewall it shouldn't be an issue to post your IP, of course DoS attempts on it can't be stopped by a firewall alone they require something like snort or the help of the ISP. So yeah just the last octet is fine. Yep first usable is what is the key there. Assign 241 to Tomato's LAN and 242 to pfsense's WAN, switch to Router mode on Tomato, reset pfsense's default gateway to 241 and you should be surfing.
-
Thanks so much for your help! Are you going to be around tomorrow evening? it is 12:40am right now where I am and I have to work tomorrow. Since my internet is working I can leave it as-is right now and pick up on it tomorrow night. However, if you are not going to be available tomorrow then I'll continue this evening.