Can't get pass VLAN /WAN setup
-
OK, you have two separate issues here:
1. Your (probably) Realtek NICs are too new to be recognised by pfSense 2.0.X. If you look carefully at the boot messages you'll probably see "re1: Unknown H/W revision: 0x2c800000" or something similar.
Try using 2.1 instead: http://snapshots.pfsense.org/2. You have a large number of services on your NAS open to the internet. pfSense can only help you here by blocking those services. Your existing router can do that anyway or you could just turn them off on the NAS. Do you really need all those open services? You are trusting the NAS firmware not to have any bugs which is not something I would do.
You can block, say, all of China in pfSense or setup a VPN instead which would be much better. ;)Steve
-
ok, issue one is what I have started to realize after reading other posts - so I will try the 2.1 snapshot.
As for issue 2 - a good VPN connection would be a better way to go yes, but up to now, the Netgear router isn't very happy with VPN or it seems, as the VPN connection is very unstable. A switch to my new pfSense box here could probably make VPN a stable solution. (As for the security risk - just why I realized I needed to look for a better solution).
Thanks for the reply. :)
-
Internet - (WAN) router (LAN) - (WAN) pfSense (LAN) - NAS"
because I need a WiFi and regular access-point, but I guess that could be a switch then?As for your suggestion to setup, I don't need two sets of firewalls then, just set up the pfSense and then use the Netgear as a switch and WiFi access-point on the LAN?
Yes, connect your Netgear switch to the pfSense LAN port. Connect the NAS, WiFi access point and any other cabled devices to the switch. Just 1 ordinary LAN behind pfSense should be fine for your needs.
OpenVPN works well on pfSense (I am using the latest pfSense 2.1 at multiple sites with OpenVPN). That will allow you to access your LAN remotely, and just have the single OpenVPN server port open on pfSense. The default OpenVPN server port number is 1194. I suggest you pick another port number when you set it up, as external hackers know that 1194 is OpenVPN and will likely make annoying attempts to break in (which will be unsuccessful unless they get your keys). I pick a number in the 4000's - the list of officially allocated ports is at http://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml - and I just pick one that is unassigned. (Actually that doesn't matter unless you are also needing to use the assigned service) -
Thanks for the replies!
Finally got it up and running. Using the 2.1 snapshot fixed it. :)I now have the router up in bridge mode, and I can access the network and the pfSense box through the network but I can not get outside. The internet is not available, but I know it works as I'm using it now after hooking my PC straight into the modem. When I go through the setup of the WAN and the LAN, straight from the box, both the WAN and the LAN get their IP, but when I check the Webgui, it says WAN IP is blank. When I check the IP straight from the box again, the WAN is blank as well. If I set up the interfaces again, same things happen. WAN IP that shows up after the setup is the ISP IP, so I know it is getting it from the ISP, but why does it disappear? i have tried to reset the pfSense installation and only use the default settings but same things happen. Any idea what could be causing this?
My setup is now:
Cable Modem > WAN pfSense (DHCP server) > LAN out > LAN in router box (bridge mode)
Thanks!
-
What sort of WAN connection do you have, PPPoE, DHCP?
Are you initially getting the correct IP?Check the system logs for clues as to why your IP is dropped.
Steve
-
What sort of WAN connection do you have, PPPoE, DHCP?
Are you initially getting the correct IP?Check the system logs for clues as to why your IP is dropped.
Steve
DHCP WAN connection
Yes, initially getting the correct IP
I don't understand all that's in the log, but this had the correct WAN IP in it: (swapted the IP with xxs)php: /interfaces.php: Clearing states to old gateway xx.x.xxx.x
php: /interfaces.php: ROUTING: setting default route to xx.x.xxx.x
php: /interfaces.php: The command '/sbin/route change -inet default xx.xx.xx.x'' returned exit code '1', the output was 'route: writing to routing socket: No such process route: writing to routing socket: Network is unreachable change net default: gateway xx.x.xxx.x: Network is unreachable'Thanks!
-
Ok, is your test PC that you connected to the modem directly running Windows?
The problem here is that you can't use a gateway that is outside your subnet when using DHCP. My understanding is that it's against the rules and FreeBSD doesn't allow it. Windows bends those rules. ;)
Does that sound right, is the gateway outside the WAN subnet?
Steve
The problem and a possible solution are described here: http://blog.magiksys.net/pfsense-firewall-default-gateway-different-subnet
-
Ok, is your test PC that you connected to the modem directly running Windows?
The problem here is that you can't use a gateway that is outside your subnet when using DHCP. My understanding is that it's against the rules and FreeBSD doesn't allow it. Windows bends those rules. ;)
Does that sound right, is the gateway outside the WAN subnet?
Steve
The problem and a possible solution are described here: http://blog.magiksys.net/pfsense-firewall-default-gateway-different-subnet
thanks for the reply.
ouch. This went a bit above my head and I don't understand much of this. Previusly I had the netgear router just hooked up to get ip from isp and that was that. I'm guessing the netgear box then did this automatically but now I have to set it up manually doing the same job? Is there no way for pfsense to handle the wan and the lan as two individual networks in the same way? what i could understand of the turorial, i have to set wan ip to static but how can that work when i don't have static ip?
I've used my mac book pro to connect to the cable modem so I guess it those the same thing as windows?
-
The fact that it worked with the Netgear router, which is probably running Linux, implies it might be nothing to do with my previous suggestion. Only you can know for sure because only you know what the WAN IP settings are/were. If the gateway supplied via dhcp is outside the subnet of the supplied WAN IP then this is certainly an issue. It looks like it might be because your log shows pfSense trying to set a default gateway that is unreachable. :-.
Steve
-
The fact that it worked with the Netgear router, which is probably running Linux, implies it might be nothing to do with my previous suggestion. Only you can know for sure because only you know what the WAN IP settings are/were. If the gateway supplied via dhcp is outside the subnet of the supplied WAN IP then this is certainly an issue. It looks like it might be because your log shows pfSense trying to set a default gateway that is unreachable. :-.
Steve
This is what I get when I hook my Mac up to the Cable TV modem:
As for the Netgear router, all the options I have are to heck of for Get IP Dynamically from ISP:
-
The assume the redacted part is the same for both your IP and the gateway?
In that case it's not the problem I described, the gateway is in the subnet.
More likely it's some issue with the modem or ISP not accepting the MAC address. Have you tried rebooting the modem? Or spoofing the MAC in pfSense?
It could also be a compatibility problem between the two ethernet devices. I was dealing with some hardware yesterday which would negotiate a connection for about a minute and then fail, at the ethernet level. It happens more often than you think, but it's still quite rare. ;) You can usually see if that's the case as the connection shows as down (or flaps up - down) in ifconfig.
Steve
-
Did you connect the Netgear's WAN port to the pfSense LAN?
If so and you can spare a LAN port, try connecting one of the Netgear's LAN ports instead - leaving the Netgear's WAN port empty.As Steve might have been suggesting, some ISPs will limit the number of MAC addresses to which they will give IP addresses through the same cable modem. My ISP only allows two different MAC addresses - supposedly one for the tech to set it up for you with his PC and one for your PC or router. In your case, your Netgear could have taken one IP and your Mac the other. It depends on your ISP's DHCP policies. Steve's suggestion of spoofing the MAC address of pfSense (so it looks like your Mac or the Netgear's MAC) should get around that limitation. Strange that an IP address appears and then disappears though.
-
The assume the redacted part is the same for both your IP and the gateway?
In that case it's not the problem I described, the gateway is in the subnet.
More likely it's some issue with the modem or ISP not accepting the MAC address. Have you tried rebooting the modem? Or spoofing the MAC in pfSense?
It could also be a compatibility problem between the two ethernet devices. I was dealing with some hardware yesterday which would negotiate a connection for about a minute and then fail, at the ethernet level. It happens more often than you think, but it's still quite rare. ;) You can usually see if that's the case as the connection shows as down (or flaps up - down) in ifconfig.
Steve
Sorry, forgot to mention that, yes they are the same.
I actually have not tried to reboot the modem, that's pretty silly, but since the connection have worked with the Mac I haven't thought of that. On the other hand, while I've been at work posting this, my wife has been home trying to use the Internet on her Windows PC the same way I did with my Mac, and she couldn't get it to work, until, she rebooted the modem. So when I get back home, I will hook the pfSense box back up and see how that goes, even reboot the modem again while the box is connected. Will also check ifconfig.Thanks!
-
Did you connect the Netgear's WAN port to the pfSense LAN?
If so and you can spare a LAN port, try connecting one of the Netgear's LAN ports instead - leaving the Netgear's WAN port empty.As Steve might have been suggesting, some ISPs will limit the number of MAC addresses to which they will give IP addresses through the same cable modem. My ISP only allows two different MAC addresses - supposedly one for the tech to set it up for you with his PC and one for your PC or router. In your case, your Netgear could have taken one IP and your Mac the other. It depends on your ISP's DHCP policies. Steve's suggestion of spoofing the MAC address of pfSense (so it looks like your Mac or the Netgear's MAC) should get around that limitation. Strange that an IP address appears and then disappears though.
I have not used the WAN port on the Netgear router, just one of the 4 LAN ports, so guess that is not the issues. But Some have suggested to use both the Netgear firewall and the pfsense box, and use the WAN and the LAN on both boxes, that would cause that issue I guess then?
as for the IP disappearing, that is strange, but as I told Steve, I have not tried to reboot the modem, so I will try that when I get home.
Thanks.
-
rebooted the modem did not help.
Ifconfig shows wan has ipv6 but no ipv4. In the log i'm not sure how to read it so can't tell if it is up or down.
As for spoofing, what mac address should i put in?
Could there ne hardware issues?
Thanks.
-
The ifconfig command will show an IPv6 address based on the device MAC even if it's disconnected.
Look at the end of the ifconfig output for your WAN NIC. It should show something like:
fxp0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500 options=9 <rxcsum,vlan_mtu>ether 00:90:7f:87:dc:74 inet6 fe80::290:7fff:fe87:dc74%fxp0 prefixlen 64 scopeid 0x7 inet 192.168.5.11 netmask 0xffffff00 broadcast 192.168.5.255 nd6 options=1 <performnud>media: Ethernet autoselect (100baseTX <full-duplex>) status: active</full-duplex></performnud></rxcsum,vlan_mtu></up,broadcast,running,simplex,multicast>If it doesn't say either 'active' or 'autoselect' you have a problem.
Steve
-
It says active, and if I type "ifconfig re0 down, it change status to blank, and back to Active after ifconfig re0 up, so it does respond and seem to be ok, other then no IP. After the reboot of the modem, the WAN ip says 0.0.0.0, and during the log, it shows the ISP IP for a short while after startup, then disappears.
-
It's a bit hard to follow where you're up to with this. How does your network look now? Is the Netgear router between the cable modem and the pfSense WAN port?
How did you bridge the Netgear? Try it like this:
http://kb.netgear.com/app/answers/detail/a_id/965
making your Netgear a Wireless AP and 3-port switch.
-
It's a bit hard to follow where you're up to with this. How does your network look now? Is the Netgear router between the cable modem and the pfSense WAN port?
How did you bridge the Netgear? Try it like this:
http://kb.netgear.com/app/answers/detail/a_id/965
making your Netgear a Wireless AP and 3-port switch.
My setup is like this: Cable Modem > WAN pfSense Box - LAN pfSense box (DHCP on - IP pool: 192.168.1.100-245 - Static IP:192.168.1.1 ) > LAN Netgeat router (DHCP off, set to bridge mode as far as I understand and WiFi AP, Static IP: 192.168.1.2) (Netgear WAN has no cable in it).
LAN works fine with no problem communicating between the computers on the network and from computer to router and to pfSense Box, both by cable and by WiFi. But I have no Internet access. unless I hook my MAC/ or PC straight up to the cable modem which then gives me correct IP and gateway.
If I hook the pfSense WAN cable to the cable modem, I get IP 0.0.0.0 on WAN on pfSense box, yet in the log I see the correct IP appear right after reboot, but then it disapears. LAN IP is fine. -
OK, Sorry I thought you might have gone back to Modem > Netgear > pfSense
Do what Steve suggested earlier and set the pfSense WAN interface to spoof the MAC address of your Mac: Interfaces > WAN > MAC address.
