APU set up with Wi-Fi

stephenw10

Don't quite understand why different subnets are needed, as the router can use IP 192.168.1.180/24.

I'm not quite sure what you mean by this. :-\ The interfaces themselves need to be in different subnets in order for pfSense to route traffic between them correctly. Clients on the interfaces will obviously be in the same subnet.

@eiger3970:

Device now connects to pfSense Wi-Fi but won't load websites.

What firewall rule did you add? Check the firewall logs for blocked traffic.

Steve

eiger3970

Sorry if I was unclear.
I meant my currently working Wi-Fi router uses IP 192.168.1.180/24.

The new pfSense Wi-Fi router just has a default firewall rule added, as the pfSense Wi-Fi setup tutorial didn't have any instructions on settings to make the Internet connection work, just how to configure the Wi-Fi interface.
Seems to be missing some final steps to connect to the Internet?

So, the firewall rule is
Action: Pass
Disabled: unticked
Interface: Wi-Fi
TCP/IP Version: IPv4
Protocol: TCP
Source: unticked
Destination: unticked
Destination port range: from: any. to: any
Log: unticked
Description: blank

stephenw10

@eiger3970:

I meant my currently working Wi-Fi router uses IP 192.168.1.180/24.

Ah, OK. In that situation your router is bridging the wireless network to the LAN and the same subnet spans both. You can do that in pfSense with your new card using a software bridge but I suggest you first get it working as a separate interface.

Your firewall rule only allows TCP which means that DNS on UDP port 53 is still blocked. I imagine your browser if giving errors like 'cannot resolve host'. You need to either change the protocol in your existing rule to tcp/udp or 'any' or add a new rules to allow UDP port 53.

Steve

eiger3970

I tried changing the pfSense > Firewall > Rules > edit rule > Edit Firewall rule > Protocol > but the protocol says TCP/UDP and is greyed out.
This means I can't change the greyed out TCP/UDP setting to allow Wi-Fi to load webpages?

stephenw10

Hmm, seems odd. I don't know why you wouldn't be able to change the protocol. That was on the new wifi interface?
You can always add an extra rule to allow it. See my example screenshots below. The LAN4 rule simply allows out all traffic, this would work fine on your wifi interface. The WIFI1 rules are significantly more complex! They prevent wireless clients talking to machines on my wired networks whilst allowing them to connect to the internet. You can see my rule to allow DNS in there.

Steve

LAN4_rules.png_thumb

WIFI1_rules.jpg_thumb

eiger3970

Thank you for the screen shots.
I'm not sure how you setup your Wi-Fi, however my Firewall rule I setup with defaults seems wrong or different to yours and won't change due to greyed out fields.

I have included 3 attachments with the screenshots.

![Firewall rules.png](/public/imported_attachments/1/Firewall rules.png)
![Firewall rules.png_thumb](/public/imported_attachments/1/Firewall rules.png_thumb)
![Firewall rules edit 1.png](/public/imported_attachments/1/Firewall rules edit 1.png)
![Firewall rules edit 1.png_thumb](/public/imported_attachments/1/Firewall rules edit 1.png_thumb)
![Firewall rules edit 2.png](/public/imported_attachments/1/Firewall rules edit 2.png)
![Firewall rules edit 2.png_thumb](/public/imported_attachments/1/Firewall rules edit 2.png_thumb)

stephenw10

That's not your wifi rule, that's a rule on your WAN interface to allow in traffic to your internal webserver. It's probably greyed out because it's autogenerated by a port forward you setup.

Go to the WIFI TAB at the top to see your rules on the wifi interface. Edit that instead. ;)

Steve

eiger3970

Oops, I missed the Wi-Fi tab.
That fixed it, Wi-Fi working.

Now I can try some of the snort and firewall advanced things, but the basics seem to be running for now.
Oh, I need to set the security to a MAC filter like my old router, so I will research how to do that.

Thanks for the help:-)

eiger3970

It was working, however my mobile was connecting to the old router which has the MAC filter setup.
I haven't been able to setup a MAC filter on pfSense yet.
Today I tried to move the mobile over from the old router Wi-Fi to the pfSense Wi-Fi, however the pfSense Wi-Fi network is not found?

So, 2 problems:
1. pfSense Wi-Fi network not found.
2. pfSense MAC filter not available for security?
I prefer a MAC filter as:
everything is blocked.
only permitted devices can connect.
no encryption means faster transmission rates.
as secure as a 12 character password. (yes, maybe 8 character password if a hacker knows the first 4 MAC character common to manufacturers).

GruensFroeschli

@eiger3970:

It was working, however my mobile was connecting to the old router which has the MAC filter setup.
I haven't been able to setup a MAC filter on pfSense yet.
Today I tried to move the mobile over from the old router Wi-Fi to the pfSense Wi-Fi, however the pfSense Wi-Fi network is not found?

So, 2 problems:
1. pfSense Wi-Fi network not found.

If you can't see the network with your mobile device, i suggest installing a wifi analyzer akin to:
https://play.google.com/store/apps/details?id=com.farproc.wifi.analyzer&hl=en

2. pfSense MAC filter not available for security?

A MAC filter provides zero security.
All you need is a device with which you can listen to traffic on the air, so basically everything which is capable of connecting to said access point. After that change your own MAC to one of the "allowed" addresses.

I prefer a MAC filter as:
everything is blocked.
only permitted devices can connect.
no encryption means faster transmission rates.

This is something you REALLY don't want to do.
No encryption does not increase the speed.
Everyone with a wlan capable device can listen to whatever you transmit over the air.
The only thing that changes is the time it takes to connect to the network.
And even then we are talking about 5ms increased time until you are connected.
You really need to have WPA2 (or at least WPA).

as secure as a 12 character password. (yes, maybe 8 character password if a hacker knows the first 4 MAC character common to manufacturers).

Not sure what you are talking here about. The password has absolutely nothing to do with the MAC addresses.
For WPA2 the password has a minimal length of 8 characters and can be up to 63 characters.

eiger3970

Thank you for the reply.
My mobile has a regular Wi-Fi finder which finds other working Wi-Fi networks.
Other devices also find Wi-Fi networks and not the pfSense Wi-Fi network.
So I don't think there's a need to download another Wi-Fi finding app.

Ok, I will setup the pfSense Wi-Fi network on WPA2 password encryption, once the pfSense Wi-Fi works.

stephenw10

What channel is your pfSense wifi card using? It may be one that your phone cannot use, 12,13 or 14 for example.

Steve

GruensFroeschli

Another thing which could be wrong: Did you set the channel specifically or did you set it to "auto"?
I've seen cards not work with the "auto" setting.

eiger3970

Thanks.
I think I found the right information under pfSense > Dashboard: Interfaces: WIFI > Common wireless configuration - Settings apply to all wireless network on ath0. > Channel: Auto.
There are 37 other manual channels to choose from?

I should mention all devices on Wi-Fi don't find the pfSense Wi-Fi network.

eiger3970

Ok, I just tried 3 channels from the choice of 37 channels.

11b/g/n - 1 (2412 MHz @ 31.5 / 20)
11a/n - 36 (5180 MHz @ 31.5 / 30)
11a/n - 100 (5500 MHz @ 31.5 / 30)

No change though.

stephenw10

You're still running 2.1.X right? Then you shouldn't be seeing any 'N' channels. Are you using 'A'? Use 802.11G mode only and you should be OK.

Steve

eiger3970

Yes, I'm on pfSense Version 2.1.4-RELEASE (amd64) FreeBSD 8.3-RELEASE-p16.

The Wi-Fi Interface Standard is 802.11g.
The Wi-Fi Interface Channel is Auto.

stephenw10

802.11g channels are 1-11 almost everywhere, 1-13 in some places including the UK and some other places can use 14 (Japan?). If you're using G mode then it shouldn't allow you to select anything in the 5GHz ranges. My own card here is G only so I can't be 100% sure what you'll see. Anything in the logs?

Steve

Edit: confusing typo

GruensFroeschli

@stephenw10:

802.11g channels are 1-11 almost everywhere, 1-13 in some places including the UK and some other places can use 14 (Japan?). If you're using G mode then it should allow you to select anything in the 5GHz ranges. My own card here is G only so I can't be 100% sure what you'll see. Anything in the logs?

Steve

Didn't you mean 2.4GHz ;)
5GHz is 802.11a

@eiger3970:

Yes, I'm on pfSense Version 2.1.4-RELEASE (amd64) FreeBSD 8.3-RELEASE-p16.

The Wi-Fi Interface Standard is 802.11g.
The Wi-Fi Interface Channel is Auto.

Don't set the channel to auto.
Set it as a test to 2412 (channel 1) b/g

eiger3970

Ok, I set the Wi-Fi to:
Standard: 802.11g
Channel: 11b/g/n - 1 (2412 MHz @ 31.5 / 20)

Weird, now the mobile finds the network, but didn't just before.
I also updated pfSense which might have helped.

Anyways, now that the mobile is finding the pfSense Wi-Fi network, I might be able to somehow turn off the old router Wi-Fi and then set pfSense with WPA2 and a secure password for users.
Bye bye old MAC filter list on the old router Wi-Fi :-(