Wifi and LAN on same subnet (SOLVED)
-
I think you want to remove OPT2 from the bridge membership. OPT2 is a bridge interface consisting of LAN and WIFI.
-
Well I'm a little confused now since you asked me about Opt2. I got the information from a post on here and followed it. Question I have no is do I need Opt2?
Here is what this guy posted and I followed. Maybe this is wrong?
Finaly i got it working but it was a hard peace of trail and error.
1. create a new interface -> Opt2
2. Setup the interface IP for Opt2 (interfaces ->Opt2) and change the name if you want
3. Setup the DHCP Server for Opt2
4. Create a "Source=Bridge subnet; rest=any" Firewall rule for Opt2
5. create a bridge: Interfaces -> Bridges, and select LAN and Wifi
6. Select the Bridge as "Network port" for Opt2; Interfaces-> asign
7. Deactivate the DHCP server of LAN and Wifi
8. Set the Type of LAN and Wifi to "None"Now your LAN and Wifi clients should get an IP from the DHCP server configured for Opt2 and these clients should be able to access the internet.
But they are currently not able to access each other WLAN <-> LAN.
So solve that i added two rules for the Firewall:
1. LAN: Source=Bridge subnet; rest = any
2. WLAB: Source= Bridge subnet; rest=anyInstead of adding these two rules you can also change the value at : System -> Advanced -> System tuneables -> net.link.bridge.pfil_member-> "0"
At that point my clients where able to ping each other and also wake up on lan from my tablet to a PC was working.
If you have any hints what i can do better on my configuration feel free to let me know.
« Last Edit: May 21, 2012, 04:28:12 pm by nimanic » -
5. create a bridge: Interfaces -> Bridges, and select LAN and Wifi
You selected LAN, WIFI, and OPT2, not LAN and WIFI.
Change that and if you did everything else it should work.
-
Still not working.
-
This is a fresh Install of Pfsense. I've connected to it so it has internet access.
Maybe if someone could give me the instructions on how to do this from start.
Here is all I want.
Pfsense on 10.10.0.1
Wifi on 10.10.0.2Pretty simple. I must have gotten something messed up.
-
The instructions you already posted look pretty good.
Typical debugging should probably be done.
Do you get DHCP on the WIFI port? On the LAN port?
Can you ping the OPT2 address from the WIFI port? From the LAN port?
Can you ping the next hop gateway from the WIFI port? From the LAN port?
Can the Hosts on LAN ping the hosts on WIFI? Vice versa?
What DNS is being handed out to the DHCP clients? Is that the DNS server actually in use by the clients? Can you resolve names using that address?
Etc. -
I am of the mind that things could be done easier in pfSense for the creation of bridges and wireless access points. I have considered requesting forum help for a wireless setup wizard -using something like what pfSense includes now at initial setup in WebConfigurator. I know everybody hates wizards but pfsense setup wizard is easy enough to click thru. I would like to see enhanced functionality with it. Is this something that seems logical to anyone else? I hate doing the cable swap for bridge creation but it works..
A suggestion for help is disable firewall from Advanced Settings on the Menu. It will prevent lockout until you figure it out what is what. And i know i hate re-imaging my CF card -so i do the restore last backup from console - to save time on lockouts when i was learning. pfsense automatically saves backups at each settings change it seems. Very convenient.
-
Yes I'll have to do some debugging. Just keep cutting myself out.
Do you get DHCP on the WIFI port? On the LAN port? WiFi yes. Not sure about LAN since I static those.
Can you ping the OPT2 address from the WIFI port? From the LAN port? I can't ping anything but the wifi device I'm testing with
Can you ping the next hop gateway from the WIFI port? From the LAN port? No same as above.
Can the Hosts on LAN ping the hosts on WIFI? Vice versa? No. It's like the bridge blocks everything and isolates the wifi.
What DNS is being handed out to the DHCP clients? Is that the DNS server actually in use by the clients? Can you resolve names using that address? Even static with DNS still doesn't work.
I'm going to have to do more research on this and try and break it down piece by piece and see what's going on. I've been driving myself crazy trying to figure this out. I know on paper its right and I drew it out many times then applied it.
Just strange.
Thanks for all your time and help.
Rick
-
What firewall rules are on LAN and WIFI?
Does anyone know for sure that the xl driver still works?
Do you get DHCP on the WIFI port? On the LAN port? WiFi yes. Not sure about LAN since I static those.
Can you try? If you can get DHCP (and have ARP, etc) then it's not a layer2 problem and we really need to look at rules.
-
Wow… Someone really needs to document how to do this! Need Documentation on Normal setup of WiFi and then WiFi on the Same Subnet.
I've been researching this for almost 2 weeks now and I'm really tied of trying to get this to work.
I have read every post I could find on this. I've watched every Youtube Video and Even the one on Pfsense Site... The problem is NOT 2 of any of the documentation is the same. Seems everyone does it different, but none of it works.
Really wish someone could post how to do this that's done it already. :(
-
It's just not that difficult. Bridging works fine.
The instructions you have already posted cover everything you need to do.
If it doesn't work you need to be able to troubleshoot it to find out what was done incorrectly or where the problem otherwise lies.
-
Well I got as far as being able to ping anything on the network from wireless or static. The WiFi just can't get out. WiFi gets an IP address from DCHP.
-
What are the firewall rules on wifi? You need rules on all bridge members and the bridge itself.
-
LAN Net > Any
WiFi Net > Any
Bridge Net > Any -
Here is all the steps I exactly took:
Fresh Build Pfsense. Got it configured and connected my computer to it and have internet access and access to my LAN.
1. Shut down install WiFi card (Card is on the recommended list of cards that work with Pfsense)
2. Interfaces > Added WiFi card (Opt1) renamed it to WiFi. > Setup WiFi settings.
3. Interfaces > Assign > Bridges > Created a Bridge > Renamed it to Bridge > Selected LAN and WiFi
4. Interfaces > Added new Interface > Opt2 > Renamed to Bridge > Network Port = Bridge
5. DHCP Server > Turned on DHCP for Bridge > Enabled > Set Range. (No DHCP on LAN or WiFi)
6. Firewall > Rules > Added New Rule > Source = Bridge Net > Rest set to Any.
7. System > Advanced > System Tuneables > net.link.bridge.pfil_member > Changed from 1 to 0
8. Interfaces > LAN > IPv4 Configuration Type = None > IPv6 Configuration Type = None
9. Interfaces > WiFi > IPv4 Configuration Type = None > IPv6 Configuration Type = NoneMy Configuration:
Old:
WAN > DHCP
LAN > 10.10.0.1New:
WAN > DHCP
LAN >
WiFi >
Bridge > 10.10.0.2 > DHCPI can connect my Phone and Laptop to WiFi. I can ping both from either one. No Internet Access.
Now you know what steps I took to get here. I know them well I've rebuilt it about 20+ Times from scratch trying to get this to work.
Thanks,
Rick -
LAN Net > Any
WiFi Net > Any
Bridge Net > AnyWhat interfaces are those on? There should be no more LAN net or WIFI Net - only Bridge Net.
-
Here are the Firewall Rules
-
First, change your bridge rules to any. You have them set for TCP only. DNS and many other things won't work like that.
Second, make rules on LAN and WIFI that look EXACTLY like the rules on bridge. (Not with source LAN net or WIFI net, but for BRIDGE net - yes, on LAN and WIFI, source BRIDGE net)
-
Still not working.
-
All your rules are still TCP only, bro.
Change them all to this:
![Screen Shot 2014-11-18 at 8.56.33 AM.png](/public/imported_attachments/1/Screen Shot 2014-11-18 at 8.56.33 AM.png)
![Screen Shot 2014-11-18 at 8.56.33 AM.png_thumb](/public/imported_attachments/1/Screen Shot 2014-11-18 at 8.56.33 AM.png_thumb) -
Did that still not working.
-
What's not working?
Do you get DHCP on the WIFI port? On the LAN port?
Can you ping the BRIDGE address from the WIFI port? From the LAN port?
Can you ping the next hop gateway from the WIFI port? From the LAN port?
Can the Hosts on LAN ping the hosts on WIFI? Vice versa?
What DNS is being handed out to the DHCP clients? Is that the DNS server actually in use by the clients? Can you resolve names using that address?
Etc. -
Wait… From my phone I'm connected to Pfsense. I opened Chrome browser and can't get to any website, BUT I just accidentally went to my cloud and it loaded. At this point and some testing... I can access any https site, just not http sites.
-
Let me guess. You're also trying to run squid or snort or both.
-
No actually it's a fresh install and no packages installed.
Can't seem to figure out what it is. So Close! smh
-
That doesn't make any sense. pf or otherwise. Firewall logs logging anything?
-
I don't see anything,
But the question I have is how long has WiFi worked just was blocking non secure websites? I'll backup the config then rebuild it again from scratch and find out.
I really appropriate all the help you've given me. Thank You for all your Help!
Rick
-
Proxy configured in the web browser? Weird.
-
Totally rebuilt it. Setup just like I did before. WiFi works on https only. So this whole time it basically worked. Just not for non secure!
I'm going over everything since now I have fresh log files.
-
Ok Got It! I had a setting wrong on my phone. The LAN computers connected worked just fine.
Got to give the Credit to "Derelict" for getting this working! Thanks!!!
This is to setup a WiFi card on the same subnet
Here are the Steps. (After you get a pfsense box up and running, connected to the internet. (I renamed Opt1 and Opt2)
1. Shut down install WiFi card (Card is on the recommended list of cards that work with Pfsense)
2. Interfaces > Added WiFi card (Opt1) renamed it to WiFi. > Setup WiFi settings.
3. Interfaces > Assign > Bridges > Created a Bridge > Renamed it to Bridge > Selected LAN and WiFi
4. Interfaces > Added new Interface > Opt2 > Renamed to Bridge > Network Port = Bridge
5. DHCP Server > Turned on DHCP for Bridge > Enabled > Set Range. (No DHCP on LAN or WiFi)
6. Firewall > Rules > Added New Rule > Interface > LAN > Source = Bridge Net > Protocol = ANY > Rest set to ANY.
7. Firewall > Rules > Added New Rule > Interface > WiFi > Source = Bridge Net > Protocol = ANY > Rest set to ANY.
8. Firewall > Rules > Added New Rule > Interface > Bridge > Source = Bridge Net > Protocol = ANY > Rest set to ANY.
9. Interfaces > LAN > IPv4 Configuration Type = None > IPv6 Configuration Type = None
10. Interfaces > WiFi > IPv4 Configuration Type = None > IPv6 Configuration Type = None
11. Interfaces > WiFi > Allow intra-BSS communication > Check Box. < For WiFi devices to talk to each otherI have to come back and give the Answer! LOL Trust me I've seached a lot of stuff on Cisco and I would find Headings that said "Solved!" and you read all the way to the end and all they would say is "Got it Working" with no directions on how too! lol
Again Thanks Derelict.
Rick
-
Glad it's working.
One last little thing. With this:
9. System > Advanced > System Tuneables > net.link.bridge.pfil_member > Changed from 1 to 0
This should be unnecessary:
6. Firewall > Rules > Added New Rule > LAN > Source = Bridge Net > Protocol = ANY > Rest set to Any.
7. Firewall > Rules > Added New Rule > WiFi > Source = Bridge Net > Protocol = ANY > Rest set to Any.With that sysctl set to 0 I'm pretty sure those rules on the bridge members aren't being looked at at all.
-
Ok Removed
9. System > Advanced > System Tuneables > net.link.bridge.pfil_member > Changed from 1 to 0
-
Ok.. I'm back :( But with just a little issue.
From my computer I can Ping another Computer. I can ping a WiFi, phone, laptop, etc.
From my laptop I can ping my Computer, But can't ping any WiFiBasically WiFi to WiFi I can't ping. I need this to work because I connect my Phone to a WiFi Device and it can't see it.
Not sure what to do here.
-
Probably wifi isolation.
“Intra-BSS Communication
If you check Allow intra-BSS communication, wireless clients will be able to see each other directly, instead of routing all traffic through the AP. If clients will only need access to the Internet, it is typically safer to uncheck this. ”
Excerpt From: Jim Pingle. “pfSense-2.1-book.epub.” iBooks. https://itunes.apple.com/WebObjects/MZStore.woa/wa/viewBook?id=3AC70C08837752AA49E641D5CEB871FE
-
That was it!! Working!
Thanks Again!
Updated HowTo
Interfaces > WiFi > Allow intra-BSS communication > Check Box. < For WiFi devices to talk to each other
-
Credit goes to Rickinfl for this solution.
What I have here is based upon what Rickinfl has typed up, but I've changed things up just a bit and added a few steps. I kept getting locked out when changing settings on the LAN IP, but finally got it figured out. This works for 2.2.6.
I'm posting because I thought it may be helpful for those trying to bridge the LAN and WIFI so they're on the same subnet. Hope this helps.
Bridging Wifi to LAN Interface
1- Set up wizard - set the initial LAN IP address to be higher than the final LAN IP, and set the netmask to /30.
For example, if you want the LAN IP to be 192.168.1.1, set the IP for the LAN to be 192.168.1.50 /30 during this step.
2- Interfaces > Assign > Add (it will be auto-named Opt1)
3- Click on Opt1 to set up Wifi Settings
3.1 Rename to Wifi
3.2 Enable interface
3.3 Under “Network-Specific Wireless Configuration” Set mode to “Access Point”
3.4 Set channel to Operate on
3.5 Select WIFI name and passphrase
3.6 Check “Allow intra-BSS Communication”
3.7 Check “Enable WME”
4- Interfaces > Assign > Bridges > Create a Bridge [+ Add] > Selected LAN and Wifi as the interfaces on this bridge > Save
5- Interfaces > Add new Interface [+ Add] > Opt2 > Set Network port = Bridge > Save
6- From Interfaces, click on Opt2 to change options
6.1 Enable Interface
6.2 Rename to “Bridge”
6.3 IPv4 Configuration Type = Static IPv4 >
6.4 IPv4 address = acutual desired IP address of LAN [must set netmask to 30 for now - will change to 24 later] (example above would be 192.168.1.1)
6.5 Save
7- Services > DHCP Server > Turn on DHCP for Bridge > Enabled > Set Range (range with a /30 netmask will be small)
8- Disable DHCP on LAN and WiFi (if they are enabled)
9- Firewall > Rules > Added New Rule > Interface > LAN > Source = Protocol = ANY > Bridge Net > Reset to ANY.
10- Firewall > Rules > Added New Rule > Interface > WiFi > Source = Bridge Net > Protocol = ANY > Rest set to ANY.
11- Firewall > Rules > Added New Rule > Interface > Bridge > Source = Bridge Net > Protocol = ANY > Rest set to ANY.
12- From “Interfaces” set the IPv4 Configuration Type for both LAN and Wifi to None.
13- Router is now reachable by the Bridge IP address (192.168.1.1) and the LAN and WIFI are bridged.
14- Log into router by Bridge IP and change the netmask to /24
15- Change DHCP scope options