Cablem Modem Access - Behind Pfsense
-
you really shouldn't have to do anything here. I access my cable modem on 192.168.100.1 without doing anything in pfsense at all. It gets a public IP 24.13.x.x and I have no issues accessing my cable modem interface.. Works out of the box.
While it shouldn't matter the only rule I have disabled is the block rfc1918 and bogon on the wan because I see no point to them, they do nothing in the real world since networks they block don't route on the internet anyway. And I have my port forwards open to the planet so what is the point in having a rule to block something that doesn't even route ;)
-
What is your LAN subnet and what do your LAN firewall rules look like? Screenshots would be wonderful.
-
My guess is one of these issues-
Your LAN is 192.168.100.0/x
You have built LAN rules that block your LAN from accessing 192.168.100.1 (maybe without realizing it..)
This modem is rented and your ISP has turned off the the GUI (which you have already disproved)
If 192.168.100.1 is outside your LAN subnet you will have no problem reaching it by default. If it is inside your LAN subnet it will be unreachable as your client machines wont even pass the request to your pfSense box but instead try and find it locally.
-
Here are screen shots of the current firewall rules. The cable modem is my own hardware. The GUI for the cable mode is operational if I make a direct connection with a notebook computer (no firewall).
-
You block RFC1918 networks on WAN. 192.168.x.y is one of those private RFC1918 networks.
At Interfaces | WAN you should uncheck "Block private networks". -
You block RFC1918 networks on WAN. 192.168.x.y is one of those private RFC1918 networks.
At Interfaces | WAN you should uncheck "Block private networks".That's only for ingress traffic. Reaching the modem is egress. Don't change that, it's fine as-is.
-
Sure and I would think so too.
I have a VDSL modem in router mode (…don't ask) with an RFC1918 IP on WAN of my pfSense and I had to explicitly uncheck this to get modem access working.
Don't know why this solved it this way but I had to get VoIP working first and didn't care about it later. -
I can access my cable modem IP of 192.168.100.1 with 0 changes to pfsense config. It just works.
Make sure you have a firewall rule on your LAN interface that allows you to reach any destination IP address. If you are restricting access from LAN interface to RFC1918 addresses, then you will have to have a rule above it that allows you to reach destination 192.168.100.1.
No reason why this shouldn't work.
-
What is your LAN subnet ?
Please! ;)
Here are screen shots of the current firewall rules. The cable modem is my own hardware. The GUI for the cable mode is operational if I make a direct connection with a notebook computer (no firewall).
Can you also post what your firewall logs say when you try to connect? Is there anything there that would indicate a block? (my guess is you will see nothing there.)
Try from your desktop- c:/>ping 192.168.100.1
Try from your pfsense box.. /diagnostic/ping 192.168.100.1
-
Thanks for all the help in trying to understand the issue. I checked the firewall log after multiple attempts to access 192.168.100.1 (no entry). I noticed that the browser (firefox) shows https://192.168.100.1. Interesting it is https. The ip traffic passes through the firewall via the ping process. I have attached a screen capture. Could the issue be some sort of dns problem? The LAN subnet is 192.168.1.0, 255.255.255.0
 -
so clearly you can ping it.. So are you running a proxy.. That could cause you issues, or captive portal?
-
No proxy running on the firewall or elsewhere. The web browsers on the workstation are direct connect ie. no proxy. I am trying to examine everything to figure out what's in the world is causing the issue. Thanks for your suggestions. I am just going to continue until the source is discovered!
Best,
Howard
-
what I would do is sniff on your wan.. You see the request going out to 192.168.100.1 - what do you get back if anything? Makes no sense that if you can ping it, and its has a gui that is there that you would not be able to access it.
You don't have any floating rules do you? Some people that have really tight tinfoil hats like to lock down on outbound anything to rfc1918.. There been some threads about it, Its also a way to make sure you don't leak noise packets. So it can be a good thing… I tried it for a while, but when I got no hits on it ever. I wasn't leaking rfc1918 out to the internet I saw no use of it - and yeah it prevented me from talking to my modem.
See attached, where the rfc1918 float rule is disabled. But I do still have my anti noise netbios rule. Window machines has a nasty habit of doing a directed query to even public IPs via netbios.. Just no reason to let that out just trying to be a good netizen and keep my network from adding to the noise of the internet.
-
With my Motorla SB6120, I could access the GUI on 192.168.100.1 with no changes to pfSense. With my Cisco DPC3848, I cannot (though I can still ping it). I believe that a lot of modems will allow any source IP address to connect (netmask 0.0.0.0) while others require the source IP address to be in the same subnet (192.168.100.0/24).
Below is how I got it working. Create a virtual IP (I use 192.168.100.2), and then create an outbount NAT rule to translate your computer's IP address to 192.168.100.2 when accessing 192.168.100.1 so that your modem won't ignore it. I had to reboot the pfSense firewall after doing this for it to take effect.
- Firewall -> Virtual IPs
- Type: IP Alias
- Interface: WAN
- Address Type: Single address
- Address: 192.168.100.2 (if your modem's GUI is on 192.168.100.1)
- VHID Group: 1
- Advertising frequency: Base - 1, Skew - 0
- Firewall -> NAT -> Outbound
- choose "Hybrid Outbound NAT rule generation
- Add a new rule:
a) Interface: WAN
b) Protocol: Any
c) Source: Any
d) Destination: Type - Network
e) Destination network for the outbound NAT mapping: 192.168.100.1/32
f) Translation: Address - 192.168..100.2()
g) Description: "Cable modem access"
-
What port did you specify in the Firewall Outbound setup?
-
I left all the ports blank ('all ports').
-
What is the absolute error on your browser when you try? HTTPS might just be a certificate error and refusal to connect.
-
No certificate error. But just wondered if htts might be an issue. I am still working on this today to see if I can make any progress. It may be just some issue with the Netgear CM 500 cable modem. I had an older Arris SB 6141 cable modem and had absolutely no issue. If these firm could just have a "engineering standards approach there would be less issues!
-
Have you tried forcing http? I can reach my cable modem with http://192.168.100.1, but not https://192.168.100.1.
*update: Mine is a Netgear CM600.
-
Thanks for tip. I tried it and it started to connect but then just stalled after I put in the user and password. I then tried to repeat the process and no connection was available. Some strange process…
