Accessing modem from inside firewall

[balubeto]

@johnpoz:

So create an outbound nat using the vip you created of 10.0.0.2 - do you need a picture?

How should I fill out this window:

?

Thanks

Bye

[ptt]

This is how i have it done….  No "VIP" here...

ADSL Modem in "Bridge"  with 172.20.254.1/29 IP address

pfSense WAN PPPoE (re1)

Modem Access Interface  "GEST"  (means: "gestión" = management)  ;)  (re1) with 172.20.254.6/29 IP address

The rest of the info, in the attached images ;)

[balubeto]

@ptt:

This is how i have it done….  No "VIP" here...

ADSL Modem in "Bridge"  with 172.20.254.1/29 IP address

pfSense WAN PPPoE (re1)

Modem Access Interface  "GEST"  (means: "gestión" = management)  ;)  (re1) with 172.20.254.6/29 IP address

The rest of the info, in the attached images ;)

I can not understand the 003 image. What rules should I add?

Thanks

Bye

[johnpoz]

Good catch ptt, no you do not need a vip if your NOT using the wan interface IP I guess.  Good catch that his wan is actually PPPoE.  I was over looking that.

But I would not suggest manual mode for the outbound nat, just use hybrid and add the nat for interface that is connected to your modem.

This is really no different than using a vip, but since your really not actually using the IP that is on your physical interface connected to your modem, you can just set the IP right on the interface and no need for a vip.

[Derelict]

Yeah PPPoE is done differently. That writeup has you putting the IP subnet of the modem on the physical interface the PPPoE is on. No VIPs there.

[balubeto]

I can not understand the 003 image. What rules should I add?

Thanks

Bye

[johnpoz]

that is not a rule.. That is the actual interface connected to the modem.. Just putting an IP address on it that matches with the IP address of the modems IP.

[ptt]

You create & configure the "Interface" for modem access (GEST in my case)

then, as John pointed, you set the NAT as "Hybrid"

now, you create the NAT Rule (Mapping) to access the Modem…

That's all..

[balubeto]

Firewall 192.168.1.1
Router 10.0.0.1

I configured the router in bridge mode and have configured the firewall in this way

When I connect my router to the WAN port on the firewall, I can't access the router. Where did a mistake?

Thank you,

Bye

[ptt]

Your NAT setting is wrong ….  Set/leave it as "Hybrid Outbound NAT"


[balubeto]

@ptt:

Your NAT setting is wrong ….  Set/leave it as "Hybrid Outbound NAT"

This setting

is fine?

Thanks

Bye

[johnpoz]

Why do you have 10.0.0.0/8 on your lan side??  Also why is your LAN connected to Bridge0???

[bimmerdriver]

My gateway uses a private network address for the management interface. My routers are connected to a bridged port so they don't have visibility of the private network. I wanted to be able to access the gateway, but I was okay with not having it accessible from any computer. I had a spare NIC on the hyper-v server that is hosting the pfsense routers, so I connected it one of the LAN ports on the gateway and bumped up the metric so the route wouldn't be used except to access the private address. I don't think there's any reason why it wouldn't work on any host with dual NICs.

[balubeto]

Router VDSL2 in Bridge mode: 10.0.0.1
Firewall hardware: 192.168.1.1

I connected the router to the WAN port of the firewall configuring it in this way:

but I can not access the router from the LAN and I have no Internet because the PPPoE client can not connect even if its login is correct. Why?

Thanks

Bye

[Derelict]

Does your PPPoE work if you get rid of all the modem access junk? Is there anything interesting in the PPP logs? Are you sure the modem is in bridge mode?

After you get PPPoE working again and you go back to trying to access the modem, are you sure it's 10.0.0.0/8 and not 10.0.0.0/24?

[balubeto]

@Derelict:

Does your PPPoE work if you get rid of all the modem access junk? Is there anything interesting in the PPP logs? Are you sure the modem is in bridge mode?

After you get PPPoE working again and you go back to trying to access the modem, are you sure it's 10.0.0.0/8 and not 10.0.0.0/24?

Why should I put 10.0.0.0/24?

Thanks

Bye

[Derelict]

Because that's the netmask the cable modem is configured for? I asked if you were sure. I didn't say you should change it.

[jahonix]

And on your Modem_access Interface you should UNcheck "Block private networks".

[johnpoz]

How exactly do you think your nat is going to work?  You have 10.0.0/8 as dest but you also have it a source for your lan automatic nat, etc.

What I would do is START over!!!  delete all that crap.. And why again do you think you need to run a bridge on pfsense?

And I find it highly unlikely your "modem" is using /8 as its mask for its 10 address.. Your status doesn't even show your wan interface up..

[balubeto]

I noticed that if I enable the Interfaces –-> Modem_access interface and, then, I click on the Connect button on the Status ---> Interfaces, the firewall connects to the Internet but the computers on the LAN have no more Internet. Why?

Thanks

Bye