Accessing modem from inside firewall

ptt

This is how i have it done…. No "VIP" here...

ADSL Modem in "Bridge" with 172.20.254.1/29 IP address

pfSense WAN PPPoE (re1)

Modem Access Interface "GEST" (means: "gestión" = management) ;) (re1) with 172.20.254.6/29 IP address

The rest of the info, in the attached images ;)

001.png_thumb

002.png_thumb

003.png_thumb

004.png_thumb

005.png_thumb

006.png_thumb

balubeto

@ptt:

This is how i have it done…. No "VIP" here...

ADSL Modem in "Bridge" with 172.20.254.1/29 IP address

pfSense WAN PPPoE (re1)

Modem Access Interface "GEST" (means: "gestión" = management) ;) (re1) with 172.20.254.6/29 IP address

The rest of the info, in the attached images ;)

I can not understand the 003 image. What rules should I add?

Thanks

Bye

johnpoz

Good catch ptt, no you do not need a vip if your NOT using the wan interface IP I guess. Good catch that his wan is actually PPPoE. I was over looking that.

But I would not suggest manual mode for the outbound nat, just use hybrid and add the nat for interface that is connected to your modem.

This is really no different than using a vip, but since your really not actually using the IP that is on your physical interface connected to your modem, you can just set the IP right on the interface and no need for a vip.

Derelict

Yeah PPPoE is done differently. That writeup has you putting the IP subnet of the modem on the physical interface the PPPoE is on. No VIPs there.

balubeto

I can not understand the 003 image. What rules should I add?

Thanks

Bye

johnpoz

that is not a rule.. That is the actual interface connected to the modem.. Just putting an IP address on it that matches with the IP address of the modems IP.

ptt

You create & configure the "Interface" for modem access (GEST in my case)

then, as John pointed, you set the NAT as "Hybrid"

now, you create the NAT Rule (Mapping) to access the Modem…

That's all..

NAT_Hybrid.png_thumb

NAT_CFG.png_thumb

balubeto

Firewall 192.168.1.1
Router 10.0.0.1

I configured the router in bridge mode and have configured the firewall in this way

When I connect my router to the WAN port on the firewall, I can't access the router. Where did a mistake?

Thank you,

Bye

ptt

Your NAT setting is wrong …. Set/leave it as "Hybrid Outbound NAT"

![Your NAT is wrong.jpg](/public/imported_attachments/1/Your NAT is wrong.jpg)
![Your NAT is wrong.jpg_thumb](/public/imported_attachments/1/Your NAT is wrong.jpg_thumb)

balubeto

@ptt:

Your NAT setting is wrong …. Set/leave it as "Hybrid Outbound NAT"

This setting

is fine?

Thanks

Bye

johnpoz

Why do you have 10.0.0.0/8 on your lan side?? Also why is your LAN connected to Bridge0???

bimmerdriver

My gateway uses a private network address for the management interface. My routers are connected to a bridged port so they don't have visibility of the private network. I wanted to be able to access the gateway, but I was okay with not having it accessible from any computer. I had a spare NIC on the hyper-v server that is hosting the pfsense routers, so I connected it one of the LAN ports on the gateway and bumped up the metric so the route wouldn't be used except to access the private address. I don't think there's any reason why it wouldn't work on any host with dual NICs.

balubeto

Router VDSL2 in Bridge mode: 10.0.0.1
Firewall hardware: 192.168.1.1

I connected the router to the WAN port of the firewall configuring it in this way:

but I can not access the router from the LAN and I have no Internet because the PPPoE client can not connect even if its login is correct. Why?

Thanks

Bye

Derelict

Does your PPPoE work if you get rid of all the modem access junk? Is there anything interesting in the PPP logs? Are you sure the modem is in bridge mode?

After you get PPPoE working again and you go back to trying to access the modem, are you sure it's 10.0.0.0/8 and not 10.0.0.0/24?

balubeto

@Derelict:

Does your PPPoE work if you get rid of all the modem access junk? Is there anything interesting in the PPP logs? Are you sure the modem is in bridge mode?

After you get PPPoE working again and you go back to trying to access the modem, are you sure it's 10.0.0.0/8 and not 10.0.0.0/24?

Why should I put 10.0.0.0/24?

Thanks

Bye

Derelict

Because that's the netmask the cable modem is configured for? I asked if you were sure. I didn't say you should change it.

jahonix

And on your Modem_access Interface you should UNcheck "Block private networks".

johnpoz

How exactly do you think your nat is going to work? You have 10.0.0/8 as dest but you also have it a source for your lan automatic nat, etc.

What I would do is START over!!! delete all that crap.. And why again do you think you need to run a bridge on pfsense?

And I find it highly unlikely your "modem" is using /8 as its mask for its 10 address.. Your status doesn't even show your wan interface up..

balubeto

I noticed that if I enable the Interfaces –-> Modem_access interface and, then, I click on the Connect button on the Status ---> Interfaces, the firewall connects to the Internet but the computers on the LAN have no more Internet. Why?

Thanks

Bye

johnpoz

Prob has something to do with running same 10/8 network on both your wan and lan? Or maybe some nonsense you did with a bridge??

What I would do is start over!! NO freaking bridges… Actually validate what your modem is using for its mask on this 10 address. And then create your interface using that.. And don't use an overlapping network on your lan side, etc.