Accessing modem from inside firewall

balubeto

I noticed that if I enable the Interfaces –-> Modem_access interface and, then, I click on the Connect button on the Status ---> Interfaces, the firewall connects to the Internet but the computers on the LAN have no more Internet. Why?

Thanks

Bye

johnpoz

Prob has something to do with running same 10/8 network on both your wan and lan? Or maybe some nonsense you did with a bridge??

What I would do is start over!! NO freaking bridges… Actually validate what your modem is using for its mask on this 10 address. And then create your interface using that.. And don't use an overlapping network on your lan side, etc.

balubeto

@johnpoz:

Prob has something to do with running same 10/8 network on both your wan and lan? Or maybe some nonsense you did with a bridge??

What I would do is start over!! NO freaking bridges… Actually validate what your modem is using for its mask on this 10 address. And then create your interface using that.. And don't use an overlapping network on your lan side, etc.

Excuse me, but how do I solve my problem?

Thanks

Bye

johnpoz

My gawd dude… I just told you!!

Lets start with basic info number 1... Ok your modem is using a 10.address - what is the mask on that? I find it like impossible to believe it would be /8 so what it /24?

So if its 10.0.0.1/24 then make your interface 10.0.0.2/24

On the lan side of your network - do not use ANY networks that are 10.0.0.0/24 or that would overlap it like 10.0.0.0/8 or /16 or /23 etc.. -- say away from all 10 networks would be my suggestion.

Then create your outbound so when you want to talk to 10.0.0/24 you nat to your 10.0.0.2 address. Using hybrid mode put that outbound nat above your automatic nats.

And don't create any freaking bridges!!! You have ZERO use for them!!

balubeto

@johnpoz:

My gawd dude… I just told you!!

Lets start with basic info number 1... Ok your modem is using a 10.address - what is the mask on that? I find it like impossible to believe it would be /8 so what it /24?

So if its 10.0.0.1/24 then make your interface 10.0.0.2/24

On the lan side of your network - do not use ANY networks that are 10.0.0.0/24 or that would overlap it like 10.0.0.0/8 or /16 or /23 etc.. -- say away from all 10 networks would be my suggestion.

Then create your outbound so when you want to talk to 10.0.0/24 you nat to your 10.0.0.2 address. Using hybrid mode put that outbound nat above your automatic nats.

And don't create any freaking bridges!!! You have ZERO use for them!!

So, can you explain in detail what I have to do to try if your idea works?

Thanks

Bye

johnpoz

How is that not enough detail for you.. .Really?? Do you want me to remote to your system and do it for you?

balubeto

@johnpoz:

How is that not enough detail for you.. .Really?? Do you want me to remote to your system and do it for you?

What are the images that you need to be able to solve my problem?

Thanks

Bye

johnpoz

I already solved your problem multiple times and told you exactly what do for gosh sake…

The info you need is in the access my modem article..
https://doc.pfsense.org/index.php/Accessing_modem_from_inside_firewall

Here are some pictures.. Now I have to use a vip to do this since I am actually using my WAN with a public IP on it.. But you are using pppoe so you would do this via interface actually assigned to your WAN interface.

So my modem uses 192.168.100.1/24 -- I know its a /24 because when it doesn't have a isp connection it hands out IPs via dhcp in 192.168.100.0/24 And doesn't really matter if you have the mask exactly right as long as your not overlapping with your other networks, and your modem and IP on your wan are in the same network.. So use /24!!! is your best option if you do not know for sure what the mask is..

So I create VIP.. You would do it on your wan interface that your calling modem_access.. You then create an outbound nat that says hey when going to that network from your source use this interface address..

You can see me accessing my modem, you can see the states in the state table on pfsense.. What is it that your not understanding here??? Do you not understand how pfsense nats to yoru public network?? Its the SAME freaking thing.. But only to another rfc1918 network..

accessmodem.jpg_thumb

balubeto

@johnpoz:

I already solved your problem multiple times and told you exactly what do for gosh sake…

The info you need is in the access my modem article..
https://doc.pfsense.org/index.php/Accessing_modem_from_inside_firewall

Here are some pictures.. Now I have to use a vip to do this since I am actually using my WAN with a public IP on it.. But you are using pppoe so you would do this via interface actually assigned to your WAN interface.

So my modem uses 192.168.100.1/24 -- I know its a /24 because when it doesn't have a isp connection it hands out IPs via dhcp in 192.168.100.0/24 And doesn't really matter if you have the mask exactly right as long as your not overlapping with your other networks, and your modem and IP on your wan are in the same network.. So use /24!!! is your best option if you do not know for sure what the mask is..

So I create VIP.. You would do it on your wan interface that your calling modem_access.. You then create an outbound nat that says hey when going to that network from your source use this interface address..

You can see me accessing my modem, you can see the states in the state table on pfsense.. What is it that your not understanding here??? Do you not understand how pfsense nats to yoru public network?? Its the SAME freaking thing.. But only to another rfc1918 network..

Which devices are the 192.168.100.2 and 192.168.9.x IPs displayed in your image?

Thanks

Bye

johnpoz

That is my freaking VIP… Its right there in the freaking pictures!! What do you not get?? Nobody can be this freaking dense.. Your just freaking trolling now...

balubeto

router=10.0.0.1/24
Firewall=192.168.1.1

I still can not access the router. Why?

ptt

Because "you're doing it wrong" ! ;)

As pointed/noted before, since you are using PPPoE on WAN, the VIP is NOT needed/necessary….

https://forum.pfsense.org/index.php?topic=118740.msg658480#msg658480

https://forum.pfsense.org/index.php?topic=118740.msg658918#msg658918

johnpoz

Dude I think he is just trolling nobody can be this freaking dense… Its just not possible.. It's been stated over and over again.. I think his just thinks its funny to see how long we will continue to try and help him..

balubeto

The ptt's solution works in part because I can access the router but, when I disconnect and connect the PPPoE service through the Status –-> Interfaces window, the Internet does no more work:

While the johnpoz's solution (logically disabling the Modem_access interface) does not work because I can not access my router:

In addition, some of you wanted to know the interfaces and the bridges that I have:

So, how do I solve my problem?

Thanks

Bye

johnpoz

ARrrgghhh I am done with this thread - you clearly are freaking trolling.. Who told you to turn off your PPPoe? Connection.. And why and the F are you bridging all your interfaces… Told you not to do that!!! WTF dude???

Nobody can be this freaking DENSE.. .Clearly your just trolling hope you having fun... Im out..

Even if you wanted to bridge some interfaces... Nobody can be this freaking stupid... Really!!!

How would this freaking work dude?? Come on!!! If you just don't have clue one on what a mask is or what IPs are then say so.. Once again you have 10/8 as a dest and on your lan side?? And you put a 192.168.1. on your modem_access (wan)?? What???

thisstupid.jpg_thumb

balubeto

@johnpoz:

ARrrgghhh I am done with this thread - you clearly are freaking trolling.. Who told you to turn off your PPPoe? Connection.. And why and the F are you bridging all your interfaces… Told you not to do that!!! WTF dude???

Nobody can be this freaking DENSE.. .Clearly your just trolling hope you having fun... Im out..

Even if you wanted to bridge some interfaces... Nobody can be this freaking stupid... Really!!!

How would this freaking work dude?? Come on!!! If you just don't have clue one on what a mask is or what IPs are then say so.. Once again you have 10/8 as a dest and on your lan side?? And you put a 192.168.1. on your modem_access (wan)?? What???

In your image, how come your pfSense has created the two automatic rules where the 10.0.0.0/8 address also appears in the Source? To me this address does not appear.

Why?

Thanks

Bye

balubeto

I'm still waiting for a solution to this old problem.

Thanks

Bye

Derelict

Might be time to try posting to the forum for your native language.

balubeto

I can not understand why to johnpoz, the automatic rules are:

whereas to me, they are:

Where am I wrong?

Thanks

Bye

johnpoz

Dude that is what you posted.. That you had 10/8 on you automatic rules

What can you not understand??? WTF really?? You posted this a while back..

So did you fix that now from your current post.. We have went over this and over this and over this..

Its not freaking rocket science… If its not working then you have the IPs wrong, or mask wrong or whatever.. Lets go over this basic concept yet again!!!

Device you want to get to is 10.0.0.1/??? What is the mask on this?? Your using 8, ok that should work even if the other guy had different if your using 10.0.0.2... But from your one posting your listing your 10.0.0.1 address so I can not make out WTF your doing!!!! See pic attached where you post up with address of 10.0.0.1 on pfsense..

Right from the help doc

https://doc.pfsense.org/index.php/Accessing_modem_from_inside_firewall
Configure a new Interface

A PPPoE WAN is actually assigned to a virtual PPPoE adapter, not the physical port.

Under Interfaces > (assign), create a new OPT interface, and assign it to the physical network card that is on WAN. For example, if the WAN on the assignment page is "PPPOE0(re2)", choose re2, and Save the changes.

Go to Interfaces > (new OPT interface), and Enable the interface. Give it an IP address in the same subnet as the modem, such as 192.168.1.5/24. Do not set a gateway. Rename the interface to ModemAccess or a similar useful name.

So you have PPPoE interface right?????? And its on what physical interface on your pfsense box Re2, em0, eth1, what??? Post up a screen shot of your interfaces!!

If your using PPPoE then you DO NOT USE A VIP!!! you make sure you have an interface assigned to your physical wan interface.. Re2 if that is your wan.. You then give it an IP and mask in the network your modem devices is on.. if your modem is 10.0.0.1, you really should know what the mask is? But if you want to use /8 ok on this opt interface you created that is using re2 if you do not have a WAN interface already assigned to this?? POST UP YOUR INTERFACES!!!

How are you even sure this modem interface is 10.0.0.1??? What if you just turn the physical interface that is connected to this modem to dhcp.. Does the physical interface get an IP??

whatisyourvip.png_thumb