Access Back-haul Radios
-
That is the problem…the wan gateway is on a static ip address from the ISP provide.
So I will need to create a outbound nat from the lan 172.25.8.0/24 to back haul radio network 192.168.1.0/24. Could you outline what nat to use.
Thanks
-
So your wan is on some public IP.. How is your P2P network connected to this same interface that pfsense has internet access on?
Could you draw how this is connected together.. Wouldn't it be better to connect some other network via a different interface on pfsense - or is that how you do have it already? That is why a drawing is very helpful.
But if you created a vip on your wan interface, and that interface is connected to this 192.168.1.0/24 network.. you would do like I have attached below. But you would use your vip you created in your 192.168.1 network vs mine that is the 192.168.100 network that my modem webgui is on.
So you create your vip as ip alias.
Then create an outbound nat using your wan interface, and setup the source network your going to nat.. This would be your lan 172 network. Then when should you nat to this IP, your dest would be the 192.168.1 network.
Then the translation address click the drop down and pick your VIP you created.. There you go. In your outbound nat pick hybrid so it uses your manual outbound nats and your automatic nats.. 2nd pic below.
-
Not sure what I am doing wrong but I can't seem to gain access to radio gui…see attached screen shots on setup.
-
Well you put a mask of /32 on that vip.. That wrong..
So what IP does your pfsense wan have/get? Can pfsense ping these 192.168.1 IPs after you create your vip? It should be able to ping them, if not then no your clients will not be able too.
But the mask of your vip should mask should match up with the mask of the network these 192.168.1 network is on..
-
Hi All.
I have read some of the thread to create a new interface on the Wan port that I need to access the radios or modem. My question is how do I create that interface? On PPTs, GGEs, GIFs, Bridges or LAGGs! See attached picture.
-
Huh?? Where did you read that you need to create a new interface?
You could create a vlan on one of those interfaces..
But you don't need to do that, you should only have to create a VIP on the interface that is connected to your p2p setup..
-
I have done everything you have suggested and the only link I think I am missing is that my wan interface that I need to get to the radios to is on the 45.x.x.x gateway that is static from the ISP modem. If I change the radios to the 45.x.x.x address range I can access them from the public side but I don't want to do that for security reasons.
Any advice would be appreciated.
Thanks for the feedback so far.
-
So when you created your vip you put the correct mask on it, not the /32 you had..
-
Yes that was a mistake on my side…I have changed that but I still can't access the radios.
-
Well lets do some simple troubleshooting.. So sniff on pfsense wan interface.. Do you see it sending the traffic? Can pfsense once you create the vip ping these IPs? What is in the arp table.. If it can not find the mac of these devices then no its not going to be able to talk to them..
-
See attached troubleshooting screen shots…...in trace route had to check Use ICMP to get a successful trace. Not sure how to do a sniff....my box is at a different location and scared it stinks there...lol
 -
Does anybody have any Ideas what could be the problem? This seems so simple that I am scratching my head…I have 2 more WAN connection where I have no problem connection to the modems from the LAN!!!!!!!!!!...........
-
you would do a sniff right on pfsense diag, packet capture.
Dude I though your radio was .41, why are you just pinging your wan address VIP that you created? .40
If you have this
modem –- p2p (192.168.1.X) ----- wireless ----- ptp (192.168.1.Y) ---- (192.168.1.Z) pfsense (192.168.0.1) -- lan (192.168.0.2) PC
Your VIP would be the 192.168.1.Z address, and you would try and ping .x or .y from pfsense.
You would look in your arp table for the .x and .y address - not your Z address..
-
I can ping the radio from the Pfsense ping Gui and I can do a trace route to all the radios from pfsense but I can't ping from my PC. All the radios are listed in the ARP Table.
My VIP is 192.168.1.21/24
I think the problem is in my firewal/nat/outbound rule…see attached.
-
That looks fine.. My guess since you have multiple wans, that your lan rules are doing policy routing and shoving you out a gateway other than where your trying to get to.
Post up your lan rules.
There has to be a rule that allows your traffic to use your normal routing before you get sent down some gateway
-
See attached….My Computers alias is the PC that I am using to try to access the Radios.
-
So dude that rule my computers is forcing traffic out your wan gateway.. That is your public connection, so no it would not be able to use your vip..
You need a rule above that for my computers that allows it to go to your 192.168 network your PtP stuff. That rules says hey anything in my computer no matter where its going shove it down the wan2axiaGW..
Rules are top down, first rule to fire wins, no other rules are evaluated..
-
Sounds like a perfect use case for a management VLAN for those radios. That's what I would probably do (if they support it.)
-
They do support clan, I am using ubiquiti power beam m5.
Could you outline on how to setup a vlan in pfsense to the radios?
Thanks
-
Depends on what they support. Is the normal traffic tagged or untagged. Is that management VLAN tagged or untagged? What is a clan?
