Access Back-haul Radios
-
Huh?? Where did you read that you need to create a new interface?
You could create a vlan on one of those interfaces..
But you don't need to do that, you should only have to create a VIP on the interface that is connected to your p2p setup..
-
I have done everything you have suggested and the only link I think I am missing is that my wan interface that I need to get to the radios to is on the 45.x.x.x gateway that is static from the ISP modem. If I change the radios to the 45.x.x.x address range I can access them from the public side but I don't want to do that for security reasons.
Any advice would be appreciated.
Thanks for the feedback so far.
-
So when you created your vip you put the correct mask on it, not the /32 you had..
-
Yes that was a mistake on my side…I have changed that but I still can't access the radios.
-
Well lets do some simple troubleshooting.. So sniff on pfsense wan interface.. Do you see it sending the traffic? Can pfsense once you create the vip ping these IPs? What is in the arp table.. If it can not find the mac of these devices then no its not going to be able to talk to them..
-
See attached troubleshooting screen shots…...in trace route had to check Use ICMP to get a successful trace. Not sure how to do a sniff....my box is at a different location and scared it stinks there...lol
 -
Does anybody have any Ideas what could be the problem? This seems so simple that I am scratching my head…I have 2 more WAN connection where I have no problem connection to the modems from the LAN!!!!!!!!!!...........
-
you would do a sniff right on pfsense diag, packet capture.
Dude I though your radio was .41, why are you just pinging your wan address VIP that you created? .40
If you have this
modem –- p2p (192.168.1.X) ----- wireless ----- ptp (192.168.1.Y) ---- (192.168.1.Z) pfsense (192.168.0.1) -- lan (192.168.0.2) PC
Your VIP would be the 192.168.1.Z address, and you would try and ping .x or .y from pfsense.
You would look in your arp table for the .x and .y address - not your Z address..
-
I can ping the radio from the Pfsense ping Gui and I can do a trace route to all the radios from pfsense but I can't ping from my PC. All the radios are listed in the ARP Table.
My VIP is 192.168.1.21/24
I think the problem is in my firewal/nat/outbound rule…see attached.
-
That looks fine.. My guess since you have multiple wans, that your lan rules are doing policy routing and shoving you out a gateway other than where your trying to get to.
Post up your lan rules.
There has to be a rule that allows your traffic to use your normal routing before you get sent down some gateway
-
See attached….My Computers alias is the PC that I am using to try to access the Radios.
-
So dude that rule my computers is forcing traffic out your wan gateway.. That is your public connection, so no it would not be able to use your vip..
You need a rule above that for my computers that allows it to go to your 192.168 network your PtP stuff. That rules says hey anything in my computer no matter where its going shove it down the wan2axiaGW..
Rules are top down, first rule to fire wins, no other rules are evaluated..
-
Sounds like a perfect use case for a management VLAN for those radios. That's what I would probably do (if they support it.)
-
They do support clan, I am using ubiquiti power beam m5.
Could you outline on how to setup a vlan in pfsense to the radios?
Thanks
-
Depends on what they support. Is the normal traffic tagged or untagged. Is that management VLAN tagged or untagged? What is a clan?
-
I think he meant vlan ;) not sure he would be talking about a collapsed lan ;)
So did you get it working once you fixed your rules?
-
I need to set a gateway out to the 192.168.1.x/24 but not sure how to get that done…
Please explain...thanks
-
Why do you need a gateway? Once you create a vip in the network the p2p address are on, and you nat to that vip.
You said you can ping the p2p IPs from pfsense. So your vip is working, you create the nat so when your clients go there pfsense nats it to its vip. Your p2p clients think your talking to them from an IP on their network.
Problem I saw as that your lan rules were not going to allow your clients to use the vip, since forcing it down the the gateway. Just put a rule above that that allows access to that p2p network.
-
Not sure if this is correct. I tried this and it doesn't work…. see attached
-
and is that rule at the top?
