Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Access Back-haul Radios

    Scheduled Pinned Locked Moved NAT
    37 Posts 4 Posters 25.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator
      last edited by

      you would do a sniff right on pfsense diag, packet capture.

      Dude I though your radio was .41, why are you just pinging your wan address VIP that you created? .40

      If you have this

      modem –- p2p (192.168.1.X) ----- wireless ----- ptp (192.168.1.Y) ---- (192.168.1.Z) pfsense (192.168.0.1) -- lan (192.168.0.2) PC

      Your VIP would be the 192.168.1.Z address, and you would try and ping .x or .y from pfsense.

      You would look in your arp table for the .x and .y address - not your Z address..

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      1 Reply Last reply Reply Quote 0
      • H
        hotshottech
        last edited by

        I can ping the radio from the Pfsense ping Gui and I can do a trace route to all the radios from pfsense but I can't ping from my PC. All the radios are listed in the ARP Table.

        My VIP is 192.168.1.21/24

        I think the problem is in my firewal/nat/outbound rule…see attached.

        post4.png
        post4.png_thumb

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by

          That looks fine.. My guess since you have multiple wans, that your lan rules are doing policy routing and shoving you out a gateway other than where your trying to get to.

          Post up your lan rules.

          There has to be a rule that allows your traffic to use your normal routing before you get sent down some gateway

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • H
            hotshottech
            last edited by

            See attached….My Computers alias is the PC that I am using to try to access the Radios.

            post5.png
            post5.png_thumb

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by

              So dude that rule my computers is forcing traffic out your wan gateway.. That is your public connection, so no it would not be able to use your vip..

              You need a rule above that for my computers that allows it to go to your 192.168 network your PtP stuff.  That rules says hey anything in my computer no matter where its going shove it down the wan2axiaGW..

              Rules are top down, first rule to fire wins, no other rules are evaluated..

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                Sounds like a perfect use case for a management VLAN for those radios. That's what I would probably do (if they support it.)

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • H
                  hotshottech
                  last edited by

                  They do support clan, I am using ubiquiti power beam m5.

                  Could you outline on how to setup a vlan in pfsense to the radios?

                  Thanks

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    Depends on what they support. Is the normal traffic tagged or untagged. Is that management VLAN tagged or untagged? What is a clan?

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      I think he meant vlan ;) not sure he would be talking about a collapsed lan ;)

                      So did you get it working once you fixed your rules?

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • H
                        hotshottech
                        last edited by

                        I need to set a gateway out to the 192.168.1.x/24 but not sure how to get that done…

                        Please explain...thanks

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          Why do you need a gateway?  Once you create a vip in the network the p2p address are on, and you nat to that vip.

                          You said you can ping the p2p IPs from pfsense.  So your vip is working, you create the nat so when your clients go there pfsense nats it to its vip.  Your p2p clients think your talking to them from an IP on their network.

                          Problem I saw as that your lan rules were not going to allow your clients to use the vip, since forcing it down the the gateway.  Just put a rule above that that allows access to that p2p network.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • H
                            hotshottech
                            last edited by

                            Not sure if this is correct. I tried this and it doesn't work…. see attached

                            post6.png
                            post6.png_thumb

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by

                              and is that rule at the top?

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • H
                                hotshottech
                                last edited by

                                Yes see attached….

                                post7.png
                                post7.png_thumb

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by

                                  Why is the gear showing on that rule?  That means you messed with the advanced setion of the rules.  So see hits to it..  So sniff on your wan when you try and connect do you see your traffic going out?

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  1 Reply Last reply Reply Quote 0
                                  • DerelictD
                                    Derelict LAYER 8 Netgate
                                    last edited by

                                    Yeah. Mouse over that gear on the bypass policy routing rule. Why is that there?

                                    What are your current outbound NAT rules?

                                    Chattanooga, Tennessee, USA
                                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                    1 Reply Last reply Reply Quote 0
                                    • H
                                      hotshottech
                                      last edited by

                                      The gear was there because I had a In and Out Limit…I have removed that...see attached

                                      Post1.png
                                      Post1.png_thumb

                                      1 Reply Last reply Reply Quote 0
                                      • H
                                        hotshottech
                                        last edited by

                                        I got it going…..here are the rules that got me there.

                                        Thanks guys for all the help....see attached

                                        Post2.png
                                        Post2.png_thumb
                                        post3.png
                                        post3.png_thumb

                                        O 1 Reply Last reply Reply Quote 0
                                        • H
                                          hotshottech
                                          last edited by

                                          And I also had to add a VIP on the 192.168.1.x/24 network.

                                          Hope this helps somebody else.

                                          1 Reply Last reply Reply Quote 0
                                          • DerelictD
                                            Derelict LAYER 8 Netgate
                                            last edited by

                                            Yeah. johnpoz said that in #3.

                                            Chattanooga, Tennessee, USA
                                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.