Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Strange behavior with SG-1000

    Scheduled Pinned Locked Moved Hardware
    18 Posts 6 Posters 4.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • G
      gsiemon
      last edited by

      You have listed 5 devices but only four IPs. Its still not clear what IP address your SG1000 WAN and pfSense Router IPs are.  I'm assuming your PC and LAN are using the 40.x.x.x IPs. That's a bad idea:

      #
      # ARIN WHOIS data and services are subject to the Terms of Use
      # available at: https://www.arin.net/whois_tou.html
      #
      # If you see inaccuracies in the results, please report at
      # https://www.arin.net/public/whoisinaccuracy/index.xhtml
      #
      
      NetRange:       40.74.0.0 - 40.125.127.255
      CIDR:           40.112.0.0/13, 40.76.0.0/14, 40.124.0.0/16, 40.96.0.0/12, 40.125.0.0/17, 40.120.0.0/14, 40.74.0.0/15, 40.80.0.0/12
      NetName:        MSFT
      NetHandle:      NET-40-74-0-0-1
      Parent:         NET40 (NET-40-0-0-0-0)
      NetType:        Direct Assignment
      OriginAS:       
      Organization:   Microsoft Corporation (MSFT)
      RegDate:        2015-02-23
      Updated:        2015-05-27
      Ref:            https://whois.arin.net/rest/net/NET-40-74-0-0-1
      

      You need to move your lan subnet to a RFC1918 compliant address range it somewhere in one of the following ranges as these networks will never be found outside an internet connected firewall:

      10.0.0.0 - 10.255.255.255 (10/8 prefix)
      172.16.0.0 - 172.31.255.255 (172.16/12 prefix)
      192.168.0.0 - 192.168.255.255 (192.168/16 prefix)
      
      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        40.79.81.193/25>40.79.81.174/25>

        Can't have two different interfaces on the same subnet, which it looks like you are doing there.

        Reset to factory and connect the SG-1000 WAN into your existing LAN and a test device to SG-1000 LAN.

        The default config is DHCP WAN with a DHCP server on LAN on 192.168.1.0/24 and NAT for all LAN traffic out WAN.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • C
          chedxb
          last edited by

          this is the correct one

          PC (40.79.81.193/25) > SG-1000_LAN (40.79.81.174/25) > SG-1000_WAN (192.168.1.40/24) > pfSense Router (192.168.1.1/24) >Internet (XXXXXXX)

          There is OpenVPN client on the pfSense Router (192.168.1.1/24), but I think it is irrelevant.

          Interestingly I can ping 8.8.8.8 from the PC (40.79.81.193/25) and SG-1000 can access Package Manager and Update. However, I cannot access any web site from the PC (40.79.81.193/25)

          1 Reply Last reply Reply Quote 0
          • C
            chedxb
            last edited by

            I just noticed that Snort on pfSense Router (192.168.1.1/24) is blocking SG-1000_WAN (192.168.1.40/24)

            2017-01-05
            16:49:26
            1
            UDP
            A Network Trojan was Detected
            192.168.1.40

            123
            74.120.81.219

            123
            1:2404075

            ET CNC Shadowserver Reported CnC Server UDP group 38

            1 Reply Last reply Reply Quote 0
            • C
              chedxb
              last edited by

              still the same problem even I whitelisted on Snort.

              1 Reply Last reply Reply Quote 0
              • D
                doktornotor Banned
                last edited by

                Dude get Snort out of the way while you are unable to get absolute basics working!!! (I.e., turn it OFF!)

                1 Reply Last reply Reply Quote 0
                • C
                  chedxb
                  last edited by

                  absolute basics are working fine with OpenWrt, Lede, etc. when Snort is ON. What is SG-1000's exception here?

                  1 Reply Last reply Reply Quote 0
                  • D
                    doktornotor Banned
                    last edited by

                    Do as you wish. Noone wants to debug crap like Snort blocking your basic connectivity. Get basics working.

                    1 Reply Last reply Reply Quote 0
                    • KOMK
                      KOM
                      last edited by

                      If you can consistently ping sites but not go anywhere via browser then you may have a DNS problem, or an upstream access via 80/443 issue.

                      1 Reply Last reply Reply Quote 0
                      • C
                        chedxb
                        last edited by

                        Hi Kom, thx, could u elaborate upstream access via 80/443 issue?

                        1 Reply Last reply Reply Quote 0
                        • KOMK
                          KOM
                          last edited by

                          If your router is connected to another router/firewall, there may be restrictions on direct web access.  In other words, you may have to go through some other proxy that is upstream from you.  I'm just guessing since I know little about your network config, and I have no interest in trying to figure it out based on several confusing posts.

                          1 Reply Last reply Reply Quote 0
                          • M
                            moikerz
                            last edited by

                            @chedxb:

                            PC (40.79.81.193/25) > SG-1000_LAN (40.79.81.174/25) > SG-1000_WAN (192.168.1.40/24) > pfSense Router (192.168.1.1/24) >Internet (XXXXXXX)

                            So you have:

                            
                            Internet (xxxx)
                                 |
                            pfSense1 WAN (xxxx)
                            pfSense1 LAN (192.168.1.1, Snort)
                                 |
                            SG1000 WAN (192.168.1.40)
                            SG1000 LAN (40.79.81.174/25) << wtf
                                 |
                            device
                            
                            

                            Sort out your SG1000 first. For example, while you're testing, put the SG1000 LAN into 192.168.2.0/24, and verify you have the basics correct. I don't understand why you're trying to use a public IP range that you do not own on your SG1000 LAN; no wonder Snort is probably having problems. Turn off Snort, reconfigure your SG1000 LAN (and thus downstream Device) and start again.

                            1 Reply Last reply Reply Quote 0
                            • KOMK
                              KOM
                              last edited by

                              Yeah what's up with you running public IP space behind private IP space?  I've never seen that before for a normal ISP connection.

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.