Unable to access a host on another subnet but can from pfSense [SOLVED]
-
I have pretty much a standard vanilla home setup WAN/ LAN1 /LAN2 which works, as I can access the internet from each LAN subset.
However I cannot access my host on LAN2 from LAN1.192.168.0.3 –> 192.168.1.2:80 ===> , however I can ping it from pfSense 192.168.1.2 OK
Setup:
LAN1: 192.168.0.0/29 - Rule: Protocol: IPv4+6/Source: LAN1 */Port: * / Dest: */Port: * / Gateway: * /Queue: none
LAN2: 192.168.1.0/28 - Rule: Protocol: IPv4+6/Source: */Port: * / Dest: */Port: * / Gateway: * /Queue: noneI am new to this so am obviously missing something basic. :-[.
Any help would be much appreciated, thank you.
-
Probably a firewall local to 192.168.1.2 (think along the lines of windows firewall) blocking access from other than it's local subnet.
-
Interesting thought …
This host is actually a simple Access point router which provides WAN access via its WiFi to my tablet, phone etc and it works OK. Also I can obviously access it's port 80 from LAN2. Firewall and NAT are switched off.
The problem is that I cannot see the connection coming trough in Status> System> Logs> Firewall> Normal View.
Am I looking in the wrong place?
-
That will normally only show blocks. If you want to examine active connections you probably want Diagnostics > States.
Or to troubleshoot state establishment, Diagnostics > Packet Capture.
It could also be that the "AP" does not, itself, have a default gateway set.
-
Those can have a setting called "AP Isolation" or something basically acts like a firewall. Find it if its there and turn it off.
-
@Derelict
Thank you - What I found in there is this:192.168.1.2:64267 (192.168.0.3:64267) -> 192.168.1.2:80 SYN_SENT:CLOSED 3 / 0 152 B / 0 B
I am still searching now to see what this means.
@kejianshi
I have specifically switched of the Firewall and NAT and the gateway inside the AP is set to 192.168.1.2. -
What kind of AP are you using?
-
It's BrightBox2.
Fortunately, this router has a specific option to switch off NAT & Firewall. (which may not work :-)
I also switched off its DHCP, as I am using the one in pfSence for the LAN 2 interface.The option to set the AP gateway is in its DHCP section, as I think on most routers.
-
A very good spot both thank you!!
I added another Web sever, this time a PC, and the request went trough with no issues from LAN1 to LAN2.
So the AP is somehow being "clever", despite its firewall being "switched-off".So, is there a way for me to access my AP, as there is no other setting I see which can solve this.
E.g. rewrite the source IP or some other special pfSence function? -
I've never been able to get around one that was doing that.
-
OK, cheers and thank you for your help.
-
Yes. Outbound NAT on the pfSense interface that the AP is connected to.
Connections to the AP will appear to the AP as coming from the pfSense interface not the remote subnet.
I'd prefer to just use a "real" AP but that's probably just me.
-
I've had hit and miss results with DD-WRT in exactly this same situation.
My last version blocked everything but my current version works fine. As you said, a real AP designed to be just an AP would be be$t.
-
Yes. Outbound NAT on the pfSense interface that the AP is connected to.
Connections to the AP will appear to the AP as coming from the pfSense interface not the remote subnet.
I'd prefer to just use a "real" AP but that's probably just me.
I just noticed your response Derelict. Great!!!
I tried it and of course it did not work :-[, so I just need a bit of help with setting up the NAT OUTBOUND to achieve => [i]"AP will appear to the AP as coming from the pfSense interface not the remote subnet"
Issue: I am trying to access AP on 192.168.1.2:80 from 192.168.0.3.
Setup:
-
Outbound NAT -> Hybrid
-
Outbound NAT Interface: LAN2
-
Outbound NAT Source: Network: 192.168.0.3/24 Port:80
-
Outbound NAT Destination: Network: 192.168.1.2/31 Port:80
-
Translation\Other subnet: 192.168.1.2/31
-
-
Don't set a source port.
-
No joy, I am uploading details in case:
-
Look at your source network. You need slimmer fingers.
And the NAT address should be the LAN2 interface address, not some /28 ffs.
How many APs are you trying to do this for? If one use a /32 destination address and LAN2 address as the NAT address.
That /29 source will only NAT if you are connecting from those specific hosts. Why are you using all these wacky netmasks?
-
It worked!!! Thank you very much!
As a note, I also had to make the port static for this to work.
The key point I was missing is that the "Translation\Other subnet" has to be the address of the destination interface.The weird subnets was just desperation, to make things work. ;D
-
"I also had to make the port static for this to work."
No you didn't.. Why would where your forwarding 80 care that the source port of the traffic was the same as what the client used vs letting pfsense do Napt..
-
Static port has nothing to do with it. That will possibly create problems for you down the road but leave it if you so desire.
Your NAT port should be 80, not any.
Glad it's working for you.
