Unable to access a host on another subnet but can from pfSense [SOLVED]
-
Interesting thought …
This host is actually a simple Access point router which provides WAN access via its WiFi to my tablet, phone etc and it works OK. Also I can obviously access it's port 80 from LAN2. Firewall and NAT are switched off.
The problem is that I cannot see the connection coming trough in Status> System> Logs> Firewall> Normal View.
Am I looking in the wrong place?
-
That will normally only show blocks. If you want to examine active connections you probably want Diagnostics > States.
Or to troubleshoot state establishment, Diagnostics > Packet Capture.
It could also be that the "AP" does not, itself, have a default gateway set.
-
Those can have a setting called "AP Isolation" or something basically acts like a firewall. Find it if its there and turn it off.
-
@Derelict
Thank you - What I found in there is this:192.168.1.2:64267 (192.168.0.3:64267) -> 192.168.1.2:80 SYN_SENT:CLOSED 3 / 0 152 B / 0 B
I am still searching now to see what this means.
@kejianshi
I have specifically switched of the Firewall and NAT and the gateway inside the AP is set to 192.168.1.2. -
What kind of AP are you using?
-
It's BrightBox2.
Fortunately, this router has a specific option to switch off NAT & Firewall. (which may not work :-)
I also switched off its DHCP, as I am using the one in pfSence for the LAN 2 interface.The option to set the AP gateway is in its DHCP section, as I think on most routers.
-
A very good spot both thank you!!
I added another Web sever, this time a PC, and the request went trough with no issues from LAN1 to LAN2.
So the AP is somehow being "clever", despite its firewall being "switched-off".So, is there a way for me to access my AP, as there is no other setting I see which can solve this.
E.g. rewrite the source IP or some other special pfSence function? -
I've never been able to get around one that was doing that.
-
OK, cheers and thank you for your help.
-
Yes. Outbound NAT on the pfSense interface that the AP is connected to.
Connections to the AP will appear to the AP as coming from the pfSense interface not the remote subnet.
I'd prefer to just use a "real" AP but that's probably just me.
-
I've had hit and miss results with DD-WRT in exactly this same situation.
My last version blocked everything but my current version works fine. As you said, a real AP designed to be just an AP would be be$t.
-
Yes. Outbound NAT on the pfSense interface that the AP is connected to.
Connections to the AP will appear to the AP as coming from the pfSense interface not the remote subnet.
I'd prefer to just use a "real" AP but that's probably just me.
I just noticed your response Derelict. Great!!!
I tried it and of course it did not work :-[, so I just need a bit of help with setting up the NAT OUTBOUND to achieve => [i]"AP will appear to the AP as coming from the pfSense interface not the remote subnet"
Issue: I am trying to access AP on 192.168.1.2:80 from 192.168.0.3.
Setup:
-
Outbound NAT -> Hybrid
-
Outbound NAT Interface: LAN2
-
Outbound NAT Source: Network: 192.168.0.3/24 Port:80
-
Outbound NAT Destination: Network: 192.168.1.2/31 Port:80
-
Translation\Other subnet: 192.168.1.2/31
-
-
Don't set a source port.
-
No joy, I am uploading details in case:
-
Look at your source network. You need slimmer fingers.
And the NAT address should be the LAN2 interface address, not some /28 ffs.
How many APs are you trying to do this for? If one use a /32 destination address and LAN2 address as the NAT address.
That /29 source will only NAT if you are connecting from those specific hosts. Why are you using all these wacky netmasks?
-
It worked!!! Thank you very much!
As a note, I also had to make the port static for this to work.
The key point I was missing is that the "Translation\Other subnet" has to be the address of the destination interface.The weird subnets was just desperation, to make things work. ;D
-
"I also had to make the port static for this to work."
No you didn't.. Why would where your forwarding 80 care that the source port of the traffic was the same as what the client used vs letting pfsense do Napt..
-
Static port has nothing to do with it. That will possibly create problems for you down the road but leave it if you so desire.
Your NAT port should be 80, not any.
Glad it's working for you.
-
Static port has nothing to do with it. That will possibly create problems for you down the road but leave it if you so desire.
Your NAT port should be 80, not any.
Hmmmm, :-, If I tick "Static", pfSence sets the NAT port to Any. However if I set NAT port to 80, then I cannot connect to 192.168.1.2:80 from 192.168.0.3 - I tried again.
Obviously you both know what you are talking about, why would this be?
"No you didn't.. Why would where your forwarding 80 care that the source port of the traffic was the same as what the client used vs letting pfsense do Napt..
As above, also I am not clear what you are saying, can you rephrase?
-
When a browser, or any application for that matter connects to pretty much any other application.. It is really rare that the source port needs to be something specific.. Some cases sure.. But very far and between.. http or port 80 have never seen such a case where the source port would have to be something specific.
When you set a static port on an outbound port forward what your saying is that pfsense can not change what the source port to something else.. So if your connection was from ipA:portX to ipB:80, then pfsense can not change that to ipA:portY to ipB:80.. Which is how Napt works.
Your pfsense lan2 IP is in your 192.168.1.1 right? And your just trying to do a source nat to the web gui running on 80, because the device your connecting to on 80 does not have a gateway set..
Would look like below. I just used my lan to show this like I was coming from a different network the 192.168.0.3 in your example.. And 192.168.1.2 is say on my lan..
