Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Pfsense with 2 modems as multiwan : cannot access webGUI of the secondary modem

    Routing and Multi WAN
    6
    29
    4.5k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DerelictD
      Derelict LAYER 8 Netgate
      last edited by

      Yeah, you're right. I was confused. Your NAT rules look fine.

      So what you want to do is start a packet capture on WAN_CELL for all traffic for host 192.168.5.1 then try to connect to the modem then stop the capture.

      It would probably be best if you attached the capture since MAC addresses might be important. Or at least set the detail to Full, View Capture again and post that.

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      1 Reply Last reply Reply Quote 0
      • T
        t__2
        last edited by

        Is this the settings you want me to try for packet capture?

        How long do I run the capture? Until the browser times out?

        pfsense_packets.png
        pfsense_packets.png_thumb

        1 Reply Last reply Reply Quote 0
        • T
          t__2
          last edited by

          Here is the capture with the settings I posted. Ran it until the browser timed out.

          pfSense_capture.txt

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            Your modem is not accepting the ARP Reply for whatever reason. You'll need to ask them. pfSense is doing everything it is supposed to there.

            11:31:58.374001 0a:40:06:d2:5d:5d > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.5.2 tell 192.168.5.1, length 46
            11:31:58.374014 00:08:a2:0b:8e:0e > 0a:40:06:d2:5d:5d, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Reply 192.168.5.2 is-at 00:08:a2:0b:8e:0e, length 28
            11:32:14.614066 0a:40:06:d2:5d:5d > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.5.2 tell 192.168.5.1, length 46
            11:32:14.614083 00:08:a2:0b:8e:0e > 0a:40:06:d2:5d:5d, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Reply 192.168.5.2 is-at 00:08:a2:0b:8e:0e, length 28

            and on and on.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • T
              t__2
              last edited by

              Thanks Derelict for your help on this.

              Tell me this, Why if I unplug the 4G modem from our pfSense box and plug it into a computer I can get the configuration web page at 192.168.5.1? No changes at all to the modem required to do this. Did not even power down or reset the modem. Does that mean my Linux computer talks to the modem differently then the pfSense box does?

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                No idea. Would need to see a PCAP from that computer port in that situation to see what is different.

                Does that mean my Linux computer talks to the modem differently then the pfSense box does?

                ARP is ARP.

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • T
                  t__2
                  last edited by

                  OK I did a tcpdump with the Linux machine connected directly to the 4G modem. Started it then went to 192.186.5.1 and stopped it as soon as the log in page for the modem came up. Not sure I was doing it correctly but here it is.

                  pfSense_tcpdump.txt

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    Yeah that doesn't even try to ARP - it seems to have already accepted that MAC address into it's ARP table based on received traffic (as it should).

                    You are going to have to ask the modem manufacturer/provider why it refuses to acknowledge the ARP Reply the WAN port is sending.

                    Sorry. It's really as simple as that. pfSense is doing nothing wrong.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • T
                      t__2
                      last edited by

                      I have some questions.

                      What does not even try ARP? The modem or my Linux computer tied to the modem?

                      What has already accepted what MAC address into it's ARP table?

                      I am just wondering if either in the modem or pfSense can we put th MAC manually to get this to work.

                      Sorry if these are dumb questions but I am new to all this.

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        Christ, man.

                        The modem doesn't try ARP because it has accepted the MAC address for that computer based on other traffic.

                        Or at least the ARP was not included in your capture.

                        You MIGHT be able to make it work by spoofing the MAC address on the WAN but I would CALL THE ISP AND MAKE THEM FIX IT PROPERLY.

                        Why are people so reluctant to call the people they are actually PAYING?!?

                        (Please tell me you have rebooted the modem.)

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • T
                          t__2
                          last edited by

                          Derelict, While I am flattered that you refer to me a famous historical figure I can claim no such celebrity.

                          Anyway so you answered my questions. It is the 4G modem that would have to have the computers MAC preapproved so to speak so it would work. Unfortunately the modem interface has no way to manually set that. As you said I may be able to have pfSense spoof the computers MAC address but either way would limit what computer on my LAN I could access the web page from.

                          Sorry to frustrate you on this but the ISP (Ting) is no help on this as they did not supply the modem. It's not their recommended device. On top of that Netgear has about the worst support policies on the planet. They often take several months just to start looking at a support ticket.

                          Anyway thanks again for all the help.

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            So you're rolling your own and this is what you get.

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • B
                              bavcon22 @trap16
                              last edited by

                              @trap16 it worked for me.

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.