Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PFSENSE with 1 wan and multiple LAN

    Scheduled Pinned Locked Moved General pfSense Questions
    18 Posts 4 Posters 18.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • G
      gjaltemba
      last edited by

      Cable lan port on access point to the unused port on quad nic.

      Try creating a new interface and assign an unused port for your access point. Configure the new interface opt1  for 192.168.2.0/24 subnet. Enable dhcp server on opt1 if needed. Add allow firewall rule in opt1 to access wan. Test.

      1 Reply Last reply Reply Quote 0
      • H
        haris013
        last edited by

        well i tried the following:

        Created new interface OPT1

        set interface ipv4 192.168.2.1/24
        setup dhcp for OPT1

        add firewall rule allow ipv4 * opt1 net  wan net

        My client gets an ip automatically 192.168.2.25, gateway 192.168.2.1, dns 192.168.2.1

        I don't have internet access, also i cant ping from client to 192.168.2.1.

        The client is connected via powerline.

        any ideas?

        1 Reply Last reply Reply Quote 0
        • NogBadTheBadN
          NogBadTheBad
          last edited by

          @haris013:

          add firewall rule allow ipv4 * opt1 net  wan net

          wan net  is that the destination, it should be any.

          Above this rule you should also block opt1 net to the subnets that you want to be blocked, i.e. 192.168.1.0/24

          Andy

          1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

          1 Reply Last reply Reply Quote 0
          • H
            haris013
            last edited by

            after a little experiment i did the following at the attachment.

            I can ping 8.8.8.8 from a client connected to opt1 but it seems cant resolve addresses. ping google.com got as result unreachable host.

            Capture.PNG
            Capture.PNG_thumb

            1 Reply Last reply Reply Quote 0
            • NogBadTheBadN
              NogBadTheBad
              last edited by

              What is 192.168.1.21, is it your DNS server, if it is you'll never hit that firewall rule as the traffic is blocked by the first rule to 192.168.1.0/24.

              Firewall rules are read from the top down.

              https://doc.pfsense.org/index.php/Firewall_Rule_Basics

              Andy

              1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

              1 Reply Last reply Reply Quote 0
              • H
                haris013
                last edited by

                I changed the rules like above and everything works like a charm.

                Is that a recommended config or it works just from luck?

                Capture.PNG
                Capture.PNG_thumb

                1 Reply Last reply Reply Quote 0
                • NogBadTheBadN
                  NogBadTheBad
                  last edited by

                  Maybe you also want to allow NTP.

                  It's sort of how I do it, but I have an alias that contain the subnets I don't want to be accessed and use that in the block rule and have it log.

                  I also just use "This Firewall" rather than a specific interface and I also have a block any any at the bottom and have that set to log.

                  Andy

                  1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                  1 Reply Last reply Reply Quote 0
                  • H
                    haris013
                    last edited by

                    How i will allow the ntp?

                    can you help with the rule?

                    1 Reply Last reply Reply Quote 0
                    • NogBadTheBadN
                      NogBadTheBad
                      last edited by

                      @haris013:

                      How i will allow the ntp?

                      can you help with the rule?

                      Untitled.jpg
                      Untitled.jpg_thumb

                      Andy

                      1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                      1 Reply Last reply Reply Quote 0
                      • H
                        haris013
                        last edited by

                        i did this, is that correct?

                        Also something more tricky, at the same physical server where the pfsense VM runs i have a several more VMs that i would like to join them at my network (LAN or OPT1 depending on the VM)

                        How i can do that?

                        thanks again for the help

                        Capture.PNG
                        Capture.PNG_thumb

                        1 Reply Last reply Reply Quote 0
                        • NogBadTheBadN
                          NogBadTheBad
                          last edited by

                          @haris013:

                          i did this, is that correct?

                          Also something more tricky, at the same physical server where the pfsense VM runs i have a several more VMs that i would like to join them at my network (LAN or OPT1 depending on the VM)

                          How i can do that?

                          thanks again for the help

                          The destination is any which will work.

                          I run NTP on my router and allow NTP only to This Firewall.

                          Re "Also something more tricky, at the same physical server where the pfsense VM runs i have a several more VMs that i would like to join them at my network (LAN or OPT1 depending on the VM)" not got a clue sorry I don't run proxmox.

                          Untitled.jpg
                          Untitled.jpg_thumb

                          Andy

                          1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                          1 Reply Last reply Reply Quote 0
                          • H
                            haris013
                            last edited by

                            ok and a final question. I would like to access the lan network when i am not at home.(office or vacations)

                            How i will achive that? i guess with VPN, can you give me some resources to read how to do that?

                            also can i allow a specific device from OPT1 to have full access at LAN and pfsense? I have an ipad connected via wifi from opt1 and i would like to manage some of my servers that are currently at lan.

                            The ipad gets an address frop OPT1 dhcp, can i create a MAC address rule to access LAN only from my ipad regardless the ip it has?

                            1 Reply Last reply Reply Quote 0
                            • NogBadTheBadN
                              NogBadTheBad
                              last edited by

                              https://doc.pfsense.org/index.php/IKEv2_with_EAP-MSCHAPv2

                              "also can i allow a specific device from OPT1 to have full access at LAN and pfsense? I have an ipad connected via wifi from opt1 and i would like to manage some of my servers that are currently at lan.

                              The ipad gets an address frop OPT1 dhcp, can i create a MAC address rule to access LAN only from my ipad regardless the ip it has?"

                              You'll need to do a mac address reservation in the dhcp settings for the iPad and allow that IP address, you can't do firewall rules with mac addresses.

                              Andy

                              1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                              1 Reply Last reply Reply Quote 0
                              • H
                                haris013
                                last edited by

                                Thank you very much for the info!

                                I forgot to mention that my isp does not provide me a static ip, if I use a ddns service will I be able to do a vpn? At the certificate creation can I use the ddns domain instead of an ip?

                                Do I have to consider something else with a ddns configuration?

                                Thanks again!

                                1 Reply Last reply Reply Quote 0
                                • DerelictD
                                  Derelict LAYER 8 Netgate
                                  last edited by

                                  Yes. Use the exact hostname the remote users will be connecting to as the CN and an FQDN or Hostname SAN in the certificate you create for the VPN Server.

                                  Set My Identifier in the VPN Phase 1 to Distinguished name and use the exact hostname there too.

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • H
                                    haris013
                                    last edited by

                                    Thank you very much sir!

                                    I have a few connectivity issues with the internet. a couple times everyday for several minutes i don't have internet access. I don't know if it is a down dsl service, a rule or something else, i just don't have internet at my devices for a few minutes. How i can troubleshoot this problem? where do i search in order to figure out whats happening?

                                    Thanks in advance again!

                                    1 Reply Last reply Reply Quote 0
                                    • DerelictD
                                      Derelict LAYER 8 Netgate
                                      last edited by

                                      https://doc.pfsense.org/index.php/Connectivity_Troubleshooting

                                      Chattanooga, Tennessee, USA
                                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                      1 Reply Last reply Reply Quote 0
                                      • First post
                                        Last post
                                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.