Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Encrypted connection between Gateway and "double NAT" pfSense?

    Scheduled Pinned Locked Moved OpenVPN
    16 Posts 4 Posters 1.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • RicoR
      Rico LAYER 8 Rebel Alliance
      last edited by

      A proper setup with segmentation would look like this

            WAN / Internet
                  :
                  : DialUp-/PPPoE-/Cable-/whatever-Provider
                  :
            .-----+-----.
            |  Gateway  |  (or Router, CableModem, whatever)
            '-----+-----'
                  |
              WAN | IP or Protocol
                  |
            .-----+-----.    LAN2        .-------------.
            |  pfSense  +----------------+ LAN2-Switch |
            '-----+-----' 192.168.1.0/24 '-------------'
                  |
              LAN | 10.0.0.1/24
                  |
            .-----+------.
            | LAN-Switch |
            '------------'
      

      -Rico

      1 Reply Last reply Reply Quote 0
      • P
        petreza
        last edited by

        Thanks Rico, I knew this, but is does not help me. I do not want to really segment the network.

        From the point of view of the network I want pfSense to be just another computer attached to it.
        From the point of view of "IMPORTANT COMPUTER" I want pfSense to appear as a router connected to some "ISP" on the other side. This "ISP" should be my Router#1 (DD-WRT) and the traffic between pfSense and Router#1 should be somehow encrypted.
        Am I wrong in assuming that pfSense can accomplish that?

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by johnpoz

          huh?? So you want your connection between pfsense and your ddwrt router to be encrypted? For what Possible reason would that make sense??

          What exactly do you think that gets you?

          Rico gave you the correct way to setup a network where you want to isolate something from something else. Take your dd-wrt and use it as just an AP for your wireless

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • P
            petreza
            last edited by

            Please note that Router#2 (192.168.1.2) acts only as an extender - it is still setup on the same net - 192.168.1.x/24
            DHCP is turned off and there is nothing connected to its WAN port.

            1 Reply Last reply Reply Quote 0
            • P
              petreza
              last edited by

              johnpoz,

              If some other computer on the 192.168.1.x/24 net is compromised, I don't want it snooping on the traffic between pfSense and Router#1.
              Thanks!

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                Dude makes NO sense... Why would you need another router in the mix? WTF is a passive coaxial extender? You have a MOCA network?

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • P
                  petreza
                  last edited by

                  Yes, that what I meant - MOCA extenders between Router#1 and Router#2.
                  By passive I meant there is no configuration - just plug and play.

                  1 Reply Last reply Reply Quote 0
                  • P
                    petreza
                    last edited by

                    Think of it as how pfSense is used with VPN Providers - it cuts out the middleman (in this case the ISP) from seeing the traffic.
                    I want to cut out the rest of my network from seeing the traffic between "IMPORTANT COMPUTER" and the internet.

                    pfSense is pfSense
                    Router#1 is the VPN provider

                    I will try to muddle through this one, but some help would be appreciated.
                    Thanks!

                    JKnottJ 1 Reply Last reply Reply Quote 0
                    • RicoR
                      Rico LAYER 8 Rebel Alliance
                      last edited by

                      Some client connected to one of your switch ports can't just sniff any network traffic.
                      That worked back in the old days with anything connected to hub.
                      But if you can sleep better...setup OpenVPN server on your DD-WRT gateway and setup pfSense as OpenVPN client forcing any traffic through it.
                      Of course this will have huge nagative performance impact tho.

                      -Rico

                      1 Reply Last reply Reply Quote 0
                      • JKnottJ
                        JKnott @petreza
                        last edited by

                        @petreza said in Encrypted connection between Gateway and "double NAT" pfSense?:

                        I want to cut out the rest of my network from seeing the traffic between

                        Why do you think that traffic will be visible? With switches, the only thing you'd see is broadcasts & multicasts. To snoop, you'd need a managed switch, with port mirroring available.

                        PfSense running on Qotom mini PC
                        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                        UniFi AC-Lite access point

                        I haven't lost my mind. It's around here...somewhere...

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          If you set it up like rico stated the clients on the other network wouldn't even see broadcast..

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • P
                            petreza
                            last edited by

                            Thank you all!
                            With my concern about the big things I ignored the small things - it's not so easy to snoop on a network with modern hardware. I'll see what I'll do.
                            Thanks again!

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by johnpoz

                              Who exactly would be sniffing on your own freaking network anyway? I mean really?

                              And lets say they did - what exactly do you think they would see.. Pretty much all traffic these days is encrypted anyway.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              P 1 Reply Last reply Reply Quote 0
                              • P
                                petreza @johnpoz
                                last edited by

                                @johnpoz said in Encrypted connection between Gateway and "double NAT" pfSense?:

                                Who exactly would be sniffing on your own freaking network anyway? I mean really?

                                And lets say they did - what exactly do you think they would see.. Pretty much all traffic these days is encrypted anyway.

                                You are right. I am sorry I asked.
                                I'll see if I can get a moderator to delete this thread - it's stupid.

                                1 Reply Last reply Reply Quote 0
                                • RicoR
                                  Rico LAYER 8 Rebel Alliance
                                  last edited by

                                  Segmentation is not stupid, but do it the right way. ;-)

                                  -Rico

                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.