Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    New to pfSense

    Scheduled Pinned Locked Moved L2/Switching/VLANs
    66 Posts 6 Posters 12.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      Thuan @johnpoz
      last edited by

      @johnpoz

      Hi John,

      After configured as instructed in the SG-3100 manual, I have no internet from the only VLAN. The grey areas are firewall and DHCP server setup.

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by johnpoz

        And again without you actually posting what you did there is no way for us to tell what your doing wrong.. Users say they did X all the time and come to find out they actually did Y..

        You saying it doesn't work is not going to get anyone anywhere.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        T 1 Reply Last reply Reply Quote 0
        • T
          Thuan @johnpoz
          last edited by

          @johnpoz

          I followed the instructions printed on the SG-3100 PDF manual, pages 7 of 48 thru 12 of 48. At the end, I was told to create firewall rules, so I did. Basically, I created rules that pass ANY from ANY source to ANY destination. Then I was told to enable DHCP, and I did.

          In general, I tried to follow exactly what the instructions said, and verified results after each step. Only thing missing is the internet from the newly configured port. That’s why I asked what steps YOU DID to get your results. Experts say doing this or that is easy but they skip the details.

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by johnpoz

            And users say they followed instructions xyz... And they really did ABC!!

            There is nothing to do other than create the vlan, put an IP on it and create the firewall rules.. That is all that is required.. So until you actually going to post up some pictures of what you actually did..

            I showed you how vlans are setup on my 3100.. each port of the switch is on a different vlan. Each one has internet.. When you create a new network/vlan the outbound nat would auto create the outbound nats for you.

            There is nothing to do but create the interface, and the firewall rules.. Can your client on vlan X ping the IP you put on vlan X?

            What PDF manual? Are you talking about??
            https://docs.netgate.com/pfsense/en/latest/solutions/sg-3100/

            I just went through that - and looks fine... What are you actually connecting to port 4?

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • S
              Sir_SSV
              last edited by Sir_SSV

              I have a rather major problem that has only now been brought to my attention via the System Logs. Today, the firewall was reporting many requests on the WAN interface. At the time, I had no idea what the IP address was until I looked further. Turns out, my pfSense gui is available to connect on both my LAN address (10.10.10.10) as well as an address on the WAN DHCP Gateway (100.xx.xx.xx).

              I have reconfigured the System settings and changed the port for https, disabled both the webConfigurator anti-lockout rule and Webgui redirect rule (I have created firewall rules to enable me to do this).

              There is a VPN connection via OpenVPN however I have disabled all the settings and restarted pfSense and still I am able to access the webgui via the WAN DHCP Gateway address (100.xx.xx.xx).

              I have not added any rules to the WAN firewall rules.

              I must have overlooked a setting somewhere but cannot find it. Does any one know where else I can look to close this loop hole?

              Edit: doing more research it seems the webgui listens on all interfaces. Is there a way to disable this? When I try and access the webgui via my phone on 4G/LTE it is blocked. How did these other external ip’s manage to find my webgui address on the WAN interface?

              JKnottJ 1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by johnpoz

                The default rules on the lan would yes allow you to access the gui on the wan address from the lan.. Since the default rules on the lan are any any.

                If you want to block lan side access to your webgui on your wan IP, then you would need to specifically block this access.. This is where the "this firewall" built in alias comes in handy.

                It will include ALL ips of the firewall..

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                S 1 Reply Last reply Reply Quote 0
                • JKnottJ
                  JKnott @Sir_SSV
                  last edited by

                  @Sir_SSV said in New to pfSense:

                  Turns out, my pfSense gui is available to connect on both my LAN address (10.10.10.10) as well as an address on the WAN DHCP Gateway (100.xx.xx.xx).

                  This is entirely normal. Any interface address on pfSense is reachable from the LAN, unless specifically blocked. Try from elsewhere and see what happens. I bet you can't get in.

                  PfSense running on Qotom mini PC
                  i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                  UniFi AC-Lite access point

                  I haven't lost my mind. It's around here...somewhere...

                  S 1 Reply Last reply Reply Quote 0
                  • S
                    Sir_SSV @johnpoz
                    last edited by

                    @johnpoz

                    Yes you are correct. I made the mistake of checking the webgui via WAN ip on LAN and this did give me a shock!

                    How would these external IP’s have found the WAN IP address of the webgui when I didn’t even know what it was?

                    It would be good if in a future pfSense release they gave us the option of choosing which interface the webgui listens on. I would have thought it would be preferable to have the webgui invisible on the WAN side

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      @Sir_SSV said in New to pfSense:

                      How did these other external ip’s manage to find my webgui address on the WAN interface?
                      When I try and access the webgui via my phone on 4G/LTE it is blocked

                      So what are these "external" ips that are accessing your gui? And how are you showing they are accessing your gui? A login attempt in the logs? Or your firewall listing a block?

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      S 1 Reply Last reply Reply Quote 0
                      • S
                        Sir_SSV @JKnott
                        last edited by

                        @JKnott

                        When I tried via my phone on 4G/LTE I couldn’t even reach the webgui. Was shocked when I saw the logs and I tested the IP address seeing it was my webgui that opened!

                        JKnottJ 1 Reply Last reply Reply Quote 0
                        • S
                          Sir_SSV @johnpoz
                          last edited by

                          @johnpoz

                          Firewall was listing a block.

                          It listed as the interface being WAN, “from” being overseas IP (they came from America, Italy, Dubai and that was the ones that it could resolve. Used Shodan.io to resolve the others) and “to” being the WAN webgui address however on different ports (I have changed the https port from 443 to a much higher one)

                          1 Reply Last reply Reply Quote 0
                          • JKnottJ
                            JKnott @Sir_SSV
                            last edited by

                            @Sir_SSV said in New to pfSense:

                            @JKnott

                            When I tried via my phone on 4G/LTE I couldn’t even reach the webgui. Was shocked when I saw the logs and I tested the IP address seeing it was my webgui that opened!

                            So, it's performing as expected. As pfSense is a router, you can access any address on it. However, the firewall rules are applied to an interface, which is why you can get in from the LAN, where there are no rules blocking access, but can't from outside, as the rules are on the WAN interface. As I said, this is entirely normal.

                            The log entries show the firewall is doing it's job, when someone tried to get in from elsewhere. Your cell phone attempts should have also appeared in the log.

                            PfSense running on Qotom mini PC
                            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                            UniFi AC-Lite access point

                            I haven't lost my mind. It's around here...somewhere...

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by

                              @Sir_SSV said in New to pfSense:

                              Firewall was listing a block.

                              Well yeah there is a shitton of noise on the net.. Your firewall logging the noise is the default (log default blocks).. If you don't want to see the noise, turn off logging default block rule.

                              80/443/22/23/1433/3389 are going to see lots of noise..

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • T
                                Thuan
                                last edited by

                                I've managed to get Internet from a VLAN port on SG-3100. The speed on it however is much slower than that of from ISP. What can I do to get the speed the SG-3100 offers?

                                1 Reply Last reply Reply Quote 0
                                • S
                                  Sir_SSV
                                  last edited by

                                  I have only recently set up DNS Resolver (prior to this I was using my ISP's DNS servers).

                                  On one of my vlans is my FreeNAS server that has no access to the internet however I have made rules for it to be made available to the intranet as well as allowing DNS (via my ISP DNS on port 53) and Gmail (on port 587).

                                  Is there a way to change the DNS rule to use the DNS Resolver? I tried changing the Destination to 127.0.0.1 however my test emails on my FreeNAS server failed.

                                  Firewall rule is:

                                  Protocol - IPv4 TCP/UDP
                                  Source - FreeNAS address
                                  Destination - 127.0.0.1
                                  Port - 53 (DNS)

                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by

                                    @Thuan said in New to pfSense:

                                    The speed on it however is much slower than that of from ISP.

                                    And what speed is that?

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    T 1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator
                                      last edited by

                                      @Sir_SSV said in New to pfSense:

                                      I tried changing the Destination to 127.0.0.1

                                      huh? When would your client send anything to pfsense if the destination was loopback?

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      S 1 Reply Last reply Reply Quote 0
                                      • S
                                        Sir_SSV @johnpoz
                                        last edited by

                                        @johnpoz said in New to pfSense:

                                        @Sir_SSV said in New to pfSense:

                                        I tried changing the Destination to 127.0.0.1

                                        huh? When would your client send anything to pfsense if the destination was loopback?

                                        I have no idea! Just not sure what address to place in the destination so FreeNAS can use the DNS Resolver. With my FreeNAS system it sends regular updates to my Gmail notifying me of system status

                                        1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by

                                          That would be the address its listening on, your lan address, or vlan address, optX address, etc.

                                          You then set your freenas to use pfsense as its dns.. Or just hand it out via dhcp - which is default.

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          S 1 Reply Last reply Reply Quote 0
                                          • S
                                            Sir_SSV @johnpoz
                                            last edited by

                                            @johnpoz said in New to pfSense:

                                            That would be the address its listening on, your lan address, or vlan address, optX address, etc.

                                            You then set your freenas to use pfsense as its dns.. Or just hand it out via dhcp - which is default.

                                            I do have dhcp set up for the vlan, and the dns settings I left blank.

                                            Should I fill the dns as the pfSense ip?

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.