Insert SG-1100 between existing cable modem and router
-
I have ordered an SG-1100. I want to insert it between my existing Arris cable modem and my Ubiquiti wife router.
I would like to do this so that my router configuration remains unchanged, and thus I can experiment with the SG-1100 (and remove it from the chain if I foul things up).
Is this possible (and if so, what configuration do I use for the SG-1100) or not (or is this the wrong approach)?
Thanks in advance for any help.
-
By default, WAN is configured for DHCP so it should get an address from your ISP (if your modem is in bridge mode) or from the modem itself (if it's acting as a router). You shouldn't have to anything other than plug it in and then configure the LAN interface.
-
Thank you.
Yes my router gets an IP from the service provider so understood that now the Firewall will get it.
So I set up my SG-1100 to essentially bridge out to the WAN input on my router, and the router continues doing what it is doing today, correct?
-
Essentially yes. In bridge mode, your cable-modem simply acts as a dumb conduit to your ISPs network.
-
@KOM Thanks. Is there a particular "mode" I need to configure in the SG-1100 so that all it does is pass data between the modem and my router (other than with the added functionality of the Firewall)?
Perhaps I'm making more of this than I need to.
-
The SG is already configured to route your traffic from WAN to LAN, if that's what you mean. There is no 'mode' to worry about.
-
Having problems making this work.
I followed the instructions to start up the SG-1100. I then went into the setup wizard and walked through it.
With a laptop plugged into the SG's LAN port, I can browse the internet so that tells me that the LAN port is getting out. The SG has a LAN IP of 192.168.1.1.
When I unhook the cable from the laptop and plug in the cable going to my wifi router (Ubiquity AirRouter), I get no connectivity downstream (even after restarting the router numerous times).
If I open a browser (on a PC on the LAN) and browse to 192.168.1.1, I get the AirRouter's configuration screen rather than the SG's setup screen. So there is an address conflict. And of course I can ping that address from the LAN.
I went back into the SG and set it's address to 192.168.1.2, thinking that would solve the problem, but no luck. From a LAN pc, I cannot browse to 192.168.1.2. If I ping it, I get a reply from 192.168.1.200 that the destination is unreachable. Not sure where that is coming from.
I did add 2 firewall rules to pass all TCP and UDP traffic; those rules sit below the built-in rules.
I am not sure exactly what to try next. Appreciate any help! Thanks.
-
There are several ways you could address this. For instance, you could give your laptop a static IP address of 192.168.1.2, 255.255.255.0 mask, no gateway and then connect your LAN port directly to the AP and then try to hit its web interface at 192.168.1.1.
Or you could unplug the AP and then get to pfSense WebGUI and change its LAN IP address and mask to 192.168.2.1, /16 mask. Also change your mask to 255.255.0.0. Then plug in the AP and hit its web interface.
Once you get to its interface, see if you can change its mode from the static 192.168.1.1 to DHCP. If not, then change it to 192.168.1.2. Turn off its DHCP server if one is enabled. You just want it to act as a bridge to LAN, and let pfSense handle giving out addreses. Make sure you have the DHCP server running on LAN and configured or your wifi devices won't get an address.
Once you have changed it, go back and restore your pfSense LAN settings to their original 192.168.1.1/24.
-
Good progress but not quite there.
I have my AP set up as a Bridge. SG gives each device (both wired and wireless) IP addresses via DHCP. I can ping any other device from any device, on the LAN. But nothing gets out to the internet (or back).
In the SG my Dashboard shows all green up arrows for everything, except OPT which I haven't done anything with.
In the Firewall, I added 4 rules: tcp and udp "pass" for both ip4 and ip6. They are green-checked. They are below the built-in rfc 1918 and reserved rules.
I suspect I have a something blocking traffic but not sure what.
-
Success! I realized I needed to create Firewall rules to allow tcp and udp on the LAN side.
Appreciate all your help #KOM! Very grateful.
-
@NGUSER6947 said in Insert SG-1100 between existing cable modem and router:
I needed to create Firewall rules to allow tcp and udp on the LAN side.
No if its the default lan it would be any any rule out of the box.. You only need to create rules on new interfaces/vlans OPTX, the out of the box lan defaults to any any rule.
In the Firewall, I added 4 rules: tcp and udp "pass" for both ip4 and ip6.
You didn't create rules on your WAN did you?
-
Please post screens of your WAN, LAN and OPT1 rules so we can check them out for you.
-
Ok.
Wan:
Lan:
I realize this probably isn't "firewalling" much of anything right now. My plan was to get everything on my network operating then research how to set up the best rules and lock the device down.
-
Rules are evaluated top-down, first match wins. No other rules are processed after a hit.
On your WAN, get rid of those last four allow rules.
On your LAN, also get rid of those last 4 rules. The second rule is already passing all IP4 traffic. Those other rules you added aren't really doing anything. If you're not using IP6 then go to System - Advanced - Networking and disable IP6 there.
-
Ok done. And, everything still works. Thanks folks for the help.
-
https://docs.netgate.com/pfsense/en/latest/firewall/firewall-rule-basics.html
-
If you do disable IP6, don't forget to go back to your LAN rules and delete the IP6 ones you manually added.
-
There you go - much better ;)
See no need to have created any rules..
-
Thank you both.
So with the "factory" rules (only) in place, am I better protected than without the SG, or not really until I start creating more specific rules?
-
Yes. Default rules allow all traffic out from LAN, and block all unsolicited traffic in to WAN.
-
depends - with the default rules nothing has been forwarded from wan/internet to your behind pfsense router that is for sure.
Not sure why you want or think you need another router behind pfsense.. If you want wireless - then just use an AP.
edit
What is this exactly "Ubiquiti wife router." Do you mean an AP like an AC-Pro or -Lite? What is the model number of this device? you have from unifi? -
@johnpoz. It is an AirRouter. I have it set up in bridge mode. Although most of my gear is hard-cabled, I have a couple of devices I can only get to via wifi.
-
@johnpoz Courierdog here and I have a similar requirement.
My ISP provides the Fibre ONT (Modem) to their ISP Router.
The ISP Router also provides the IP TV and the ISP provided Home Security System
From the ISP Router I feed a Bitdefender Box 2 (WiFi Router)
The Netgate SG-1100 does not have WiFi
I would like to configure the SG-1100 so all the ethernet LAN connections pass through the SG-1100 which then connects to the Home Network Switch.
The ISP Router provide the Internet connection
The Bitdefender Box 2 provides the monitored WiFi Access Point
The Netgate SG-1100 provides the Firewall for the Home Ethernet network
I have in the past used a Router with Tomato Firmware whereI now want to place the Netgate SG-1100
I configured the Tomato Router as a static IP addressed Bridge using one address within the range of the Bitdefender Box 2 DHCP range of addresses.
I am unsure if the Netgate SG-1100 can be configured this way or would it have to be placed in front of the Access Point which would have to be configured as the Bridge.
Thanks in advance -
It can be configured as a transparent firewall like that but doing so requires bridging VLANs.
It's almost always better to avoid bridging if you can.
An Access Point would normally be a layer 2 device anyway, no need to bridge anything or already internally bridged.
I'm unclear where the USP router fits in here. Potentially you have 3 routers with 3 levels of NAT. Really you want 1.
Steve
-
@stephenw10
We have no option on the ISP Router That Must stay in place.
However, I have revised my thoughts.
ISP Router -> Netgate SG-1100 Firewall - ASUS RT N66U (WiFi AP) -> Home Network Switch
This requires me to reassign the SG-1100 LAN IP
Currently the SG-1100 Put me directly to the Dashboard this is not what the User Guide states.
At this point I am lost.
I may be Somewhat of a newbie but the SG-1100 is not following the Documentation.
Dave -
@courierdog said in Insert SG-1100 between existing cable modem and router:
Currently the SG-1100 Put me directly to the Dashboard this is not what the User Guide states.
At this point I am lost.Huh?? When you setup the sg1100, yeah would be able to access the web gui, on the default 192.168.1.1 IP - unless you changed it?
Directly to the dashboard of what - how or where does it say in the documentation anything different?
-
I assume you mean you're not seeing the setup wizard?
That can happen if it was previously launched and then escaped but you can run it again at any time fro System > Setup Wizard.
Steve
-
@johnpoz
Problem is the ISP uses the 192.168.1.1 LAN IP address so I have to change it.
The guide says go to Advanced - Option 2When I login, I am sent directly to the dashboard
The setup wizard does not appear.
Even if I set up using and empty WAN port and connect my Mac directly to the LAN port, Login takes me directly to the Dashboard.
Very strange. -
@courierdog said in Insert SG-1100 between existing cable modem and router:
The guide says go to Advanced - Option 2
You can set the IP via here option 2
What is the page in the docs your looking at exactly - can you post the url your looking at?
Here for example
https://docs.netgate.com/pfsense/en/latest/config/index.html#connecting-to-the-gui -
@johnpoz let me start over.
my ISP (Telus) provides my Internet/TV/Home Security
I want to leave all of that on one network and using the Netgate SG-1100 to provide my Home Internet Network.
The ISP uses the Standard 192.168.1.1 IP LAN Settings
First I have to change the LAN of the SG-1100 to something different
However the WAN side of the Netgate SG-1100 will come from the ISP Provided Router.
Currently I have managed to LAN configuration of the SG-1100 but the WAN side of the SG-1100 is not connecting to the ISP Router.
Where / How in the configurations settings do I enable the Netgate SG-1100 to accept the Internet connection as provided by the ISP Router.
I hope this makes sense.
I mentioned this to a friend who uses pfsense and he did say I have to enable something on the WAN side to accept the feed from the ISP Router. -
@courierdog said in Insert SG-1100 between existing cable modem and router:
I have to enable something on the WAN side to accept the feed from the ISP Router.
No you don't... You can for sure use 192.168.1/24 on your wan - many users do, just a double nat.
He might be thinking about the default block rfc1918 rule, but the dhcp hidden rules that allow pfsense to be a dhcp client would allow it to get a rfc1918 address.
Change your lan of pfsense to be say 192.168.2 and you would be fine.
-
@johnpoz my limited understanding is Double NAT is not a good thing.
changing the LAN side to a secondary LAN assignment minimizes the issue or so I have been told.
Assigning as an example the pfsense LAN to the 192.168.2.1 or anything except the ISP DHCP assignment minimizes the Double NAT issue.
My current issue is the WAN side will not connect to the ISP Router and thus the internet.
I can connect the to the pfsense Device from the LAN, fine but the device is not connecting on the WAN side.
Hence the question of a setting for the WAN Side to enable it to communicate with the ISP Router -
@courierdog said in Insert SG-1100 between existing cable modem and router:
anything except the ISP DHCP assignment minimizes the Double NAT issue.
What? Your still double natted..
Change the lan of pfsense to be something different than its wan.. And will be fine - double nat is not optimal no... But works just fine... Many Many people do it, seen triple even quad nat, etc.
It is not an optimal choice but shouldn't be a problem.
@courierdog said in Insert SG-1100 between existing cable modem and router:
but the device is not connecting on the WAN side
What is not connecting to what exactly? Does pfsense get an IP address from your isp device its connecting too or not?
If you want something on your pfsense "wan" to talk to something on pfsense lan. And want the wan device to start the conversation. Then yes you would have to turn off the block rfc1918 rule that is default on the wan. AND you would have to setup a port forward for whatever it is your wanting to do.
If something on pfsense lan wants to start a conversation to something on pfsense wan - that would not be an issue.
-
OK Now you are way over my head.
Like I was attempting to say, I can communicate with the SG-1100 via the LAN port.
The WAN is not seeing the internet at all.
Is there any means to return to factory settings and I can start over. Just in case I have done something inadvertently.
I followed the Quick Start Guide but when I connected the WAN port to the SG-1100 it failed to connect to the ISP Router and thus the internet.
The first strange thing that happened when I plugged in the power was when I logged in from the first time,
The login was per the Quick Start Guide.
From then on everything has been different than the Guide.
First, Login -> Directly to Dashboard.
The Quick Start Guide does not explain what to do when you arrive at the Dashboard.
I am sure if the guide covered this situation I would not be sitting here scratching my head and not knowing what I did or how to proceed. -
You can reset to defaults from Diag > Factory Defaults in the GUI or using menu option 4 at the console.
The setup wizard runs one time only automatically. If you escape it at any point it won't run again. But you can manually run it anytime from System > Setup Wizard.
Do you even see link LEDs on the ports when you connect the WAN?
Steve
-
@stephenw10 Thank You Ever So Much.
This was the Most Helpful Response I have received to date.I would suggest this NOTE be placed in the beginning of User Setup Guide.
It would explain what is happening, to many people especially those who become frustrated and give upEven My friend who uses pfsense did not explain this to me.
Before this note I was about to pack up the Netgate SG-1100 in the box and return it as defective.
I may have to run through this procedure a few times to verify for my self exactly what is happening and time each segment noting the LED Status with each step.
Please be patient with an old Man (80) who is still finding new things every day.
-
No worries. Keep asking questions, that's what I'm here for.
Steve
-
@stephenw10 Have No Worries, I have many more questions.
The SG-1100 has a significant lag time for the reboot process.
Even after using the System -> Diagnostics -> Factory Defaults
Login to the SG-1100 takes a considerable time.
So I am not convinced, at least at this point, that the device default setting are correct.
There is still no internet connection passing through the SG-1100
I would have thought this would be a Default Setting.
I have a Zoom Meeting starting at 0900 I will get back to this after the meeting.
Thanks for your patience, I am sure the device will work, however some how there is an incorrect setting preventing the (Automatic) connection to the internet.
Dave -
It should indeed provide internet to a LAN side client by default when WAN is connected to something providing DHCP.
Reasons it may not include:
Subnet conflict. The WAN is using the same subnet the LAN does by default.
No DHCO server on the WAN connection.
No link on WAN so it cannot connect.Yes, the boot time is significantly slower when there is no valid WAN connected. A number of things have to timeout during the process.
Steve
-
@stephenw10 I had an opportunity to sit down on a zoom call late this morning.
My friend and I each sat in front of our respective pfsense box
Here are the Unedited Results
NOTE:
The setup wizard runs One Time Only automatically.
If you escape it at any point it will not run again.
However you can manually run it anytime from System -> Setup Wizard.
You can reset to defaults from Diagnostics -> Factory Defaults in the GUI
or
using Menu Option 4 at the console.For My Particular Issues of Non Connect with the Netgate SG-1100
- Interfaces WAN
Enable Interfaces [ ] - Reserved Networks
UnBlock Private - Interfaces LAN
Static IP Address 192.168.2.1
General Enable DHCP
Subnet 192.168.2.0
Subnet Mask 255.255.255.0
Available Range 192.168.2.1 192.168.2.254
Range From 192.168.2.100 To 192.168.2.199 - Package Manager
Installed aws wizard
ipsec profile wizard
Add Bandwidthd
Reboot Full Reboot, - Settings Highlight LAN
- Bandwidthd Settings
Enable Bandwidth [ ]
Subnet(s) LAN Highlight
Enable Proniscuous [ ]
Enable Draw Graphs [ ]
Meta Refresh 20
6 SAVE
This is my first draft of what it required to place the SG-1100 down stream of my ISP Router and before my home network switch.
Please review and provide your input and comments.
Note one of the objectives is to be able to monitor all Home Network LAN Traffic with will also include a wireless Access Point for the iPhones and iPads ALL computers are hardwired to the LAN as are the NAS Servers - Interfaces WAN