Remove LAN interface

johnpoz

The modem already has a switch, like most.

No not like most.. If your talking a gateway device then sure... But "MODEMS" normally only have 1 lan side port..

There are
Modems
Routers
Gateways - a gateway is a combo modem and router.

The 8200 he mentions is a "modem" but it has 2 ethernet interfaces. Some isp don't enable the 2nd interface, etc.

What is the make and model of your device?

A Former User

The activation of the 2nd port would come down to the ISP, and what their config setups on the device. Unless it gives you a 2nd public IPv4 That you want to use for forwarding, or outbound that is different than your 1st IPv4 I don't really see the point there.

Forwarding is exactly what I want t use it for. Now I can have two reverse proxies, one of them being in a true DMZ, along with other services, and keep it separate from the rest of my network.

Anyway, is it as simple as creating another vlan on lagg0 and assigning the LAN to that vlan?

Yup!

This frees up the physical interface - bobs your uncle.

Awesome. So pfsense will retain the default 192.168.1.1 address. Can you think of any other implications? I have a Unifi controller managing a few APs and managed switch. I suppose I'll need to add the new VLAN in the controller, otherwise nothing will be able to talk to pfsense...

JKnott

@johnpoz said in Remove LAN interface:

What is the make and model of your device?

Hitron CGN3ACSMR. As mentioned, it can be configured in gateway or bridge modes. Mine's in bridge. It's been years since I've had a plain modem. Also, while it is a gateway device, the ISP calls it a modem, as do many others.

A Former User

So, just wanted to report back that I created a vlan on lagg0 and assigned the LAN interface to that vlan. All seems OK.

However, the extra nic on the modem is now plugged into em1 but does not seem to be getting an IP, which I don't understand because when I plugged my laptop into that extra nic it did get an IP.

Status->gateways just says pending for the new WAN interface

stephenw10

Might be locked to the laptop MAC address.

Could be it was never supposed to happen and the second port is not intended to be used.

Steve

johnpoz

Yeah... maybe your laptop had a rfc1918 address? 192.168.100 is common for modems to hand out.

Also as mentioned you almost always have to reboot a cable modem when you change the device connected to it.. To release the mac pairing.

A Former User

It was locked to the laptop MAC. I spoofed the interface with the MAC and it obtained an IP.

Connection doesn't seem stable though. I can't route traffic out the new WAN gateway. Also, the interface bounces between up and down frequently.

johnpoz

Have you actually validated with your ISP that you should get and be able to use a 2nd IPv4 address on this interface.. I find it highly unlikely that ISPs would just let users have a 2nd IP without the user paying for it at min.

Are you paying for more than 1 IPv4 address?

A Former User

I called a few times and each person had a different answer. First it was only one IP address per modem, then it was we don't offer the service of adding a second IP anymore, finally it was we don't lock ports on customer provided modems. That's when I tried with a laptop.

JKnott

@johnpoz said in Remove LAN interface:

Have you actually validated with your ISP that you should get and be able to use a 2nd IPv4 address on this interface.. I find it highly unlikely that ISPs would just let users have a 2nd IP without the user paying for it at min.

I read about it on a my ISP's user forum, which is moderated by some employees. I am not paying extra for the 2nd address.

johnpoz

And are you on the same ISP as the OP?

That your ISP doesn't charge for extra IPs is nice for you - they are leaving money on the table ;) More then likely they don't even know its happening and have just not locked it down yet ;)

Are you on a business line, that an ISP would hand out multiiple IPv4 in this day and age of shortages seems like really bad business practice if you ask me.

That 2nd IP could be used to support another customer, or at min get more money from you per month.. If they just have IPs sitting there unused... But to hand them out for free, they should prob fire their business model guy ;)

JKnott

@johnpoz said in Remove LAN interface:

Are you on a business line

No, just a plain residential account. However, I generally don't use the 2nd address, other than for occasional testing.

A Former User

@johnpoz

My ISP used to offer the service of a 2nd IP but now they don't. Yet they don't lock down customer modems with multiple ports.

JKnott

@johnpoz said in Remove LAN interface:

And are you on the same ISP as the OP?

Probably not.

A Former User

So I tried removing the spoofed Mac and turned the modem off for a few minutes. Second wan connection received an IP but the first did not.

Also, when I purchased my modem I had to give the MAC address to them. Since the modem only has one MAC I think that's where they are limited although I could be wrong.

JKnott

@angdigi said in Remove LAN interface:

Also, when I purchased my modem I had to give the MAC address to them. Since the modem only has one MAC I think that's where they are limited although I could be wrong.

The modem MAC address is used only for communication with or through the modem, not what's beyond.

A Former User

@JKnott

Interesting. Do you know of any tips/tricks to keep the interface up instead of bouncing up and down?

JKnott

@angdigi

Not really, as I've never experienced that problem. My service is rock solid.

A Former User

Isn't this considered "flapping". Maybe it's something on the NIC that's causing the issue and not the ISP....

Gertjan

@angdigi said in Remove LAN interface:

of any tips/tricks to keep the interface up instead of bouncing up and down?

Take a switch.
Put it between the modem and pfSense.
Now, observe where the flapping happens.
On the flapping side, check port parameters - or just change the materiel and/or NIC if possible.