Routing 169.254 Networks

johnpoz

Ok here you go - sorry for the delay... When got back from walk yesterday I got side tracked on other things then had to leave for work.

Set my printer to 169.254.2.50, connected it to my wan L2

Created a vip on my pfsense 169.254.100.100

Made sure pfsense could ping it

Created outbound nat rule

Created a port forward for ping to some odd rfc1918 IP that would send to 169.254.100.100 - you will need whatever port(s) your using for printing.

Then from my PC I pinged the portforwarded IP 192.168.20.50 in my case - and via sniff on wan while this is happening you see that pfsense changed that to its 169.254.100.100 address

Make sure you turn off blocking APIPA
JimP has a post here about it
https://forum.netgate.com/post/737766

Validate that is working by looking at your full rule set or looking in your system of your config - download that section via backup and look at it with fav text editor..

Good Luck - but you really should get with your IT to do this correctly!!! Such a setup is just plain BORKED!!!

edit: To to be 100% complete on this - check your full rules
pfctl -sr
If you see

block drop in quick inet from 169.254.0.0/16 to any label "Block IPv4 link-local"
block drop in quick inet from any to 169.254.0.0/16 label "Block IPv4 link-local"

In there which is the default then no its not going to work.. Check the above setting in your <system> part of the config and do your filter reload, then check your rules again.

hopkins

Thanks! It was very kind of you to post the steps and screenshots.
It is working and I can finally connect to my printer now!

I really appreciate for your help :)

johnpoz

Yeah never know when the next guy will have the same question ;)

Glad you got is sorted - but its still BORKED!!! dude.. Your IT guys need to rethink how they have their printer setup.. That is just nonsense to have to have users create route statements, etc.

hopkins

To be fair, I don't think they will do anything about it though. Regardless the network is borked or not, they won't modify the network settings for the one single guy who wants more security with a PF box. Especially when other (Windows) users doesn't have any issues.

Funny thing is, the printer seems automatically change its IP every few days, I guess I have to live with it and use IP Aliases..ha!

johnpoz

APIPA (169.254.x.x) is what is used when device is set for dhcp and it gets no dhcp, so yeah it could change whenever it tries to get dhcp again, or when its rebooted for sure, etc..

You would think they could take the time to actually just set a rfc1918 IP on the freaking thing - so its always the same IP..

You sure they even understand what its doing?

hopkins

I am not sure. But if the printer gets a RFC1918 IP (e.g. 192.168.x.x), I think it requires more configurations for my colleagues' Windows PCs, which means they (the IT guys) need to do more things, which means it is better to leave the network configuration to status quo. I don't think they really care if the network is f*'d up or not, as long as it works...

johnpoz

No it would require the same sort of shit nonsense with a route statement..

But it wouldn't be freaking changing as the wind blows.

hopkins

Hmm... I will try to talk to the IT guys later if possible.
In the meantime I think I probably will need to stick to current configurations.
Thanks again for your help. You really did save the day!

hopkins

Sorry for bumping up the old post.
After upgrading to 2.4.5, I cannot reach the printer anymore.

It seems that I can ping it on the pfsense box, but not on the NAT IP on LAN.

When pinging 192.168.200.1 (Printer is at 169.254.169.100, VIP of my box is 169.254.100.100/16) from 192.168.1.4:

It seems that there is no response:

I have confirmed that no_apipa_block is set to true, and

pfctl -sr

shows no blockage for packets in 169.254.0.0/16

Any ideas what is going on?

Thanks

hopkins

@hopkins Got similar issue for users upgraded to 2.4.5, not sure if it helps to diagnostic the issue:
https://www.reddit.com/r/PFSENSE/comments/fq8t8f/245_breaks_apipanat_rules_for_me/

johnpoz

And clearly that redmine was rejected..

johnpoz

@hopkins said in Routing 169.254 Networks:

shows no blockage for packets in 169.254.0.0/16

To talk to something on another vlan that is using apipa, that device would have to have a gateway.. Or you would have to nat to it, etc.