Accessing modem from inside firewall



  • Hi

    I read the guide https://doc.pfsense.org/index.php/Accessing_modem_from_inside_firewall and it seems to me that there is a mismatch:

    In the first part, it indicates that the modem must have a different subnet from the LAN: So if, for example, the LAN belongs to class C, the modem may belong to class A.

    While, in the second part, it indicates that their subnet should be the same.

    I am wrong?

    Thanks

    Bye


  • Netgate

    You need to have a VIP on LAN on the same subnet as the modem and NAT out that VIP when the destination is the modem so it doesn't have to have a route back to you (since it won't have one)



  • @Derelict:

    You need to have a VIP on LAN on the same subnet as the modem and NAT out that VIP when the destination is the modem so it doesn't have to have a route back to you (since it won't have one)

    Excuse me but what is a VIP?

    Thanks

    Bye


  • Rebel Alliance



  • I have a VDSL2 router (10.0.0.1) in bridge mode connected to the WAN port on a hardware firewall (192.168.1.1) which manages the Internet connection using the PPPoE.

    Since the WAN interface of the firewall is become a virtual adapter PPPoE-WAN, associated with the re2 physical interface, I assigned the re2 physical interface and I set it to 10.0.0.2.

    Now, what are the rules that I will have to create in the Virtual IP and NAT sections to make sure that I am able to access the web interface of the router?

    I've been using pfSense 2.3.2 64 bit.

    Thanks

    Bye



  • I'm still waiting for your answer.

    Thanks

    Bye


  • Rebel Alliance Global Moderator

    "I have a VDSL2 router (10.0.0.1)"
    "I assigned the re2 physical interface and I set it to 10.0.0.1"

    How do you expect that to work??  Just curious… Do you mean you set re2 to 10.0.0.2?

    So what do you think you should do for nat, if your wanting to talk to a client on a 10 network on your wan interface that has no gateway and doesn't understand how to get to your 192.168 network on your lan??  Hint if you "nat" your 192.168 traffic to look like its coming from a 10 address, then your "router" will no how to talk back ;)



  • @johnpoz:

    "I have a VDSL2 router (10.0.0.1)"
    "I assigned the re2 physical interface and I set it to 10.0.0.1"

    How do you expect that to work??  Just curious… Do you mean you set re2 to 10.0.0.2?

    So what do you think you should do for nat, if your wanting to talk to a client on a 10 network on your wan interface that has no gateway and doesn't understand how to get to your 192.168 network on your lan??  Hint if you "nat" your 192.168 traffic to look like its coming from a 10 address, then your "router" will no how to talk back ;)

    I was wrong to write: the re2 physical interface has the IP 1.0.0.2.

    With these settings, it is possible to reach my goal? If so, how should I do? If not, what are the addresses of the router and re2 interface appropriate for do this?

    Thanks

    Bye



  • Sorry but there is someone willing to help me?

    Thanks

    Bye


  • Rebel Alliance Global Moderator

    So create an outbound nat using the vip you created of 10.0.0.2 - do you need a picture?



  • @johnpoz:

    So create an outbound nat using the vip you created of 10.0.0.2 - do you need a picture?

    How should I fill out this window:


    ?

    Thanks

    Bye


  • Rebel Alliance

    This is how i have it done….  No "VIP" here...

    ADSL Modem in "Bridge"  with 172.20.254.1/29 IP address

    pfSense WAN PPPoE (re1)

    Modem Access Interface  "GEST"  (means: "gestión" = management)  ;)  (re1) with 172.20.254.6/29 IP address

    The rest of the info, in the attached images ;)














  • @ptt:

    This is how i have it done….  No "VIP" here...

    ADSL Modem in "Bridge"  with 172.20.254.1/29 IP address

    pfSense WAN PPPoE (re1)

    Modem Access Interface  "GEST"  (means: "gestión" = management)  ;)  (re1) with 172.20.254.6/29 IP address

    The rest of the info, in the attached images ;)

    I can not understand the 003 image. What rules should I add?

    Thanks

    Bye


  • Rebel Alliance Global Moderator

    Good catch ptt, no you do not need a vip if your NOT using the wan interface IP I guess.  Good catch that his wan is actually PPPoE.  I was over looking that.

    But I would not suggest manual mode for the outbound nat, just use hybrid and add the nat for interface that is connected to your modem.

    This is really no different than using a vip, but since your really not actually using the IP that is on your physical interface connected to your modem, you can just set the IP right on the interface and no need for a vip.


  • Netgate

    Yeah PPPoE is done differently. That writeup has you putting the IP subnet of the modem on the physical interface the PPPoE is on. No VIPs there.



  • I can not understand the 003 image. What rules should I add?

    Thanks

    Bye


  • Rebel Alliance Global Moderator

    that is not a rule.. That is the actual interface connected to the modem.. Just putting an IP address on it that matches with the IP address of the modems IP.


  • Rebel Alliance

    You create & configure the "Interface" for modem access (GEST in my case)

    then, as John pointed, you set the NAT as "Hybrid"

    now, you create the NAT Rule (Mapping) to access the Modem…

    That's all..






  • Firewall 192.168.1.1
    Router 10.0.0.1

    I configured the router in bridge mode and have configured the firewall in this way





    When I connect my router to the WAN port on the firewall, I can't access the router. Where did a mistake?

    Thank you,

    Bye


  • Rebel Alliance

    Your NAT setting is wrong ….  Set/leave it as "Hybrid Outbound NAT"

    ![Your NAT is wrong.jpg](/public/imported_attachments/1/Your NAT is wrong.jpg)
    ![Your NAT is wrong.jpg_thumb](/public/imported_attachments/1/Your NAT is wrong.jpg_thumb)



  • @ptt:

    Your NAT setting is wrong ….  Set/leave it as "Hybrid Outbound NAT"

    This setting

    is fine?

    Thanks

    Bye


  • Rebel Alliance Global Moderator

    Why do you have 10.0.0.0/8 on your lan side??  Also why is your LAN connected to Bridge0???



  • My gateway uses a private network address for the management interface. My routers are connected to a bridged port so they don't have visibility of the private network. I wanted to be able to access the gateway, but I was okay with not having it accessible from any computer. I had a spare NIC on the hyper-v server that is hosting the pfsense routers, so I connected it one of the LAN ports on the gateway and bumped up the metric so the route wouldn't be used except to access the private address. I don't think there's any reason why it wouldn't work on any host with dual NICs.



  • Router VDSL2 in Bridge mode: 10.0.0.1
    Firewall hardware: 192.168.1.1

    I connected the router to the WAN port of the firewall configuring it in this way:










    but I can not access the router from the LAN and I have no Internet because the PPPoE client can not connect even if its login is correct. Why?

    Thanks

    Bye


  • Netgate

    Does your PPPoE work if you get rid of all the modem access junk? Is there anything interesting in the PPP logs? Are you sure the modem is in bridge mode?

    After you get PPPoE working again and you go back to trying to access the modem, are you sure it's 10.0.0.0/8 and not 10.0.0.0/24?



  • @Derelict:

    Does your PPPoE work if you get rid of all the modem access junk? Is there anything interesting in the PPP logs? Are you sure the modem is in bridge mode?

    After you get PPPoE working again and you go back to trying to access the modem, are you sure it's 10.0.0.0/8 and not 10.0.0.0/24?

    Why should I put 10.0.0.0/24?

    Thanks

    Bye


  • Netgate

    Because that's the netmask the cable modem is configured for? I asked if you were sure. I didn't say you should change it.



  • And on your Modem_access Interface you should UNcheck "Block private networks".


  • Rebel Alliance Global Moderator

    How exactly do you think your nat is going to work?  You have 10.0.0/8 as dest but you also have it a source for your lan automatic nat, etc.

    What I would do is START over!!!  delete all that crap.. And why again do you think you need to run a bridge on pfsense?

    And I find it highly unlikely your "modem" is using /8 as its mask for its 10 address.. Your status doesn't even show your wan interface up..



  • I noticed that if I enable the Interfaces –-> Modem_access interface and, then, I click on the Connect button on the Status ---> Interfaces, the firewall connects to the Internet but the computers on the LAN have no more Internet. Why?

    Thanks

    Bye


  • Rebel Alliance Global Moderator

    Prob has something to do with running same 10/8 network on both your wan and lan?  Or maybe some nonsense you did with a bridge??

    What I would do is start over!!  NO freaking bridges… Actually validate what your modem is using for its mask on this 10 address.  And then create your interface using that.. And don't use an overlapping network on your lan side, etc.



  • @johnpoz:

    Prob has something to do with running same 10/8 network on both your wan and lan?  Or maybe some nonsense you did with a bridge??

    What I would do is start over!!  NO freaking bridges… Actually validate what your modem is using for its mask on this 10 address.  And then create your interface using that.. And don't use an overlapping network on your lan side, etc.

    Excuse me, but how do I solve my problem?

    Thanks

    Bye


  • Rebel Alliance Global Moderator

    My gawd dude… I just told you!!

    Lets start with basic info number 1... Ok your modem is using a 10.address - what is the mask on that?  I find it like impossible to believe it would be /8 so what it /24?

    So if its 10.0.0.1/24 then make your interface 10.0.0.2/24

    On the lan side of your network - do not use ANY networks that are 10.0.0.0/24 or that would overlap it like 10.0.0.0/8 or /16 or /23 etc.. -- say away from all 10 networks would be my suggestion.

    Then create your outbound so when you want to talk to 10.0.0/24 you nat to your 10.0.0.2 address.  Using hybrid mode put that outbound nat above your automatic nats.

    And don't create any freaking bridges!!!  You have ZERO use for them!!



  • @johnpoz:

    My gawd dude… I just told you!!

    Lets start with basic info number 1... Ok your modem is using a 10.address - what is the mask on that?  I find it like impossible to believe it would be /8 so what it /24?

    So if its 10.0.0.1/24 then make your interface 10.0.0.2/24

    On the lan side of your network - do not use ANY networks that are 10.0.0.0/24 or that would overlap it like 10.0.0.0/8 or /16 or /23 etc.. -- say away from all 10 networks would be my suggestion.

    Then create your outbound so when you want to talk to 10.0.0/24 you nat to your 10.0.0.2 address.  Using hybrid mode put that outbound nat above your automatic nats.

    And don't create any freaking bridges!!!  You have ZERO use for them!!

    So, can you explain in detail what I have to do to try if your idea works?

    Thanks

    Bye


  • Rebel Alliance Global Moderator

    How is that not enough detail for you.. .Really??  Do you want me to remote to your system and do it for you?



  • @johnpoz:

    How is that not enough detail for you.. .Really??  Do you want me to remote to your system and do it for you?

    What are the images that you need to be able to solve my problem?

    Thanks

    Bye


  • Rebel Alliance Global Moderator

    I already solved your problem multiple times and told you exactly what do for gosh sake…

    The info you need is in the access my modem article..
    https://doc.pfsense.org/index.php/Accessing_modem_from_inside_firewall

    Here are some pictures.. Now I have to use a vip to do this since I am actually using my WAN with a public IP on it.. But you are using pppoe so you would do this via interface actually assigned to your WAN interface.

    So my modem uses 192.168.100.1/24 -- I know its a /24 because when it doesn't have a isp connection it hands out IPs via dhcp in 192.168.100.0/24  And doesn't really matter if you have the mask exactly right as long as your not overlapping with your other networks, and your modem and IP on your wan are in the same network..  So use /24!!! is your best option if you do not know for sure what the mask is..

    So I create VIP..  You would do it on your wan interface that your calling modem_access.. You then create an outbound nat that says hey when going to that network from your source use this interface address..

    You can see me accessing my modem, you can see the states in the state table on pfsense.. What is it that your not understanding here???  Do you not understand how pfsense nats to yoru public network??  Its the SAME freaking thing.. But only to another rfc1918 network..




  • @johnpoz:

    I already solved your problem multiple times and told you exactly what do for gosh sake…

    The info you need is in the access my modem article..
    https://doc.pfsense.org/index.php/Accessing_modem_from_inside_firewall

    Here are some pictures.. Now I have to use a vip to do this since I am actually using my WAN with a public IP on it.. But you are using pppoe so you would do this via interface actually assigned to your WAN interface.

    So my modem uses 192.168.100.1/24 -- I know its a /24 because when it doesn't have a isp connection it hands out IPs via dhcp in 192.168.100.0/24  And doesn't really matter if you have the mask exactly right as long as your not overlapping with your other networks, and your modem and IP on your wan are in the same network..  So use /24!!! is your best option if you do not know for sure what the mask is..

    So I create VIP..  You would do it on your wan interface that your calling modem_access.. You then create an outbound nat that says hey when going to that network from your source use this interface address..

    You can see me accessing my modem, you can see the states in the state table on pfsense.. What is it that your not understanding here???  Do you not understand how pfsense nats to yoru public network??  Its the SAME freaking thing.. But only to another rfc1918 network..

    Which devices are the 192.168.100.2 and 192.168.9.x IPs displayed in your image?

    Thanks

    Bye


  • Rebel Alliance Global Moderator

    That is my freaking VIP…  Its right there in the freaking pictures!!  What do you not get??  Nobody can be this freaking dense.. Your just freaking trolling now...



  • router=10.0.0.1/24
    Firewall=192.168.1.1


    I still can not access the router. Why?