Accessing modem from inside firewall

johnpoz

Why do you have 10.0.0.0/8 on your lan side?? Also why is your LAN connected to Bridge0???

bimmerdriver

My gateway uses a private network address for the management interface. My routers are connected to a bridged port so they don't have visibility of the private network. I wanted to be able to access the gateway, but I was okay with not having it accessible from any computer. I had a spare NIC on the hyper-v server that is hosting the pfsense routers, so I connected it one of the LAN ports on the gateway and bumped up the metric so the route wouldn't be used except to access the private address. I don't think there's any reason why it wouldn't work on any host with dual NICs.

balubeto

Router VDSL2 in Bridge mode: 10.0.0.1
Firewall hardware: 192.168.1.1

I connected the router to the WAN port of the firewall configuring it in this way:

but I can not access the router from the LAN and I have no Internet because the PPPoE client can not connect even if its login is correct. Why?

Thanks

Bye

Derelict

Does your PPPoE work if you get rid of all the modem access junk? Is there anything interesting in the PPP logs? Are you sure the modem is in bridge mode?

After you get PPPoE working again and you go back to trying to access the modem, are you sure it's 10.0.0.0/8 and not 10.0.0.0/24?

balubeto

@Derelict:

Does your PPPoE work if you get rid of all the modem access junk? Is there anything interesting in the PPP logs? Are you sure the modem is in bridge mode?

After you get PPPoE working again and you go back to trying to access the modem, are you sure it's 10.0.0.0/8 and not 10.0.0.0/24?

Why should I put 10.0.0.0/24?

Thanks

Bye

Derelict

Because that's the netmask the cable modem is configured for? I asked if you were sure. I didn't say you should change it.

jahonix

And on your Modem_access Interface you should UNcheck "Block private networks".

johnpoz

How exactly do you think your nat is going to work? You have 10.0.0/8 as dest but you also have it a source for your lan automatic nat, etc.

What I would do is START over!!! delete all that crap.. And why again do you think you need to run a bridge on pfsense?

And I find it highly unlikely your "modem" is using /8 as its mask for its 10 address.. Your status doesn't even show your wan interface up..

balubeto

I noticed that if I enable the Interfaces –-> Modem_access interface and, then, I click on the Connect button on the Status ---> Interfaces, the firewall connects to the Internet but the computers on the LAN have no more Internet. Why?

Thanks

Bye

johnpoz

Prob has something to do with running same 10/8 network on both your wan and lan? Or maybe some nonsense you did with a bridge??

What I would do is start over!! NO freaking bridges… Actually validate what your modem is using for its mask on this 10 address. And then create your interface using that.. And don't use an overlapping network on your lan side, etc.

balubeto

@johnpoz:

Prob has something to do with running same 10/8 network on both your wan and lan? Or maybe some nonsense you did with a bridge??

What I would do is start over!! NO freaking bridges… Actually validate what your modem is using for its mask on this 10 address. And then create your interface using that.. And don't use an overlapping network on your lan side, etc.

Excuse me, but how do I solve my problem?

Thanks

Bye

johnpoz

My gawd dude… I just told you!!

Lets start with basic info number 1... Ok your modem is using a 10.address - what is the mask on that? I find it like impossible to believe it would be /8 so what it /24?

So if its 10.0.0.1/24 then make your interface 10.0.0.2/24

On the lan side of your network - do not use ANY networks that are 10.0.0.0/24 or that would overlap it like 10.0.0.0/8 or /16 or /23 etc.. -- say away from all 10 networks would be my suggestion.

Then create your outbound so when you want to talk to 10.0.0/24 you nat to your 10.0.0.2 address. Using hybrid mode put that outbound nat above your automatic nats.

And don't create any freaking bridges!!! You have ZERO use for them!!

balubeto

@johnpoz:

My gawd dude… I just told you!!

Lets start with basic info number 1... Ok your modem is using a 10.address - what is the mask on that? I find it like impossible to believe it would be /8 so what it /24?

So if its 10.0.0.1/24 then make your interface 10.0.0.2/24

On the lan side of your network - do not use ANY networks that are 10.0.0.0/24 or that would overlap it like 10.0.0.0/8 or /16 or /23 etc.. -- say away from all 10 networks would be my suggestion.

Then create your outbound so when you want to talk to 10.0.0/24 you nat to your 10.0.0.2 address. Using hybrid mode put that outbound nat above your automatic nats.

And don't create any freaking bridges!!! You have ZERO use for them!!

So, can you explain in detail what I have to do to try if your idea works?

Thanks

Bye

johnpoz

How is that not enough detail for you.. .Really?? Do you want me to remote to your system and do it for you?

balubeto

@johnpoz:

How is that not enough detail for you.. .Really?? Do you want me to remote to your system and do it for you?

What are the images that you need to be able to solve my problem?

Thanks

Bye

johnpoz

I already solved your problem multiple times and told you exactly what do for gosh sake…

The info you need is in the access my modem article..
https://doc.pfsense.org/index.php/Accessing_modem_from_inside_firewall

Here are some pictures.. Now I have to use a vip to do this since I am actually using my WAN with a public IP on it.. But you are using pppoe so you would do this via interface actually assigned to your WAN interface.

So my modem uses 192.168.100.1/24 -- I know its a /24 because when it doesn't have a isp connection it hands out IPs via dhcp in 192.168.100.0/24 And doesn't really matter if you have the mask exactly right as long as your not overlapping with your other networks, and your modem and IP on your wan are in the same network.. So use /24!!! is your best option if you do not know for sure what the mask is..

So I create VIP.. You would do it on your wan interface that your calling modem_access.. You then create an outbound nat that says hey when going to that network from your source use this interface address..

You can see me accessing my modem, you can see the states in the state table on pfsense.. What is it that your not understanding here??? Do you not understand how pfsense nats to yoru public network?? Its the SAME freaking thing.. But only to another rfc1918 network..

accessmodem.jpg_thumb

balubeto

@johnpoz:

I already solved your problem multiple times and told you exactly what do for gosh sake…

The info you need is in the access my modem article..
https://doc.pfsense.org/index.php/Accessing_modem_from_inside_firewall

Here are some pictures.. Now I have to use a vip to do this since I am actually using my WAN with a public IP on it.. But you are using pppoe so you would do this via interface actually assigned to your WAN interface.

So my modem uses 192.168.100.1/24 -- I know its a /24 because when it doesn't have a isp connection it hands out IPs via dhcp in 192.168.100.0/24 And doesn't really matter if you have the mask exactly right as long as your not overlapping with your other networks, and your modem and IP on your wan are in the same network.. So use /24!!! is your best option if you do not know for sure what the mask is..

So I create VIP.. You would do it on your wan interface that your calling modem_access.. You then create an outbound nat that says hey when going to that network from your source use this interface address..

You can see me accessing my modem, you can see the states in the state table on pfsense.. What is it that your not understanding here??? Do you not understand how pfsense nats to yoru public network?? Its the SAME freaking thing.. But only to another rfc1918 network..

Which devices are the 192.168.100.2 and 192.168.9.x IPs displayed in your image?

Thanks

Bye

johnpoz

That is my freaking VIP… Its right there in the freaking pictures!! What do you not get?? Nobody can be this freaking dense.. Your just freaking trolling now...

balubeto

router=10.0.0.1/24
Firewall=192.168.1.1

I still can not access the router. Why?

ptt

Because "you're doing it wrong" ! ;)

As pointed/noted before, since you are using PPPoE on WAN, the VIP is NOT needed/necessary….

https://forum.pfsense.org/index.php?topic=118740.msg658480#msg658480

https://forum.pfsense.org/index.php?topic=118740.msg658918#msg658918