Accessing modem from inside firewall

balubeto · Sep 25, 2016, 10:11 AM

Hi

I read the guide https://doc.pfsense.org/index.php/Accessing_modem_from_inside_firewall and it seems to me that there is a mismatch:

In the first part, it indicates that the modem must have a different subnet from the LAN: So if, for example, the LAN belongs to class C, the modem may belong to class A.

While, in the second part, it indicates that their subnet should be the same.

I am wrong?

Thanks

Bye

Derelict · Sep 25, 2016, 11:14 AM

You need to have a VIP on LAN on the same subnet as the modem and NAT out that VIP when the destination is the modem so it doesn't have to have a route back to you (since it won't have one)

balubeto · Sep 25, 2016, 4:09 PM

@Derelict:

You need to have a VIP on LAN on the same subnet as the modem and NAT out that VIP when the destination is the modem so it doesn't have to have a route back to you (since it won't have one)

Excuse me but what is a VIP?

Thanks

Bye

ptt · Sep 25, 2016, 4:29 PM

@balubeto:

Excuse me but what is a VIP?

https://doc.pfsense.org/index.php/What_are_Virtual_IP_Addresses

balubeto · Sep 28, 2016, 4:20 PM

I have a VDSL2 router (10.0.0.1) in bridge mode connected to the WAN port on a hardware firewall (192.168.1.1) which manages the Internet connection using the PPPoE.

Since the WAN interface of the firewall is become a virtual adapter PPPoE-WAN, associated with the re2 physical interface, I assigned the re2 physical interface and I set it to 10.0.0.2.

Now, what are the rules that I will have to create in the Virtual IP and NAT sections to make sure that I am able to access the web interface of the router?

I've been using pfSense 2.3.2 64 bit.

Thanks

Bye

balubeto · Sep 28, 2016, 7:30 AM

I'm still waiting for your answer.

Thanks

Bye

johnpoz · Sep 28, 2016, 9:52 AM

"I have a VDSL2 router (10.0.0.1)"
"I assigned the re2 physical interface and I set it to 10.0.0.1"

How do you expect that to work?? Just curious… Do you mean you set re2 to 10.0.0.2?

So what do you think you should do for nat, if your wanting to talk to a client on a 10 network on your wan interface that has no gateway and doesn't understand how to get to your 192.168 network on your lan?? Hint if you "nat" your 192.168 traffic to look like its coming from a 10 address, then your "router" will no how to talk back ;)

balubeto · Sep 28, 2016, 5:59 PM

@johnpoz:

"I have a VDSL2 router (10.0.0.1)"
"I assigned the re2 physical interface and I set it to 10.0.0.1"

How do you expect that to work?? Just curious… Do you mean you set re2 to 10.0.0.2?

So what do you think you should do for nat, if your wanting to talk to a client on a 10 network on your wan interface that has no gateway and doesn't understand how to get to your 192.168 network on your lan?? Hint if you "nat" your 192.168 traffic to look like its coming from a 10 address, then your "router" will no how to talk back ;)

I was wrong to write: the re2 physical interface has the IP 1.0.0.2.

With these settings, it is possible to reach my goal? If so, how should I do? If not, what are the addresses of the router and re2 interface appropriate for do this?

Thanks

Bye

balubeto · Sep 29, 2016, 4:14 PM

Sorry but there is someone willing to help me?

Thanks

Bye

johnpoz · Sep 29, 2016, 4:36 PM

So create an outbound nat using the vip you created of 10.0.0.2 - do you need a picture?

balubeto · Sep 29, 2016, 5:50 PM

@johnpoz:

So create an outbound nat using the vip you created of 10.0.0.2 - do you need a picture?

How should I fill out this window:

?

Thanks

Bye

ptt · Sep 29, 2016, 11:33 PM

This is how i have it done…. No "VIP" here...

ADSL Modem in "Bridge" with 172.20.254.1/29 IP address

pfSense WAN PPPoE (re1)

Modem Access Interface "GEST" (means: "gestión" = management) ;) (re1) with 172.20.254.6/29 IP address

The rest of the info, in the attached images ;)

balubeto · Sep 30, 2016, 7:51 AM

@ptt:

This is how i have it done…. No "VIP" here...

ADSL Modem in "Bridge" with 172.20.254.1/29 IP address

pfSense WAN PPPoE (re1)

Modem Access Interface "GEST" (means: "gestión" = management) ;) (re1) with 172.20.254.6/29 IP address

The rest of the info, in the attached images ;)

I can not understand the 003 image. What rules should I add?

Thanks

Bye

johnpoz · Sep 30, 2016, 9:43 AM

Good catch ptt, no you do not need a vip if your NOT using the wan interface IP I guess. Good catch that his wan is actually PPPoE. I was over looking that.

But I would not suggest manual mode for the outbound nat, just use hybrid and add the nat for interface that is connected to your modem.

This is really no different than using a vip, but since your really not actually using the IP that is on your physical interface connected to your modem, you can just set the IP right on the interface and no need for a vip.

Derelict · Sep 30, 2016, 3:20 PM

Yeah PPPoE is done differently. That writeup has you putting the IP subnet of the modem on the physical interface the PPPoE is on. No VIPs there.

balubeto · Oct 2, 2016, 11:02 AM

I can not understand the 003 image. What rules should I add?

Thanks

Bye

johnpoz · Oct 2, 2016, 11:15 AM

that is not a rule.. That is the actual interface connected to the modem.. Just putting an IP address on it that matches with the IP address of the modems IP.

ptt · Oct 2, 2016, 1:40 PM

You create & configure the "Interface" for modem access (GEST in my case)

then, as John pointed, you set the NAT as "Hybrid"

now, you create the NAT Rule (Mapping) to access the Modem…

That's all..

balubeto · Oct 2, 2016, 5:39 PM

Firewall 192.168.1.1
Router 10.0.0.1

I configured the router in bridge mode and have configured the firewall in this way

When I connect my router to the WAN port on the firewall, I can't access the router. Where did a mistake?

Thank you,

Bye

ptt · Oct 2, 2016, 6:01 PM

Your NAT setting is wrong …. Set/leave it as "Hybrid Outbound NAT"

![Your NAT is wrong.jpg](/public/imported_attachments/1/Your NAT is wrong.jpg)
![Your NAT is wrong.jpg_thumb](/public/imported_attachments/1/Your NAT is wrong.jpg_thumb)