Access Back-haul Radios



  • I am trying to setup my pfsense so I can access some backhaul radios that are behind my wan connection. I have setup VIP for the radios and can ping the radios from the pfsense gui but I can't access the radios gui. I am guessing I don't have a nat rule set properly. Here is a network map…Internet come in on ISP modem --PTP Radios 192.168.1.0/24 to Pfsense Wan port---I need to acesss the PTP radios from the Lan network 172.25.8.0/24.. What Nat rule will I need to setup?

    Thanks in advance


  • Rebel Alliance Global Moderator

    So what network is your pfsense wan on?  Is it not on this ptp radios network of 192.168.1/24

    You say you created a vip, so I am thinking your wan is different network or using PPPoE or something?

    If your wan is on a different network, and you you create a vip to be on this network, then you would need to create an outbound nat using the VIP IP so when you devices on your lan network of 127.25.8 try and go to this 192.168.1 network pfsense nats that connection to its 192.168.1 vip.

    If your pfsense wan is on this 192.168.1 network.  The nat would already be in place and you shouldn't have to do anything special.



  • That is the problem…the wan gateway is on a static ip address from the ISP provide.

    So I will need to create a outbound nat from the lan 172.25.8.0/24 to back haul radio network 192.168.1.0/24. Could you outline what nat to use.

    Thanks


  • Rebel Alliance Global Moderator

    So your wan is on some public IP.. How is your P2P network connected to this same interface that pfsense has internet access on?

    Could you draw how this is connected together..  Wouldn't it be better to connect some other network via a different interface on pfsense - or is that how you do have it already?  That is why a drawing is very helpful.

    But if you created a vip on your wan interface, and that interface is connected to this 192.168.1.0/24 network.. you would do like I have attached below.  But you would use your vip you created in your 192.168.1 network vs mine that is the 192.168.100 network that my modem webgui is on.

    So you create your vip as ip alias.

    Then create an outbound nat using your wan interface, and setup the source network your going to nat.. This would be your lan 172 network.  Then when should you nat to this IP, your dest would be the 192.168.1 network.

    Then the translation address click the drop down and pick your VIP you created..  There you go.  In your outbound nat pick hybrid so it uses your manual outbound nats and your automatic nats.. 2nd pic below.






  • Not sure what I am doing wrong but I can't seem to gain access to radio gui…see attached screen shots on setup.







  • Rebel Alliance Global Moderator

    Well you put a mask of /32 on that vip.. That wrong..

    So what IP does your pfsense wan have/get?  Can pfsense ping these 192.168.1 IPs after you create your vip?  It should be able to ping them, if not then no your clients will not be able too.

    But the mask of your vip should mask should match up with the mask of the network these 192.168.1 network is on..



  • Hi All.

    I have read some of the thread to create a new interface on the Wan port that I need to access the radios or modem. My question is how do I create that interface? On PPTs, GGEs, GIFs, Bridges or LAGGs! See attached picture.



  • Rebel Alliance Global Moderator

    Huh??  Where did you read that you need to create a new interface?

    You could create a vlan on one of those interfaces..

    But you don't need to do that, you should only have to create a VIP on the interface that is connected to your p2p setup..



  • I have done everything you have suggested and the only link I think I am missing is that my wan interface that I need to get to the radios to is on the 45.x.x.x gateway that is static from the ISP modem. If I change the radios to the 45.x.x.x address range I can access them from the public side but I don't want to do that for security reasons.

    Any advice would be appreciated.

    Thanks for the feedback so far.


  • Rebel Alliance Global Moderator

    So when you created your vip you put the correct mask on it, not the /32 you had..



  • Yes that was a mistake on my side…I have changed that but I still can't access the radios.


  • Rebel Alliance Global Moderator

    Well lets do some simple troubleshooting.. So sniff on pfsense wan interface.. Do you see it sending the traffic?  Can pfsense once you create the vip ping these IPs?  What is in the arp table.. If it can not find the mac of these devices then no its not going to be able to talk to them..



  • See attached troubleshooting screen shots…...in trace route had to check Use ICMP to get a successful trace. Not sure how to do a sniff....my box is at a different location and scared it stinks there...lol







    ![ARP Table.png](/public/imported_attachments/1/ARP Table.png)
    ![ARP Table.png_thumb](/public/imported_attachments/1/ARP Table.png_thumb)



  • Does anybody have any Ideas what could be the problem? This seems so simple that I am scratching my head…I have 2 more WAN connection where I have no problem connection to the modems from the LAN!!!!!!!!!!...........


  • Rebel Alliance Global Moderator

    you would do a sniff right on pfsense diag, packet capture.

    Dude I though your radio was .41, why are you just pinging your wan address VIP that you created? .40

    If you have this

    modem –- p2p (192.168.1.X) ----- wireless ----- ptp (192.168.1.Y) ---- (192.168.1.Z) pfsense (192.168.0.1) -- lan (192.168.0.2) PC

    Your VIP would be the 192.168.1.Z address, and you would try and ping .x or .y from pfsense.

    You would look in your arp table for the .x and .y address - not your Z address..



  • I can ping the radio from the Pfsense ping Gui and I can do a trace route to all the radios from pfsense but I can't ping from my PC. All the radios are listed in the ARP Table.

    My VIP is 192.168.1.21/24

    I think the problem is in my firewal/nat/outbound rule…see attached.



  • Rebel Alliance Global Moderator

    That looks fine.. My guess since you have multiple wans, that your lan rules are doing policy routing and shoving you out a gateway other than where your trying to get to.

    Post up your lan rules.

    There has to be a rule that allows your traffic to use your normal routing before you get sent down some gateway



  • See attached….My Computers alias is the PC that I am using to try to access the Radios.



  • Rebel Alliance Global Moderator

    So dude that rule my computers is forcing traffic out your wan gateway.. That is your public connection, so no it would not be able to use your vip..

    You need a rule above that for my computers that allows it to go to your 192.168 network your PtP stuff.  That rules says hey anything in my computer no matter where its going shove it down the wan2axiaGW..

    Rules are top down, first rule to fire wins, no other rules are evaluated..


  • Netgate

    Sounds like a perfect use case for a management VLAN for those radios. That's what I would probably do (if they support it.)



  • They do support clan, I am using ubiquiti power beam m5.

    Could you outline on how to setup a vlan in pfsense to the radios?

    Thanks


  • Netgate

    Depends on what they support. Is the normal traffic tagged or untagged. Is that management VLAN tagged or untagged? What is a clan?


  • Rebel Alliance Global Moderator

    I think he meant vlan ;) not sure he would be talking about a collapsed lan ;)

    So did you get it working once you fixed your rules?



  • I need to set a gateway out to the 192.168.1.x/24 but not sure how to get that done…

    Please explain...thanks


  • Rebel Alliance Global Moderator

    Why do you need a gateway?  Once you create a vip in the network the p2p address are on, and you nat to that vip.

    You said you can ping the p2p IPs from pfsense.  So your vip is working, you create the nat so when your clients go there pfsense nats it to its vip.  Your p2p clients think your talking to them from an IP on their network.

    Problem I saw as that your lan rules were not going to allow your clients to use the vip, since forcing it down the the gateway.  Just put a rule above that that allows access to that p2p network.



  • Not sure if this is correct. I tried this and it doesn't work…. see attached



  • Rebel Alliance Global Moderator

    and is that rule at the top?



  • Yes see attached….



  • Rebel Alliance Global Moderator

    Why is the gear showing on that rule?  That means you messed with the advanced setion of the rules.  So see hits to it..  So sniff on your wan when you try and connect do you see your traffic going out?


  • Netgate

    Yeah. Mouse over that gear on the bypass policy routing rule. Why is that there?

    What are your current outbound NAT rules?



  • The gear was there because I had a In and Out Limit…I have removed that...see attached




  • I got it going…..here are the rules that got me there.

    Thanks guys for all the help....see attached






  • And I also had to add a VIP on the 192.168.1.x/24 network.

    Hope this helps somebody else.


  • Netgate

    Yeah. johnpoz said that in #3.


  • Rebel Alliance Global Moderator

    Actually Derelict.. Lets see stated multiple times to create a vip in reply #1, then again in #3 and then #5 and then #7 and then #14…. that was just on the first page ;)

    And then reported on this page 3 of the thread that he has his mask wrong on his vip.. he had a /32, etc..

    Got to love how a 15 second thing to do runs into days and days ;)  Really all that was need to do was given in my reply #1

    If he wasn't forcing traffic out a gateway this would of been working days ago..

    edit: 3 pages of trying to help this guy, not 1 thank you.. And then from his last post he makes it like we never told him to create a vip hehehe  Got to love it...

    Why would you create ind rules like that?  Why would you not just use an alias or /cidr dest?



  • The last post that you did johnpoz where I have the gateway not correct did the trick…..I hade the VIP set correct after you 1st post....

    Thanks a lot guys....I will say it again Thanks, Thanks Thanks johnpoz

    You got to like newbies.....but one day I know I will be able to contribute to this forum.