Access Back-haul Radios

hotshottech

I am trying to setup my pfsense so I can access some backhaul radios that are behind my wan connection. I have setup VIP for the radios and can ping the radios from the pfsense gui but I can't access the radios gui. I am guessing I don't have a nat rule set properly. Here is a network map…Internet come in on ISP modem --PTP Radios 192.168.1.0/24 to Pfsense Wan port---I need to acesss the PTP radios from the Lan network 172.25.8.0/24.. What Nat rule will I need to setup?

Thanks in advance

johnpoz

So what network is your pfsense wan on? Is it not on this ptp radios network of 192.168.1/24

You say you created a vip, so I am thinking your wan is different network or using PPPoE or something?

If your wan is on a different network, and you you create a vip to be on this network, then you would need to create an outbound nat using the VIP IP so when you devices on your lan network of 127.25.8 try and go to this 192.168.1 network pfsense nats that connection to its 192.168.1 vip.

If your pfsense wan is on this 192.168.1 network. The nat would already be in place and you shouldn't have to do anything special.

hotshottech

That is the problem…the wan gateway is on a static ip address from the ISP provide.

So I will need to create a outbound nat from the lan 172.25.8.0/24 to back haul radio network 192.168.1.0/24. Could you outline what nat to use.

Thanks

johnpoz

So your wan is on some public IP.. How is your P2P network connected to this same interface that pfsense has internet access on?

Could you draw how this is connected together.. Wouldn't it be better to connect some other network via a different interface on pfsense - or is that how you do have it already? That is why a drawing is very helpful.

But if you created a vip on your wan interface, and that interface is connected to this 192.168.1.0/24 network.. you would do like I have attached below. But you would use your vip you created in your 192.168.1 network vs mine that is the 192.168.100 network that my modem webgui is on.

So you create your vip as ip alias.

Then create an outbound nat using your wan interface, and setup the source network your going to nat.. This would be your lan 172 network. Then when should you nat to this IP, your dest would be the 192.168.1 network.

Then the translation address click the drop down and pick your VIP you created.. There you go. In your outbound nat pick hybrid so it uses your manual outbound nats and your automatic nats.. 2nd pic below.

outboundnatnetworkonwan.jpg_thumb

hybridoutboundnats.jpg_thumb

hotshottech

Not sure what I am doing wrong but I can't seem to gain access to radio gui…see attached screen shots on setup.

Poast3.png_thumb

Post1.png_thumb

Post2.png_thumb

johnpoz

Well you put a mask of /32 on that vip.. That wrong..

So what IP does your pfsense wan have/get? Can pfsense ping these 192.168.1 IPs after you create your vip? It should be able to ping them, if not then no your clients will not be able too.

But the mask of your vip should mask should match up with the mask of the network these 192.168.1 network is on..

hotshottech

Hi All.

I have read some of the thread to create a new interface on the Wan port that I need to access the radios or modem. My question is how do I create that interface? On PPTs, GGEs, GIFs, Bridges or LAGGs! See attached picture.

post3.png_thumb

johnpoz

Huh?? Where did you read that you need to create a new interface?

You could create a vlan on one of those interfaces..

But you don't need to do that, you should only have to create a VIP on the interface that is connected to your p2p setup..

hotshottech

I have done everything you have suggested and the only link I think I am missing is that my wan interface that I need to get to the radios to is on the 45.x.x.x gateway that is static from the ISP modem. If I change the radios to the 45.x.x.x address range I can access them from the public side but I don't want to do that for security reasons.

Any advice would be appreciated.

Thanks for the feedback so far.

johnpoz

So when you created your vip you put the correct mask on it, not the /32 you had..

hotshottech

Yes that was a mistake on my side…I have changed that but I still can't access the radios.

johnpoz

Well lets do some simple troubleshooting.. So sniff on pfsense wan interface.. Do you see it sending the traffic? Can pfsense once you create the vip ping these IPs? What is in the arp table.. If it can not find the mac of these devices then no its not going to be able to talk to them..

hotshottech

See attached troubleshooting screen shots…...in trace route had to check Use ICMP to get a successful trace. Not sure how to do a sniff....my box is at a different location and scared it stinks there...lol

trouble1.png_thumb

trouble2.png_thumb

trouble3.png_thumb
![ARP Table.png](/public/imported_attachments/1/ARP Table.png)
![ARP Table.png_thumb](/public/imported_attachments/1/ARP Table.png_thumb)

hotshottech

Does anybody have any Ideas what could be the problem? This seems so simple that I am scratching my head…I have 2 more WAN connection where I have no problem connection to the modems from the LAN!!!!!!!!!!...........

johnpoz

you would do a sniff right on pfsense diag, packet capture.

Dude I though your radio was .41, why are you just pinging your wan address VIP that you created? .40

If you have this

modem –- p2p (192.168.1.X) ----- wireless ----- ptp (192.168.1.Y) ---- (192.168.1.Z) pfsense (192.168.0.1) -- lan (192.168.0.2) PC

Your VIP would be the 192.168.1.Z address, and you would try and ping .x or .y from pfsense.

You would look in your arp table for the .x and .y address - not your Z address..

hotshottech

I can ping the radio from the Pfsense ping Gui and I can do a trace route to all the radios from pfsense but I can't ping from my PC. All the radios are listed in the ARP Table.

My VIP is 192.168.1.21/24

I think the problem is in my firewal/nat/outbound rule…see attached.

post4.png_thumb

johnpoz

That looks fine.. My guess since you have multiple wans, that your lan rules are doing policy routing and shoving you out a gateway other than where your trying to get to.

Post up your lan rules.

There has to be a rule that allows your traffic to use your normal routing before you get sent down some gateway

hotshottech

See attached….My Computers alias is the PC that I am using to try to access the Radios.

post5.png_thumb

johnpoz

So dude that rule my computers is forcing traffic out your wan gateway.. That is your public connection, so no it would not be able to use your vip..

You need a rule above that for my computers that allows it to go to your 192.168 network your PtP stuff. That rules says hey anything in my computer no matter where its going shove it down the wan2axiaGW..

Rules are top down, first rule to fire wins, no other rules are evaluated..

Derelict

Sounds like a perfect use case for a management VLAN for those radios. That's what I would probably do (if they support it.)