• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

[SOLVED] access between two networks

Scheduled Pinned Locked Moved Firewalling
24 Posts 4 Posters 1.8k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • V
    vocal
    last edited by Apr 14, 2017, 6:59 PM Apr 12, 2017, 3:30 PM

    Hello,
    I have 3 NICs, WAN LAN and OPT1. I have only standard firewall settings for captive portal and all works fine but I need to have some access between LAN and OPT1. I have tried to set up rule for LAN to accept traffic from OPT1 and rule for OPT1 to accept traffic from LAN (also the other way round). At the same time I have disabled standard rule for blocking traffic between networks but it doesnt work. I have checked firewall logs but nothing in there so I dont know what Im doing wrong.

    1 Reply Last reply Reply Quote 0
    • J
      johnpoz LAYER 8 Global Moderator
      last edited by Apr 12, 2017, 4:15 PM

      post your rules please.

      Rules are always evaluated as traffic enters the firewall interface, top down, first rule to trigger wins no other rules are evaluated.

      Problem that is common is if your doing any policy routing, ie sending clients on your lan out a specific gateway - say a vpn service.  Your rules that allow traffic to opt1 on the lan interface for for what you want to allow need to be above any rule that sends traffic out any specific gateway.

      Easy thing is post your rules for your lan and opt1 interfaces and let us know what you want to allow.  Also keep in mind another common issue is software firewalls running on the devices your trying to access blocking access from any IP other than their local network.

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

      1 Reply Last reply Reply Quote 0
      • V
        vocal
        last edited by Apr 12, 2017, 4:57 PM

        In desparate act, I have disabled all rules for captive portal and just on top (only one rule) I have put

        OPT1 : 
        Protocol Source Port Destination Port Gateway
        IPv4 *      *              *      *                      *      *                  pass

        LAN:
        Protocol Source Port Destination Port Gateway
        IPv4*        *              *      *                      *      *              pass

        and  still cannot access  OPT1 from LAN

        1 Reply Last reply Reply Quote 0
        • J
          johnpoz LAYER 8 Global Moderator
          last edited by Apr 12, 2017, 5:04 PM

          Well then that points to issue with software firewall on the devices your trying to access from the other network.

          Or just plain connectivity issue completely on the devices your testing with, or they are pointing to something other than pfsense as their gateway.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

          1 Reply Last reply Reply Quote 0
          • V
            vocal
            last edited by Apr 13, 2017, 4:20 PM

            I have few different devices on OPT1 and all of them are responding while accessing from OPT1. However you have pointed me to right direction, and instead of playing with firewall rules, I started checking other options. Finally, when I add MAC address (of the device I want to acces) to captive portal allowed MACs, then I can access OPT1 device from LAN. Does it mean, that static IPs cannot be accessed across networks? Did I miss something?

            1 Reply Last reply Reply Quote 0
            • J
              johnpoz LAYER 8 Global Moderator
              last edited by Apr 13, 2017, 4:47 PM

              well if your using a captive portal that could cause you problems.  Have to know what your captive portal settings are and are you clients not authing to it then no they wouldn't be able to access anything.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

              1 Reply Last reply Reply Quote 0
              • D
                Derelict LAYER 8 Netgate
                last edited by Apr 13, 2017, 6:38 PM

                Split DNSBL conversation here: https://forum.pfsense.org/index.php?topic=128978.0

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • V
                  vocal
                  last edited by Apr 13, 2017, 9:27 PM

                  My settings are:

                  WAN - static IP from multiwan router
                  LAN - Business network with static IP, no DHCP server
                  OPT1 - guest WiFi, DHCP server 192.168.0.1/22

                  Im running captive portal with freeradius on OPT1 and wanted to access all APs and switches on OPT1 from LAN. At the same time I don't want guests to be able to access any AP or switch.

                  1 Reply Last reply Reply Quote 0
                  • D
                    Derelict LAYER 8 Netgate
                    last edited by Apr 13, 2017, 9:30 PM

                    Then you are going to need a management network/VLAN for the devices on OPT1.

                    Typically you would put the APs and switches on LAN (or a dedicated management/trusted network), then tag the guest VLAN on the guest SSID and switch ports.

                    Your firewall cannot prevent something on the guest network from accessing something else on the guest network. That has to be done at layer 2 (switches, AP Radio chipsets).

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • V
                      vocal
                      last edited by Apr 13, 2017, 9:54 PM

                      But it still doesn't answer my question why I cannot access OPT1 devices from LAN. As I said, when I add allowed MAC address (of AP) in captive portal settings, then I can log on it (AP) but then, guests logged via this AP dont go trough CP.

                      1 Reply Last reply Reply Quote 0
                      • D
                        DarkSky
                        last edited by Apr 14, 2017, 7:59 AM Apr 14, 2017, 7:50 AM

                        Something like this? I have no CP set. Just need the rules to be created.

                        From LAN to OPT1 (called WIFI in my case):

                        • Proto:TCP, Source:ANY, Port:ANY, Dest.:WIFI net, Port:ANY, Gateway:ANY, Description: Permit LAN to OPT1.

                        From OPT1 to LAN:

                        • Proto:TCP, source:ANY, Port:ANY, Dest.:LAN net, Port:ANY, Gateway:ANY, Description: Permit OPT1 to LAN.

                        ![Sans titre.jpg_thumb](/public/imported_attachments/1/Sans titre.jpg_thumb)
                        ![Sans titre.jpg](/public/imported_attachments/1/Sans titre.jpg)

                        1 Reply Last reply Reply Quote 0
                        • J
                          johnpoz LAYER 8 Global Moderator
                          last edited by Apr 14, 2017, 10:37 AM

                          you do understand those rules are TCP only.. So you are not going to be able to ping (icmp)..  Wouldn't be able to use dns, which is UDP..

                          What are the other rules… Always show the whole listing of rules.. Rules are evaluated top down, first rule to trigger wins, no other rules are evaluated.. So unless your showing use the top rule on the interface - and that allows what you want.. For all we know you have a block above that, or if nothing below that for example your devices on a specific interface wouldn't be able to ask pfsense for dns even, etc..

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                          1 Reply Last reply Reply Quote 0
                          • V
                            vocal
                            last edited by Apr 14, 2017, 12:40 PM

                            As I said before :

                            @vocal:

                            In desparate act, I have disabled all rules for captive portal and just on top (only one rule) I have put

                            OPT1 : 
                            Protocol Source Port Destination Port Gateway
                            IPv4 *      *              *      *                      *      *                  pass

                            LAN:
                            Protocol Source Port Destination Port Gateway
                            IPv4*        *              *      *                      *      *              pass

                            and  still cannot access  OPT1 from LAN

                            basically I should access everything from anywhere with above rules but not OPT1 devices from LAN
                            I even cannot ping it.
                            When I add allowed MACs in CP then Im able to access it but guests are not going trough CP as APs are allowed without auth

                            My settings are:

                            WAN - static IP from multiwan router
                            LAN - Business network with static IP, no DHCP server
                            OPT1 - guest WiFi, DHCP server 192.168.0.1/22 GTW  192.168.2.1

                            All devices (APs and managed switches) are in 192.168.1.1 network.
                            OPT1 DHCP - 192.168.2.2 - 192.168.3.254

                            Im running captive portal with freeradius on OPT1

                            I had pfBlocker installed earlier on but uninstalled it already. Maybe it left something in pfS config?

                            1 Reply Last reply Reply Quote 0
                            • J
                              johnpoz LAYER 8 Global Moderator
                              last edited by Apr 14, 2017, 3:20 PM Apr 14, 2017, 3:16 PM

                              "as APs are allowed without auth"

                              What does that have to do with clients of your AP?

                              Unless you were doing a wireless router with natting, your clients mac would not be the same as your AP..

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                              1 Reply Last reply Reply Quote 0
                              • V
                                vocal
                                last edited by Apr 14, 2017, 3:31 PM

                                indeed its confusing…
                                as soon as I allowed APs MACs on CP, all guests could log withouth auth.
                                All was working on previous server but I decided to go with pfSense.
                                Probably Im making silly mistake but really no clue what.
                                However I will keep trying :)

                                1 Reply Last reply Reply Quote 0
                                • D
                                  Derelict LAYER 8 Netgate
                                  last edited by Apr 14, 2017, 4:59 PM Apr 14, 2017, 4:47 PM

                                  You will not be able to access anything in the portal network unless they are somehow passed through the portal. A MAC address passthrough will accomplish that.

                                  Having devices that need management behind the CP is only going to cause you pain and suffering. Put the management interfaces of the managed devices on a management network. Tag the guest traffic to be on the network with the portal.

                                  It also sounds like you are using routers for wireless and not true access points. In that case your CP will never work correctly because you will never see the users' IP addresses and MAC addresses because the AP/Router is performing NAT. The first user will get prompted for authentication and all subsequent users will not because the CP will have the AP/Router's IP and MAC address in its user table.

                                  You need a serious redesign, a better understanding of exactly what Captive Portals actually do, and probably some new gear to accomplish what you want to do.

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by Apr 14, 2017, 5:21 PM

                                    ^ exactly!!!  What devices are using use for AP?  And what exactly are you wanting to accomplish with your CP?

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                    1 Reply Last reply Reply Quote 0
                                    • V
                                      vocal
                                      last edited by Apr 14, 2017, 5:30 PM

                                      Im using tp-link wdr3600 with dd-wrt installed
                                      No NAT, no firewall, no wifi pass. Just transparent.

                                      Im using netgear gs724 switches. I have two VLANs. Bussines and guests, all works fine

                                      1 Reply Last reply Reply Quote 0
                                      • D
                                        Derelict LAYER 8 Netgate
                                        last edited by Apr 14, 2017, 5:32 PM

                                        Except it is not working fine. That's why you're here asking why it's not working fine.

                                        This is simple. If adding the AP/Router's MAC address to a MAC address pass through passes all guest traffic, then the CP is not seeing the IP/MAC address of the wireless client, but that of the AP/Router because it is performing NAT.

                                        Chattanooga, Tennessee, USA
                                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                        1 Reply Last reply Reply Quote 0
                                        • V
                                          vocal
                                          last edited by Apr 14, 2017, 5:39 PM

                                          I've done some more tests. I can ping OPT1 from LAN, but only devices which have DHCP IP assigned by OPT1 DHCP server. My APs have static IP.

                                          1 Reply Last reply Reply Quote 0
                                          20 out of 24
                                          • First post
                                            20/24
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received