[SOLVED] access between two networks

DarkSky · Apr 14, 2017, 7:59 AM

Something like this? I have no CP set. Just need the rules to be created.

From LAN to OPT1 (called WIFI in my case):

Proto:TCP, Source:ANY, Port:ANY, Dest.:WIFI net, Port:ANY, Gateway:ANY, Description: Permit LAN to OPT1.

From OPT1 to LAN:

Proto:TCP, source:ANY, Port:ANY, Dest.:LAN net, Port:ANY, Gateway:ANY, Description: Permit OPT1 to LAN.

![Sans titre.jpg_thumb](/public/imported_attachments/1/Sans titre.jpg_thumb)
![Sans titre.jpg](/public/imported_attachments/1/Sans titre.jpg)

johnpoz · Apr 14, 2017, 10:37 AM

you do understand those rules are TCP only.. So you are not going to be able to ping (icmp).. Wouldn't be able to use dns, which is UDP..

What are the other rules… Always show the whole listing of rules.. Rules are evaluated top down, first rule to trigger wins, no other rules are evaluated.. So unless your showing use the top rule on the interface - and that allows what you want.. For all we know you have a block above that, or if nothing below that for example your devices on a specific interface wouldn't be able to ask pfsense for dns even, etc..

vocal · Apr 14, 2017, 12:40 PM

As I said before :

@vocal:

In desparate act, I have disabled all rules for captive portal and just on top (only one rule) I have put

OPT1 :
Protocol Source Port Destination Port Gateway
IPv4 * * * * * * pass

LAN:
Protocol Source Port Destination Port Gateway
IPv4* * * * * * pass

and still cannot access OPT1 from LAN

basically I should access everything from anywhere with above rules but not OPT1 devices from LAN
I even cannot ping it.
When I add allowed MACs in CP then Im able to access it but guests are not going trough CP as APs are allowed without auth

My settings are:

WAN - static IP from multiwan router
LAN - Business network with static IP, no DHCP server
OPT1 - guest WiFi, DHCP server 192.168.0.1/22 GTW 192.168.2.1

All devices (APs and managed switches) are in 192.168.1.1 network.
OPT1 DHCP - 192.168.2.2 - 192.168.3.254

Im running captive portal with freeradius on OPT1

I had pfBlocker installed earlier on but uninstalled it already. Maybe it left something in pfS config?

johnpoz · Apr 14, 2017, 3:20 PM

"as APs are allowed without auth"

What does that have to do with clients of your AP?

Unless you were doing a wireless router with natting, your clients mac would not be the same as your AP..

vocal · Apr 14, 2017, 3:31 PM

indeed its confusing…
as soon as I allowed APs MACs on CP, all guests could log withouth auth.
All was working on previous server but I decided to go with pfSense.
Probably Im making silly mistake but really no clue what.
However I will keep trying :)

Derelict · Apr 14, 2017, 4:59 PM

You will not be able to access anything in the portal network unless they are somehow passed through the portal. A MAC address passthrough will accomplish that.

Having devices that need management behind the CP is only going to cause you pain and suffering. Put the management interfaces of the managed devices on a management network. Tag the guest traffic to be on the network with the portal.

It also sounds like you are using routers for wireless and not true access points. In that case your CP will never work correctly because you will never see the users' IP addresses and MAC addresses because the AP/Router is performing NAT. The first user will get prompted for authentication and all subsequent users will not because the CP will have the AP/Router's IP and MAC address in its user table.

You need a serious redesign, a better understanding of exactly what Captive Portals actually do, and probably some new gear to accomplish what you want to do.

johnpoz · Apr 14, 2017, 5:21 PM

^ exactly!!! What devices are using use for AP? And what exactly are you wanting to accomplish with your CP?

vocal · Apr 14, 2017, 5:30 PM

Im using tp-link wdr3600 with dd-wrt installed
No NAT, no firewall, no wifi pass. Just transparent.

Im using netgear gs724 switches. I have two VLANs. Bussines and guests, all works fine

Derelict · Apr 14, 2017, 5:32 PM

Except it is not working fine. That's why you're here asking why it's not working fine.

This is simple. If adding the AP/Router's MAC address to a MAC address pass through passes all guest traffic, then the CP is not seeing the IP/MAC address of the wireless client, but that of the AP/Router because it is performing NAT.

vocal · Apr 14, 2017, 5:39 PM

I've done some more tests. I can ping OPT1 from LAN, but only devices which have DHCP IP assigned by OPT1 DHCP server. My APs have static IP.

johnpoz · Apr 14, 2017, 5:56 PM

"My APs have static IP. "

And do your AP have a gateway setup pointing back to pfsense opt1 IP?

vocal · Apr 14, 2017, 6:00 PM

yes they have

johnpoz · Apr 14, 2017, 6:02 PM

Well then then sniff on your opt interface… When you ping the AP.. Doe you see it go out to their mac, do you not see a reply?

You sure your AP have the correct mask setup.. If your saying you can talk to boxes with dhcp.. Then points to a problem with what you set for their static, like no gateway which you say they have. So maybe you messed up the mask, etc.

vocal · Apr 14, 2017, 6:53 PM

Got it!!!
finally

Machine I was testing it from, was using IPv6, and I have blocked IPv6 lol
Other machine works fine.
However I still don't understand why all those strange things was happening.

Now, I have normal firewall rules (as I want), normal config, etc and all works fine

thanks for pointing me to the right direction :)