Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    [SOLVED] access between two networks

    Scheduled Pinned Locked Moved Firewalling
    24 Posts 4 Posters 2.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • V
      vocal
      last edited by

      As I said before :

      @vocal:

      In desparate act, I have disabled all rules for captive portal and just on top (only one rule) I have put

      OPT1 : 
      Protocol Source Port Destination Port Gateway
      IPv4 *      *              *      *                      *      *                  pass

      LAN:
      Protocol Source Port Destination Port Gateway
      IPv4*        *              *      *                      *      *              pass

      and  still cannot access  OPT1 from LAN

      basically I should access everything from anywhere with above rules but not OPT1 devices from LAN
      I even cannot ping it.
      When I add allowed MACs in CP then Im able to access it but guests are not going trough CP as APs are allowed without auth

      My settings are:

      WAN - static IP from multiwan router
      LAN - Business network with static IP, no DHCP server
      OPT1 - guest WiFi, DHCP server 192.168.0.1/22 GTW  192.168.2.1

      All devices (APs and managed switches) are in 192.168.1.1 network.
      OPT1 DHCP - 192.168.2.2 - 192.168.3.254

      Im running captive portal with freeradius on OPT1

      I had pfBlocker installed earlier on but uninstalled it already. Maybe it left something in pfS config?

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        "as APs are allowed without auth"

        What does that have to do with clients of your AP?

        Unless you were doing a wireless router with natting, your clients mac would not be the same as your AP..

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • V
          vocal
          last edited by

          indeed its confusing…
          as soon as I allowed APs MACs on CP, all guests could log withouth auth.
          All was working on previous server but I decided to go with pfSense.
          Probably Im making silly mistake but really no clue what.
          However I will keep trying :)

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            You will not be able to access anything in the portal network unless they are somehow passed through the portal. A MAC address passthrough will accomplish that.

            Having devices that need management behind the CP is only going to cause you pain and suffering. Put the management interfaces of the managed devices on a management network. Tag the guest traffic to be on the network with the portal.

            It also sounds like you are using routers for wireless and not true access points. In that case your CP will never work correctly because you will never see the users' IP addresses and MAC addresses because the AP/Router is performing NAT. The first user will get prompted for authentication and all subsequent users will not because the CP will have the AP/Router's IP and MAC address in its user table.

            You need a serious redesign, a better understanding of exactly what Captive Portals actually do, and probably some new gear to accomplish what you want to do.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by

              ^ exactly!!!  What devices are using use for AP?  And what exactly are you wanting to accomplish with your CP?

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • V
                vocal
                last edited by

                Im using tp-link wdr3600 with dd-wrt installed
                No NAT, no firewall, no wifi pass. Just transparent.

                Im using netgear gs724 switches. I have two VLANs. Bussines and guests, all works fine

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  Except it is not working fine. That's why you're here asking why it's not working fine.

                  This is simple. If adding the AP/Router's MAC address to a MAC address pass through passes all guest traffic, then the CP is not seeing the IP/MAC address of the wireless client, but that of the AP/Router because it is performing NAT.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • V
                    vocal
                    last edited by

                    I've done some more tests. I can ping OPT1 from LAN, but only devices which have DHCP IP assigned by OPT1 DHCP server. My APs have static IP.

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      "My APs have static IP. "

                      And do your AP have a gateway setup pointing back to pfsense opt1 IP?

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • V
                        vocal
                        last edited by

                        yes they have

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          Well then then sniff on your opt interface… When you ping the AP.. Doe you see it go out to their mac, do you not see a reply?

                          You sure your AP have the correct mask setup.. If your saying you can talk to boxes with dhcp.. Then points to a problem with what you set for their static, like no gateway which you say they have.  So maybe you messed up the mask, etc.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • V
                            vocal
                            last edited by

                            Got it!!!
                            finally

                            Machine I was testing it from, was using IPv6, and I have blocked IPv6 lol
                            Other machine works fine.
                            However I still don't understand why all those strange things was happening.

                            Now, I have normal firewall rules (as I want), normal config, etc and all works fine

                            thanks for pointing me to the right direction :)

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.