Unable to access a host on another subnet but can from pfSense [SOLVED]



  • I have pretty much a standard vanilla home setup WAN/ LAN1 /LAN2 which works, as I can access the internet from each LAN subset.
    However I cannot access my host on LAN2 from LAN1.

    192.168.0.3 –> 192.168.1.2:80  ===> , however I can ping it from pfSense 192.168.1.2 OK

    Setup:
    LAN1: 192.168.0.0/29  - Rule: Protocol: IPv4+6/Source: LAN1 */Port: * / Dest: */Port: * / Gateway: * /Queue: none
    LAN2: 192.168.1.0/28 -  Rule: Protocol: IPv4+6/Source: */Port: * / Dest: */Port: * / Gateway: * /Queue: none

    I am new to this so am obviously missing something basic. :-[.

    Any help would be much appreciated, thank you.


  • LAYER 8 Netgate

    Probably a firewall local to 192.168.1.2 (think along the lines of windows firewall) blocking access from other than it's local subnet.



  • Interesting thought …

    This host is actually a simple Access point router which provides WAN access via its WiFi to my tablet, phone etc and it works OK. Also I can obviously access it's port 80 from LAN2. Firewall and NAT are switched off.

    The problem is that I cannot see the connection coming trough in Status> System> Logs> Firewall> Normal View.

    Am I looking in the wrong place?


  • LAYER 8 Netgate

    That will normally only show blocks. If you want to examine active connections you probably want Diagnostics > States.

    Or to troubleshoot state establishment, Diagnostics > Packet Capture.

    It could also be that the "AP" does not, itself, have a default gateway set.



  • Those can have a setting called "AP Isolation" or something basically acts like a firewall.  Find it if its there and turn it off.



  • @Derelict
    Thank you - What I found in there is this:

    192.168.1.2:64267 (192.168.0.3:64267) -> 192.168.1.2:80 SYN_SENT:CLOSED 3 / 0 152 B / 0 B

    I am still searching now to see what this means.

    @kejianshi
    I have specifically switched of the Firewall and NAT and the gateway inside the AP is set to 192.168.1.2.



  • What kind of AP are you using?



  • It's BrightBox2.

    Fortunately, this router has a specific option to switch off NAT & Firewall. (which may not work  :-)
    I also switched off its DHCP, as I am using the one in pfSence for the LAN 2 interface.

    The option to set the AP gateway is in its DHCP section, as I think on most routers.



  • A very good spot both thank you!!

    I added another Web sever, this time a PC, and the request went trough with no issues from LAN1 to LAN2.
    So the AP is somehow being "clever", despite its firewall being "switched-off".

    So, is there a way for me to access my AP, as there is no other setting I see which can solve this.
    E.g.  rewrite the source IP  or some other special pfSence function?



  • I've never been able to get around one that was doing that.



  • OK, cheers and thank you for your help.


  • LAYER 8 Netgate

    Yes. Outbound NAT on the pfSense interface that the AP is connected to.

    Connections to the AP will appear to the AP as coming from the pfSense interface not the remote subnet.

    I'd prefer to just use a "real" AP but that's probably just me.



  • I've had hit and miss results with DD-WRT in exactly this same situation.

    My last version blocked everything but my current version works fine.  As you said, a real AP designed to be just an AP would be be$t.



  • @Derelict:

    Yes. Outbound NAT on the pfSense interface that the AP is connected to.

    Connections to the AP will appear to the AP as coming from the pfSense interface not the remote subnet.

    I'd prefer to just use a "real" AP but that's probably just me.

    I just noticed your response Derelict. Great!!!

    I tried it and of course it did not work  :-[, so I just need a bit of help with setting up the NAT OUTBOUND to achieve => [i]"AP will appear to the AP as coming from the pfSense interface not the remote subnet"

    Issue: I am trying to access AP on 192.168.1.2:80 from 192.168.0.3.

    Setup:

    • Outbound NAT -> Hybrid

    • Outbound NAT Interface: LAN2

    • Outbound NAT Source: Network: 192.168.0.3/24 Port:80

    • Outbound NAT Destination: Network: 192.168.1.2/31 Port:80

    • Translation\Other subnet: 192.168.1.2/31


  • LAYER 8 Netgate

    Don't set a source port.



  • No joy, I am uploading details in case:



  • LAYER 8 Netgate

    Look at your source network. You need slimmer fingers.

    And the NAT address should be the LAN2 interface address, not some /28 ffs.

    How many APs are you trying to do this for? If one use a /32 destination address and LAN2 address as the NAT address.

    That /29 source will only NAT if you are connecting from those specific hosts. Why are you using all these wacky netmasks?



  • It worked!!! Thank you very much!

    As a note, I also had to make the port static for this to work.
    The key point I was missing is that the "Translation\Other subnet" has to be the address of the destination interface.

    The weird subnets was just desperation, to make things work.  ;D



  • LAYER 8 Global Moderator

    "I also had to make the port static for this to work."

    No you didn't..  Why would where your forwarding 80 care that the source port of the traffic was the same as what the client used vs letting pfsense do Napt..


  • LAYER 8 Netgate

    Static port has nothing to do with it. That will possibly create problems for you down the road but leave it if you so desire.

    Your NAT port should be 80, not any.

    Glad it's working for you.



  • @Derelict:

    Static port has nothing to do with it. That will possibly create problems for you down the road but leave it if you so desire.

    Your NAT port should be 80, not any.

    Hmmmm,  :-,  If I tick "Static", pfSence sets the NAT port to Any. However if I set NAT port to 80, then I cannot connect to 192.168.1.2:80 from 192.168.0.3 - I tried again.

    Obviously you both know what you are talking about, why would this be?

    @johnpoz:

    "No you didn't..  Why would where your forwarding 80 care that the source port of the traffic was the same as what the client used vs letting pfsense do Napt..

    As above, also I am not clear what you are saying, can you rephrase?


  • LAYER 8 Global Moderator

    When a browser, or any application for that matter connects to pretty much any other application.. It is really rare that the source port needs to be something specific.. Some cases sure.. But very far and between.. http or port 80 have never seen such a case where the source port would have to be something specific.

    When you set a static port on an outbound port forward what your saying is that pfsense can not change what the source port to something else.. So if your connection was from ipA:portX to ipB:80, then pfsense can not change that to ipA:portY to ipB:80..  Which is how Napt works.

    Your pfsense lan2 IP is in your 192.168.1.1 right?  And your just trying to do a source nat to the web gui running on 80, because the device your connecting to on 80 does not have a gateway set..

    Would look like below.  I just used my lan to show this like I was coming from a different network the 192.168.0.3 in your example.. And 192.168.1.2 is say on my lan..




  • @johnpoz:

    Your pfsense lan2 IP is in your 192.168.1.1 right?  And your just trying to do a source nat to the web gui running on 80, because the device your connecting to on 80 does not have a gateway set..

    Exactly!!! This is a WiFi router working as AP only. I am trying to access its Web Config pages.

    @johnpoz:

    Would look like below.

    I totally get what you are saying. Also, I did change the NAT port to 80 (non static), as you suggested,  so it can change  "ipA:portx" to " ipA:portY", however when I do this, I just cannot get trough to the AP's web interface.

    I just cannot see how would the AP detect this and why your suggestion does not work.

    When I change the NAT port to 80, I get following in the state log:

    LAN1 tcp 192.168.0.3:52387 -> 192.168.1.2:80 CLOSED:SYN_SENT
    LAN2 tcp 192.168.0.3:52387 -> 192.168.1.2:80 SYN_SENT:CLOSED

    When it is static I get below - Although I see the source port also changing, strange :

    LAN1 tcp 192.168.0.3:52469 -> 192.168.1.2:80 ESTABLISHED:ESTABLISHED
    LAN2 tcp 192.168.1.1:52469 (192.168.0.3:52469) -> 192.168.1.2:80 ESTABLISHED:ESTABLISHED


  • LAYER 8 Global Moderator

    Your post does not show a change in source port.. It's 52469 from the .0.3 box and when it gets forwarded from 1.1..



  • @johnpoz:

    Your post does not show a change in source port.. It's 52469 from the .0.3 box and when it gets forwarded from 1.1..

    OK, get it (was late  :D).  Still don't get why non static does not work.


  • LAYER 8 Global Moderator

    No idea… Sniff the traffic to see what you get back from the syn that is sent.. My guess is your getting RST back from the device because there is a session open or something.

    Did you try rebooting the AP?


  • LAYER 8 Netgate

    Giving you some bunk info messing up between outbound NAT and port forwards. Sorry.

    Set it like this:

    ![Screen Shot 2017-11-11 at 7.29.43 AM.png](/public/imported_attachments/1/Screen Shot 2017-11-11 at 7.29.43 AM.png)
    ![Screen Shot 2017-11-11 at 7.29.43 AM.png_thumb](/public/imported_attachments/1/Screen Shot 2017-11-11 at 7.29.43 AM.png_thumb)


  • LAYER 8 Global Moderator

    Good catch Derelict.. This is outbound nat you wouldn't set the NAT.. That would be done automatic.  You would do that with port forward inbound.  But shouldn't it work anyway?


  • LAYER 8 Netgate

    That was effectively static port. I would expect that to work intermittently at best.



  • @Derelict:

    Giving you some bunk info messing up between outbound NAT and port forwards. Sorry.

    Great catch!

    It now works ether way, when I set it as static or if I set it to any (non-static). I am now using (non-static)

    Thank you!



  • @Derelict:

    That was effectively static port. I would expect that to work intermittently at best.

    I am trying to understand this statement, can you please go into a bit more detail to explain?
    I.e. Why would you expect this to work intermittently?


  • LAYER 8 Netgate

    Because static port sets the NAT source port so it never changes.

    That was effectively setting your source port to 80 and the dest port was 80.

    You can only have one firewall state from ip_address_1:80 to ip_address_2:80. So even if the browser tried to open multiple connections to the AP's web interface the potential for them to fail was there.

    With static source port the NAT (PAT really) will work around that by translating the source port to any available port in the NAT table.

    You do not want or need static port here. Leave it off.



  • Thanks for the info and all the help. Cheers. 8)


Log in to reply