Need Wake on LAN help or Alternative Solution



  • Hi, I am using the latest pfsense and I am trying to find a way to wake a pc on my network from a remote location. The pc I want to wake is a windows 10 pro machine doubling as a Plex sever.

    I will be going away on vacation in a few months and would like to have access to the movies on my Plex server but at the same time I do not want to leave my Plex server pc turned on for the whole week I am gone.

    I have read that I can have the pc sleep and turn it on remotely using Wake-On-LAN. The pc will go back to sleep after it is inactive for a set amount of time.

    The problem is that I do not know the best way or any way for that matter to send the WOL magic packets while away and on a network other than my own.

    I know pfsense can do WOL which I have tested locally and does work but what about when I am away from home? I have also read that I should not setup pfsense in a way that allows access to the WAN from an outside network, so what are my options?



  • I'd say the best way is to use ssh to reach your firewall and run WOL from there. It is possible to relay WOL, but I don't think you'd want to allow that over the 'net.



  • @jknott said in Need Wake on LAN help or Alternative Solution:

    I'd say the best way is to use ssh to reach your firewall and run WOL from there. It is possible to relay WOL, but I don't think you'd want to allow that over the 'net.

    Thanks for the info jknott.

    Is there a guide for setting up SSH?

    I'll be honest, at this point I do not even know how to access pfsense from outside of my own network.

    Also, I forgot to mention in my first post that I do have a FreeDNS (afraid.org) account but haven't set it up in pfsense yet and I also have a VPN account through ExpressVPN. Currently I am using the VPN on my whole network except the subnet which the plex server is on because the Plex Server is on my gaming pc and one of the games I play won't work with a VPN. I do however have pfsense setup so that I can easily turn the VPN on and off for said pc using 2 different firewall rules.

    Also, is it possible to SSH in to pfsense using an iphone 6? If not I could use my laptop.



  • I was able to setup SSH using Termius on my iphone6 and puttygen to create the keys.

    I am not sure if it is a configuration error but I can log into pfsense console but not the webgui from my iphone.

    Given this I do not see how I can send a WOL packet to my pc.

    Please forgive my ignorance but is it possible to ssh into the webgui or just the console?

    If just the console, how do I send the WOL packet to my pc?


  • Galactic Empire

    Set up a VPN on your pfSense router then do it from the web browser or via SSH.

    You'll also need the VPN to access your plex server unless you port forward to it.

    https://www.netgate.com/docs/pfsense/vpn/ipsec/configuring-an-ipsec-remote-access-mobile-vpn-using-ikev2-with-eap-mschapv2.html

    [2.4.3-RELEASE][admin@pfsense]/root: /usr/local/bin/wol --help
    Usage: /usr/local/bin/wol [OPTION] ... MAC-ADDRESS ...
    Wake On LAN client - wakes up magic packet compliant machines.
    
        --help          display this help and exit
    -V, --version       output version information and exit
    -v, --verbose       verbose output
    -w, --wait=NUM      wait NUM millisecs after sending
    -h, --host=HOST     broadcast to this IP address or hostname
    -i, --ipaddr=HOST   same as --host
    -p, --port=NUM      broadcast to this UDP port
    -f, --file=FILE     read addresses from file FILE ("-" reads from stdin)
        --passwd[=PASS] send SecureON password PASS (if no PASS is given, you
                        will be prompted for the password)
    
    Each MAC-ADDRESS is written as x:x:x:x:x:x, where x is a hexadecimal number
    between 0 and ff which represents one byte of the address, which is in
    network byte order (big endian).
    
    PASS is written as x-x-x-x-x-x, where x is a hexadecimal number between 0
    and ff which represents one byte of the password.
    
    Report bugs to <krennwallner@aon.at>
    [2.4.3-RELEASE][admin@pfsense]/root: /usr/local/bin/wol -i 172.16.2.21 a8:20:66:10:fc:b7
    Waking up a8:20:66:10:fc:b7...
    [2.4.3-RELEASE][admin@pfsense]/root:
    

  • Galactic Empire

    @tagit446 said in Need Wake on LAN help or Alternative Solution:

    Also, is it possible to SSH in to pfsense using an iphone 6? If not I could use my laptop.

    Prompt from the Apple store will do it, but if you set up a VPN you could just connect via https.



  • @nogbadthebad said in Need Wake on LAN help or Alternative Solution:

    Prompt from the Apple store will do it, but if you set up a VPN you could just connect via https.

    Why VPN or HTTPS, when SSH is all that's needed. PfSense already has SSH availalble. All he needs is a SSH client to connect to the fireall, a rule to let him in and then just issue the WOL command.


  • Galactic Empire

    The IP address where he’s connecting from may change, not all ISPs supply a fixed IP address.

    Also if you don’t create a VPN that suggests that ssh and the service Plex is using is available on the WAN interface.

    VPN is more secure.

    It’s not just WOL that’s required even if that’s all that was asked by the OP.



    1. the address he's connecting from should be irrelevant. I often use SSH from various elsewhere.
    2. SSH is already available, without having to do anything else. It's built into the FreeBSD that pfSense is based on.
    3. All he has to do on pfSense is create a rule that lets it in. I currently have NAT set up to allow access to my main computer, but it could just as easily be set up to allow connection to pfSense.
    4. You can configure SSH to use a private/public key pair for security, which is a lot harder to break than a password. Security would be similar to a VPN or HTTPS
    5. All he needs to add is a SSH client. Linux comes with one and Windows users can use Putty. There are also SSH clients for Android and probably iOS. Given that MAC OS is also BSD based, it would have a built in client too.

    Once he's at the command prompt, he simply issues the WOL command, though it's also possible to use SSH to connect and enter the command in one operation. SSH is by far the easiest operation, unless he already has a VPN available. In that case, simply run SSH through the tunnel and forget about the rule to allow it in from the Internet.


  • Galactic Empire

    Yes but he’s not going to be able to view his his plex content is he!

    It’s the address he’s connecting from that’s the issue.



  • @nogbadthebad said in Need Wake on LAN help or Alternative Solution:

    Yes but he’s not going to be able to view his his plex content is he!

    It’s the address he’s connecting from that’s the issue.

    His question was about WOL, that is remotely starting a computer. Whatever happens after that is another matter.



  • Hi JKnott & NoBadTheBad, thank you both for all of the info.

    Sounds like there is a few different ways to go about this from your comments and I have to admit I am a bit confused on which would be the best way to go.

    Let me try to clear up a few things from my end.

    I do use PPPoE for my internet and yes from time to time my IP does change.

    I do have a VPN account with ExpressVPN and used them to setup OpenVPN on my firewall.

    I do have a dynamic DNS account with afraid.org (FreeDNS) but don't have it setup. I thought I might need it since my public IP can change.

    After Jknott's first reply I did set up SSH using a private/public key and put an SSH client on my iPhone (Termius). I can access the pfsense console locally from the iphone but not the webGUI.

    I still want to explore each of your solutions so maybe we can work through each one. I do need a working solution but I also would like to learn how to do each and then decide on what works best for me.

    Concerning SSH, since I got this set up lets start there.

    1. How do I SSH into the webGUI or is it not possible?
    2. What URL do I use to access remotely from someone else's network, would it be my public IP?
    3. If i cannot SSH into the webGUI, how do I issue a WOL command from the console?


  • @tagit446 said in Need Wake on LAN help or Alternative Solution:

    How do I SSH into the webGUI or is it not possible?

    Depends on the operating system. On Linux and other Unix based OSs, very easy. You can use the ssh -X command to run a graphical interface app. Others, I couldn't say.



  • @jknott said in Need Wake on LAN help or Alternative Solution:

    @tagit446 said in Need Wake on LAN help or Alternative Solution:

    How do I SSH into the webGUI or is it not possible?

    Depends on the operating system. On Linux and other Unix based OSs, very easy. You can use the ssh -X command to run a graphical interface app. Others, I couldn't say.

    I would be SSHing ing from either IOS 11 on an iPhone or from a windows 10 home laptop.


  • Netgate Administrator

    I would definitely setup a VPN here. Why would you not do that if you can? I use it all the time just for tunneling my traffic if I'm on some untrusted network somewhere.

    SSH is always useful, especially if you setup an SSH proxy. Never tried that from iOS though.

    Why not both? 😉

    Steve


  • Galactic Empire

    Have you thought how your going to access your plex content?



  • @tagit446 This thing is oftenly referred to as WOW (Wake on WAN) if u need to Google it.

    I just did it the "easy" way, port forward port 7 (if I recall correctly, not at home at the moment), I also forgot whether I port forwarded to the actual mask, or the broadcast mask (255.255.255.255), try both see which one works. Only caveat is, anybody can wake your box, but so what? let them, they can't do anything else, unless you let them right.

    Now this is only the wake portion. How you actually access your box is a separate deal.



  • Ok, so i'm still exploring everything that has been said but want to ask if the following would work.

    First, as I mentioned before, I have a VPN account with ExpressVPN. Currently I am using OpenVPN via ExpressVPN setup on my entire pfsense network except for the PC in which my Plex Server is setup on. When I connect to the internet with this PC it goes through my ISP instead of the VPN. According to the remote access settings in Plex I should be able to access Plex remotely from out side of my network but I have not been able to verify it yet.

    With that said, I also have a app from ExpressVPN installed on my iPhone so that I can tunnel my phone internet traffic through ExpressVPN regardless of who's internet I am using. I also have now setup Dynamic DNS on pfSense. So is this as simple as....

    1. When using someone else's network, start my VPN app.
    2. Connect to my pfSense firewall by going to the URL I got from Dynamic DNS host? For example, would going to http://mychoosenName.mooo.com take me to my pfsense's webgui login?
    3. In pfSense, Send WOL to my Plex Server/PC.

    If what I am asking could be working solution, is there anything else I would need to configure in pfSense to make this work or any security issues I should be aware of?

    Kinda sucks I need to travel somewhere and use someone else's network to test if it would work or not.



  • "Kinda sucks I need to travel somewhere and use someone else's network to test if it would work or not."

    No you do not. U maybe able to use your smart phone cellular network...

    SmartPhone -> cellular -> Internet -> YourISP -> YourBroadbandWAN.



  • @sammywoo said in Need Wake on LAN help or Alternative Solution:

    "Kinda sucks I need to travel somewhere and use someone else's network to test if it would work or not."

    No you do not. U maybe able to use your smart phone cellular network...

    SmartPhone -> cellular -> Internet -> YourISP -> YourBroadbandWAN.

    Palm to face.. you are absolutely right lol. I've had my iPhone for 4 years and in that time I have never turned on the data as it has only one gig shared between myself and my wife's phone. Just always connected it to wifi and didn't give the cellular data a thought. I swear, sometimes I do a good job at embarrassing myself...


  • Netgate Administrator

    Rather than connecting to ExpressVPN from your phone/laptop and then coming back into your pfSense box outside the tunnel it would be better to setup a VPN server on the pfSense box itself and just connect directly to it.

    Shorter route. Less (or no) NAT. End to end inside the VPN.

    You would then connect to your plex server as though you're local. No need to port froward anything to it opening potential security holes.

    Steve



  • @tagit446 said in Need Wake on LAN help or Alternative Solution:

    Kinda sucks I need to travel somewhere and use someone else’s network to test if it would work or not.

    What sort of Internet connection do you have? I have a cable modem with 2 ports. I normally just use one of them to connect my firewall, but I occasionally use the 2nd for testing. Of course, as someone else mentioned, you can tether to your cell phone.



  • @stephenw10 said in Need Wake on LAN help or Alternative Solution:

    Rather than connecting to ExpressVPN from your phone/laptop and then coming back into your pfSense box outside the tunnel it would be better to setup a VPN server on the pfSense box itself and just connect directly to it.

    Shorter route. Less (or no) NAT. End to end inside the VPN.

    You would then connect to your plex server as though you're local. No need to port froward anything to it opening potential security holes.

    Steve

    I just set this up following a Lawrence Systems video (https://www.youtube.com/watch?v=7rQ-Tgt3L18) .

    In the VPN > OpenVPN > Servers > Tunnel Settings it allowed me to add my LAN1 network which is where my Plex server resides. I tested the connection locally from my iphone to my plex server and it works. I haven't tried it remotely using my iphone's cellular data due to poor connection signal at the moment. Cellular is poor at home and only works sometimes.

    So I am wondering, will this connection let me access the pfsense webGUI by default or would I need to edit the setting to allow this. I only need remote access to the pfsense webGUI to issue the WOL to the plex server. If I need to edit the settings, what exactly would I need to do?

    I am also wondering if my public IP was to change, would it effect the VPN connection?

    If it would effect the connection, I do have a Dynamic DNS account setup but I am unsure how I would make it work with the VPN.

    @jknott said in Need Wake on LAN help or Alternative Solution:

    @tagit446 said in Need Wake on LAN help or Alternative Solution:

    Kinda sucks I need to travel somewhere and use someone else’s network to test if it would work or not.

    What sort of Internet connection do you have? I have a cable modem with 2 ports. I normally just use one of them to connect my firewall, but I occasionally use the 2nd for testing. Of course, as someone else mentioned, you can tether to your cell phone.

    ADSL+, ISP > 4 port DSL Modem > pfSense > Local network with 2 unmanaged switches & 1 WiFi access point.


  • Netgate Administrator

    It will allow you access the webgui via the LAN IP as long as you have firewall rules to allow it. By default the wizard adds an allow all rule.

    As long as the OpenVPN client is using your DynDNS address to access the server it will be updated automatically if your WAN IP changes. If you used the OpenVPN client exporter it has an option for choosing how the client does that, Host Name Resolution. By default it will just use the interface IP but if you have a dyndns address configured it will be selectable there.

    Steve



  • @stephenw10 said in Need Wake on LAN help or Alternative Solution:

    It will allow you access the webgui via the LAN IP as long as you have firewall rules to allow it. By default the wizard adds an allow all rule.

    As long as the OpenVPN client is using your DynDNS address to access the server it will be updated automatically if your WAN IP changes. If you used the OpenVPN client exporter it has an option for choosing how the client does that, Host Name Resolution. By default it will just use the interface IP but if you have a dyndns address configured it will be selectable there.

    Steve

    Thanks for the info Steve 👍

    I think I have this setup correctly and works from a windows 10 desktop and appears to be working on my iphone6 IOS 11.4 except for a couple of issues.

    I used the client export tool in pfsense and for the iphone I choose the "OpenVPN Connect (IOS/Android)" download. This created one file and I then added the file into itunes by dropping it into OpenVPN folder. After this OpenVPN connect recognized the file and imported it in. After signing in it appeared to connect but at the same time it looks like there might be some issues.

    1. On the iphone while in OpenVPN Connect, if I click on "Certs" I get a message saying "No certificates are present in the keychain. Note: PKCS#12 files need to end with '.ovpn12', instead of '.p12' or '.pfx', for proper importing (check FAQ)" I tried looking on the web but found nothing useful on this error.
    2. On the iphone, both safari and duck duck go give me this error about "This connection is not private". For this I figured I needed to manually trust the OpenVPN certificate but when I go into the trust settings there is no certificate to trust.


  • O'Boy, I'm not sure what happened but I rebooted pfSense and now I can not access pfSense webgui.

    UPDATE: The reboot caused my public IP to change. It took a little bit for dynamic dns to update my IP. I can now log in to pfSense. I tried to delete this post but it said I didn't have the right privileges.



  • Hi Everyone, Happy Fourth of July !!

    So I finally went to a location were I got good cell service and tested my OpenVPN connection to my pfSense firewall.

    The result, OpenVPN connected however I could not reach my firewall webgui by ip address or by using my dynamic DNS address.

    I noted the time I did the test and compared it to my firewall logs when I got home. I do not know what my cellular IP address is but it does look like the firewall may have blocked my access with "Default deny rule IPv4 (1000000103)". I'm pretty certain it was blocking my cell IP though because the IP being blocked resolved to Sprint many times at the same time I was testing and then stopped hitting the firewall when I was done testing.

    So now I am very confused as to why my OpenVPN client was able to connect but my cell IP was being blocked at the same time not allowing me to get to the webgui. Any ideas?

    PS, I could also access my plex sever without issue but that is not surprising because I am keeping my port forwards up until I can get OpenVPN sorted.

    [EDIT]: Tested Plex connection before starting OpenVPN Client. Also, if it helps the deny rule I mentioned above all had a TCP-S Flag.


  • Netgate Administrator

    The OpenVPN client will only be configured to route traffic for the internal subnet so you would have to access the firewall webgui using the internal IP address. The LAN IP I believe here.
    The dyndns url will resolve to the WAN IP which should not be accessible. Either publicly or across the VPN.

    Steve



  • @stephenw10 said in Need Wake on LAN help or Alternative Solution:

    The OpenVPN client will only be configured to route traffic for the internal subnet so you would have to access the firewall webgui using the internal IP address. The LAN IP I believe here.
    The dyndns url will resolve to the WAN IP which should not be accessible. Either publicly or across the VPN.

    Steve

    Sorry for the late reply but this was very helpful, thank you. I actually reconfigured my firewall rules and DNS following "This Guide". The only difference is that I am using ExpressVPN on all subnets, not using DNS Forwarder and not using Vlans. I also setup my OpenVPN by using "This Guide" which is by the same author and builds off his baseline config which I linked to above.

    After using these two guides and adjusting for my network environment I tested remotely from my iphone.

    I was able to successfully connect to my pfSense OpenVPN server and also able to access my pfSense webGUI using the IP(192.168.40.1) which I created in OpenVPN :) I have not tested yet but I should now be able to send the WOL command to my Plex Server.

    Now I am trying to setup my laptop to do the same. So far I have the OpenVPN client setup on it . I only have my home network setup on this laptop so for now I can only test locally on it.

    I have found using my laptop I can connect to my local network through the OpenVPN client but cannot access my Plex Server while connected. At least not completely. On the laptop with the OpenVPN client connected, using chrome I navigate to 192.168.10.10:32400/web/index.html (my local plex server) it will bring up a Plex error saying "Plex is not reachable - Make sure your server has an internet connection and any firewalls or other programs are set to allow access."

    I actually find this error kind of odd because the above address takes me to a Plex Error.

    stephenw10, you mentioned I would not need any port forwards to access my Plex Server when using OpenVPN. Welp, I still have my port forwards in place and can access Plex on my local devices when NOT connected using the OpenVPN client but I cannot access Plex while connected to the OpenVPN client. I must be doing something wrong but I am not sure what.

    If anything obvious in what I have written stands out as a possible problem please let me know.

    In the mean time I am wondering, in order to reach my Plex Server do I also need the OpenVPN client installed and running on my Plex Server as well or is the OpenVPN client only needed on the devices used to remotely access my network?

    One thing I see that may be an issue is that when trying to access Plex on the laptop (connected to OpenVPN), is that the firewall log shows "LAN1 | LAN1: Default reject IPv4 (1531020574) | Source - 192.168.10.10:61446 | Destination - 192.168.10.255:32414 | UDP" and "LAN1 | LAN1: Default reject IPv4 (1531020574) | Source - 192.168.10.10:61445 | Destination - 192.168.10.255:32412 | UDP". The source IP is my plex server with an unknown port and the destination I am unsure of (broadcast address?) and port is close to my Plex port (Plex port is set to 32400).

    [UPDATE] - I think I may know what the issue is here but I am unsure how to fix it. When the laptop OpenVPN Client is running the laptop looses internet access. I believe the laptop is connecting to my Plex Server but then the laptop also needs internet to login to Plex. So I think my question now is how can I have internet while the OpenVPN client is running.


  • Netgate Administrator

    If it looses internet when the VPN is connected then it is configured to send all traffic over the VPN. Most likely the setting 'redirect v4 gateway' on the server. It should be routing only the LAN subnet traffic over the VPN.

    Alternatively you can route all traffic over the VPN as long as pfSense is configured to allow out internet traffic from the VPN client and NAT it. Doing so allows you to hide all your traffic from whatever remote network you may be on.

    I fail to see why the client on the laptop would need to login to Plex other than on your Plex server though.

    The fact you are reaching the server and it's showing an error implies the connection is working. I assume your server doesn't show that error if you are connected locally?

    Steve



  • I do have all network traffic exiting out my ExpressVPN gateway on each subnet/interface.

    I still need to test remotely but I think I found the issue, I had the wrong gateway set in one of the Roadwarrior VPN firewall rules. Testing locally I can now connect to OpenVPN using the client and I still have internet at the same time.

    I'll report back once I get a chance to test this remotely.