Having Trouble With Nest & Energenie Gateway Since pfSense
Since installing pfSense on a Microserver things have been good! apart from no longer being able to connect to my Nest or Energenie Gateway (Smart Home) I cannot see anything in the firewall blocking these devices? can anyone offer advice on the best way to get these devices back online to the outside world?
Many Thanks in advance!
Can anyone offer any advice on this please? I just put my vodafone router in place of pfsense and my energenie and nest sprung to life so something on pfsense is blocking these devices. I have the rules show below but I still cannot get them to work?
Those WAN rules do nothing. You should delete them.
What would be interesting would be the rules on the interface the devices are connecting through (probably LAN or UNIFI.)
Just at a complete and utter loss to what you think those rules were going to allow? I take it you have no clue to how rules are evaluated on pfsense or on any firewall for that matter.
What is lanandwifi - you have some sort of bridge setup?
What rules did you create on the interfaces you created other than LAN? Which lan default to any any, any opt interface you create would have no rules and everything would be denied. So no your nest would not be able to phone home if you put no rules on the interface its connected to, etc.. Same would also hold true for any other sort of "gateway" for smarthome stuff that needs to get to the internet.
Ah, ok... I am completely new to this so don't be too harsh!
My thought was that I can communicate with the nest & energenie gateway over the LAN but the issue I have is with them both accessing the internet so excluding them from the WAN I thought would be the way to go?
I have 3 interfaces as you can see (WAN LAN & UNIFI)
I am not sure where LANANDWIFI came from as I have read so many guides it would be something I picked up somewhere and will revisit at some point.
I will set the rules on the WAN for the energenie as it is hard wired and on the UNIFI for the Nest as it is Wifi.
Not sure why you think you need any rules on WAN.
I will set the rules on the WAN for the energenie
No!! You would not set any rules on the wan... I really suggest you familiarize yourself with how rules are evaluated on pfsense..
The only time you would have any rules on wan would be if you were doing port forwards, etc. As to no understanding whawtt lanandunifi is - I would make it a priority to understand interfaces you have seutp.. With such a name I would take it a bridge maybe? You have NO need for a bridge in a typical setup.
I run nest therm and protect, there are no port forwards needed, so no rules on wan would ever be needed. And also run myq gateway for my garage and another gateway for wall switches tied to lights. No port forwards needed for any of that. If your smarthome stuff needs port forwards into your network - your doing it wrong!!! return such hardware would be my suggestion.
I will read through all this that you have kindly linked and hope it will help me understand why I am having issues with these devices.
The Energenie gateway is found on my network and is assigned an IP but the app cannot see it when on pfsense, the nest works as such that it thinks it is connected to the interenet and it does function properly but it is unable to collect weather information on pfsense but works perfectly when on my vodafone router.
As for the LANANDWIFI the only interface that was assigned to it in the group was LAN so I have deleted it now.
Post up the rules you have setup on your lan and unifi interfaces.
Also are you running packages like pfblocker, snort, proxy, etc..
Out of the box lan is any any rules and clients can go anywhere they on on the internet on any port. So if your having some problem pulling weather you have modified the rules or are running something blocking it like pfblocker or havng dns problems.
Below are the current rules, I am not running any packages yet, I want to get pfsense up and running with normal operation before adding any packages.
If you cannot see any problems with my rules maybe I should reset and start again?
All of those rules on your lan are POINTLESS!!! rules are evaluated top down first rule to trigger wins no other rules evaluated. So those being below an any any rule mean nothing!
Rule on on unifi do you have a downstream network of 192.168.1/?
What network is your unifi net and what network is your lan net.
If you were adding rules on your lan net via seeing blocks - ie the easy rules. You prob had out of state blocks.. What is 192.168.1.5?? That rules is pretty pointless if 192.168.1 is your unifi network.
Is your lan 172.17.0/?
Thank you so much for your time!!
My LAN is 192.168.0.*
My Unifi (WiFi) is 192.168.1.*
My Unifi AC-Lite is 192.168.1.5
I was experimenting with an issue with some of my dockers on unRAID which are all 172.17.0
I hope that makes sense!
Well if your dockers on your "lan" but on a different network that is a borked config. You need to put your dockers on an actual network.. It is not proper to run multiple layer 3 networks on the same layer 2 - and not secure and does not isolate the networks, and can cause asymmetrical traffic, etc. etc.. There is really never a good reason to do it - other than say the time it takes to migrate hosts to new address scheme, etc.
I would suggest you either put your dockers on a vlan or put them on current network they are connected to.
I will investigate this further, I have not specified the dockers IP's on my unRAID server, they are all set to bridge mode automaticallly and auto assign their own IP's I have never had an issue but I have never set up pfsense before.
Many Thanks for all your time, I really appreciate it!
hmmm I run some dockers on my synology nas, and I access them via the nas IP not some other one.. Do you have a specific docker I could try out on my nas? That your having problems with, ie your seeing those blocks when it tries to go to the enternet for example - I run for example tautulli as a docker for my plex, and I access it via the nas IP
Via that 8181 port..
I will admit I am not a docker guru by any stretch of the imagination, but what I can tell you for sure is trying to run 2 different address schemes on the same L2, ie 192.168.x/24 and 172.17.x/? is not really a valid configuration and should be avoided.
My guess is the "nat" that should be happening between your docker container and what "docker" network its connected to the bridge is not happening.. So while all dockers.. I looked at one of mine and its running in a "bridge" that is 172.17/16 but when you talk to it from outside its like a port forward from your network to the container network.. So if your seeing traffic on pfsense lan from this container network - I take it the ip masquerade is not happening.. But remember I am in no way qualified to be talking about the ins and out of how docker works - its just something from looking at my nas setting for a few minutes.
I decided to carry out a factory reset and try again as nothing I could do with regard to firewall rules was working for me. I am still positive I was doing something wrong but since wiping and starting from fresh my energenie gateway is working perfectly (wired) the only issue I still have is with the nest (wireless) getting the weather information? The nest connects to the wifi via my UniFi wireless network (as do another 13 devices) The only "strange" thing I notice is that the nest itself says the router address is 192.168.1.5 which is the IP address of the UniFi so maybe that is "correct" but pfsense IP is 192.168.0.10 (different range) so maybe that could be the issue?
Please can you take a look at my screenshots and let me know if I am missing anything on my firewall setup?
As for my dockers, they are all working perfectly and as you can see from the picture below they are mapped ports so I don't think that will cause an issue.
Again, HUGE thanks for your help!
your nest has IP address of your AP as its gateway? Yeah that would not be right, a unfii AP does not do any nat..
Any device connected to your unifi wifi network should see pfsense as its gateway. If its pointing to your AP ip as its gateway I have no idea how it could actually be getting to the internet at all..
Where are you seeing that the nest got that as its gateway? On the unit itself...
Your saying the nest has a LAN ip vs your Unfii network, 192.168.0 is your lan, and 192.168.1 is your unifi network?
Just an update,
I have been out and in the last couple of hours My Energenie gateway has now lost connection (last seen at 14:31)
I had not made any changes to pfsense since late morning so I am struggling to see what the issue is here? (it works 24/7 when on my vodafone router)
As for my nest (on the nest itself) it says the router is 192.168.1.5 there is no mention of gateway, I am going to investigate this further now. When connecting the nest you just choose an SSID which in my case is the UniFi, 13 other devices all work fine on the same connection so it must be looking for a port of somekind specific to the nest.
My LAN is 192.168.0.* and my UniFi is 192.168.1.*
As for my nest (on the nest itself) it says the router is 192.168.1.5
Where does it say that? What are you looking at? The device on the wall has nothing that says router,
Take a picture of where you see that.. It clearly shows IP, mask and gateway - I will take a picture when I get home. I would swear it doesn't say router when you look at network details. I just looked at mine this morning before left for work - I was going to take a picture of it even ;) For use on this thread.
Did you name your SSID 192.168.1.5?
Lets say nest used port XYZ doesn't matter your rule is ANY ANY!!
When I get a chance I will sniff the traffic coming off the nest on how it checks the outside temp.
Also where is not showing the outside temp, is your location set? What version of the software running on your nest, on your app?
I found this seems like your same sort of problem
Here is my info showing software version and when last updated, etc. I will take a picture of it detailed network info when I get home
mbc0 last edited by mbc0
I have taken some photo's to show you what I mean,
I am contacting energenie today to see what their gateway is looking for port wise.
It is the farsight weather that the nest will not display when on pfsense...
1262 ping response time is a bit
What respones time do you get if you ping 188.8.131.52 from a PC / Laptop ?
@nogbadthebad yes, I agree! I get 16ms from wired devices and 21 from wireless devices in the same room
"21 from wireless devices in the same room" Same SSID as the Nest & Energenie ?
If its the same SSID is the Nest & Energenie on 2.4 Ghz and the device your testing from on 5Ghz ?
Same room as the Nest and same SSID (Home Control)
Home Control is a seperate SSID I set up on my UniFi just for all my smart devices, light switches etc
The Energene Gateway is wired not wireless
Also, I have just received this information from Energenie as I am typing this reply
"The problem you are experiencing is probably as a result of the internal/external port 9998 been closed: Please follow the following instructions and ensure port 9998 is open:
- Please use this link to find out if port 9998 is open http://www.yougetsignal.com/tools/open-ports/
- If the port is closed. You will need to find your gateway in your network. The gateway uses a dynamic IP address obtained from the DHCP server of the network it's plugged into. You will be able to find devices on your network through your router settings. To access your router settings you need to know its IP address, and if you're having trouble accessing this it may have changed. You can find the IP address using ipconfig. The options from this point will vary depending on which home hub you own. Once you find your gateway
take note of it’s IP address or MAC address.
- You will need to place your gateway in a DMZ. A DMZ (demilitarized Zone) is a conceptual network design where publicly accessible servers are placed on a separate, isolated network segment. The intention of a DMZ is to ensure that publicly accessible servers cannot contact other internal network segments, in the event that a server is compromised. Open the web browser and type the IP address of the device in the address bar (default is 192.168.1.1/192.168.0.1/192.168.0.254). Press Enter. The default username and password are both admin, click OK to log into the device. There should be an option for Configure the DMZ. You could check Enable for the current DMZ Status, enter the IP address of the gateway.
- At this point the gateway should begin to work. You will be able to control your devices. Now you will need to enable port forwarding port 9998. This step will vary depending on your router. Access your router settings. Select advance settings. Under security there should be an option for port forwarding. Here are the settings you will need
a. Name: enter a name for the service (Energenie)
b. Start Port: enter the start port for the service (9998)
c. End Port: enter the end port for the service (9999)
d. Protocol: Select the protocol for the ports: select UDP
e. External and internal ports
f. IP Address: IP address of gateway
Can now take the gateway out of DMZ. Bear in mind that the gateway uses a dynamic IP address obtained from the DHCP server of the network it's plugged into. If the gateway reboots it will have a different IP address. You can go back to change the IP address you’ve set in the above port forwarding rule."
its address is .5 and its router is .5 - that will not work..
And its point to itself for dns... Looks like it got some sort of IPv6 address..
You have something major wrong with dhcp.. You can not have the same router/gateway as your own IP and also point to yourself for dns and expect anything to work.
So your nest has same IP as your AP..
They need an inbound port forward - no... Return it... There is zero reason for these devices to require inbound traffic.
mbc0 last edited by mbc0
I understand but all other 13 devices are working fine. I cannot configure the nest all I can do is choose an SSID and connect to it so I presume the nest is screwing up? All other devices can connect to the internet and talk to each other etc
oh they are talking if your router is behind a nat it seems like..
You have something wrong for dhcp... In the nest it will pull dhcp yes.. Clearly that is wrong.
Look at your other wireless devices - they sure and the hell do not point to their own IP for a router and dns which is someone elses IP.
From that list your ac lite is .39 your AP.. Thought you said before that your AP was .5
Ok your nest is .5 what do you have setup in that static reservation... You need it to talk to pfsense for its gateway/router and dns.
ah, I am really sorry!
yes you are right I got confused, the nest as you say is .5 and the AP is .39
what is your overall dhcp pool... Since with those settings your client should point to pfsense IP on which 192.168.1.x??
For both its router/gateway and dns..
I have my local lan on 192.168.0
My AP Gateway is 192.168.1
the pfsense is 192.168.0.10
I do not have any pools setup
you do have a pool - the default ones.
What is the pfsense unifi interface IP 192.168.1.X ??
That should be the gateway/router for your wifi clients and also that should be there dns.
Do you have anything setup in the router setup in the unifi dhcp server page? You didn't list the whole page.
I do not know what the pfsense UniFi interface IP is as I just use 192.168.0.10 (which is reachable from UniFi 192.168.1.*)
Could this be an issue? as devices are looking for it on 192.168.1?
There is nothing setup on the DHCP page I uploaded previously, everything is blank apart from what you have already seen..