Modem GUI/SSH access stops when pfsence has active PPPOE connection.
Hi all of You lovely people.
First of all I wish merry Xmas to all.
Now to the chase.. Hope gurus on here will be able to help.
I have seen loads of topics about DSL modem access behind pfsense but can't find solution for the problem I am having.
As per title.. I have no access to my DSL modem when pfsence makes PPPOE connection and gets public IP. Modem is in bridge mode and pfsence handles PPPOE connection. Configuration is made according to this guide: https://www.netgate.com/docs/pfsense/interfaces/accessing-modem-from-inside-firewall.html
I have tried to make MODEMACCESS interface on another LAN port on my pfsense nic card (it has 4) and connect it to LAN port 2 on my modem (HG612 has 2). Thought modem access could conflict with PPPOE on same port somehow but no. Same result. Everything works until I enable PPPOE connection.
Thanks in advance.
Gertjan last edited by
about DSL modem access behind pfsense but can't find solution for the problem I am having.
is a problem.
LAN interfaces are 'behind' pfSEnse, WAN is in front, and that's where your modem lives.
I just checked https://www.netgate.com/docs/pfsense/interfaces/accessing-modem-from-inside-firewall.html and it works for me.
@gertjan I did follow that guide. See my post. Interface and NAT rule is configured correctly as far as my understanding goes. Or else I would not be able to reach the modem at all. I can access modem only when PPPOE connection is down or WAN interface (which is configured as PPPOE) is disabled.
Gertjan last edited by
I can access modem only when PPPOE connection is down or WAN interface (which is configured as PPPOE) is disabled
This proofs you did not set up things as they should.
How would it be possible to access the modem if your WAN interface is disabled ??
It's time (as always) to show rules, NAT, interfaces, network layout, etc.
@gertjan WAN(PPPOE) is a virtual interface and this is why another interface to same physical NIC port (em0) can be added for modem access. Wan(PPPOE) is not necessary to access modem.
In this configuration modem is not accessible. As soon as I disable WAN interface or change PPPOE login details so connection can't be established I can access my modem.
My setup is quite simple. modem->pfsense->unmanaged swithch (LAN).
Here are settings on my modem:
Its an echolife issue.
On your wan setting under service list , just bind it to lan1 not to both (which is the case if you have them both unchecked.
Have the other lan also plugged in on same lan (or vlan) like lan1 lan2 and pf wan port
I guess You are talking about 2 cable configuration here. If both ticks are unchecked it lets You use only one cable and get internet as well as GUI access. See this:
This worked perfectly on tomato router but refuses to work on pfsense when PPPOE link is made.
Putting a tick in to LAN1 binding lets only PPPOE traffic go through. GUI will not work on LAN1. It will be accessible on LAN2 only. Which is not an issue if it would work. I have done what you suggested. Tick on LAN1 and put 2nd cable to my pfsense with another interface created on that port. Same thing. I can access GUI until PPPOE connection is made.
@girtsj 2nd cable on the same physical pfsense lan via a simple switch?
I have this working with a linux pppoe (centos) and works.
I doubt pf is any different accesing hg612.
@netblues must be something in settings.. If I plug in 2nd cable to LAN switch there is no access. But then if I manually change IP on my PC adapter properties to 192.168.3.2 (modem is 192.168.3.1) I can access the modem GUI. But then I have no access to internet and pfsense as it bypasses its lan (192.168.1.0).. any ideas? Maybe virtual IP?
Show the rules on the Lan interface
I have a hunch you're redirecting traffic through the openvpn tunnel .
Rule 1 from top forwards certain sites to VPN as some are blocked in UK.
Rule 2 forwards my synology nas to VPN.
Rule 3 forwards the rest of LAN to wan gateway so it dont go to VPN.
1 NAT not needed
2 create a rule after the first
source 192.168.1.0 / 24 destination 192.168.3.0 / 24 and default gateway
@konstanti like this?
Still no dice..
I don't see the ModemAccess interface in the picture
@konstanti sorry disabled it
still a no-go
still a no-go
Diagnostics/ Packet Capture
Show me the result of the packet capture.
And Huawei IP route table
I'm sorry, I think NAT needs
Another option is to change the IP address of the modem, for example, 192.168.1.55/32 with default gateway 192.168.1.1 (don't know which gateway address). And plug the cable from the modem into the network switch . And test the connection
@konstanti thought that without nat rule it won't work.
Will give this a go.
I really don't get it.. Huawei PPPOE connection is binded to LAN1 port on modem. GUI access is through LAN2. MODEMACCESS interface on pfsense is on different port than WAN. It all works:
22:12:45.552442 IP 192.168.3.2.55771 > 192.168.3.1.80: tcp 0
22:12:45.552885 IP 192.168.3.1.80 > 192.168.3.2.55771: tcp 0
22:12:45.553547 IP 192.168.3.2.55771 > 192.168.3.1.80: tcp 0
22:12:45.554795 IP 192.168.3.2.55771 > 192.168.3.1.80: tcp 610
22:12:45.555131 IP 192.168.3.1.80 > 192.168.3.2.55771: tcp 0
22:12:45.557256 IP 192.168.3.1.80 > 192.168.3.2.55771: tcp 112
22:12:45.557630 IP 192.168.3.1.80 > 192.168.3.2.55771: tcp 434
22:12:45.557918 IP 192.168.3.2.55771 > 192.168.3.1.80: tcp 0
22:12:45.558918 IP 192.168.3.2.55771 > 192.168.3.1.80: tcp 0
22:12:45.559042 IP 192.168.3.2.55771 > 192.168.3.1.80: tcp 0
22:12:45.560042 IP 192.168.3.2.55771 > 192.168.3.1.80: tcp 0
22:12:45.560417 IP 192.168.3.2.55771 > 192.168.3.1.80: tcp 0
22:12:45.560541 IP 192.168.3.2.55771 > 192.168.3.1.80: tcp 0
22:12:45.560628 IP 192.168.3.1.80 > 192.168.3.2.55771: tcp 0
22:12:45.867621 IP 192.168.3.2.31225 > 192.168.3.1.80: tcp 0
22:12:45.867862 IP 192.168.3.2.7015 > 192.168.3.1.80: tcp 0
22:12:45.868066 IP 192.168.3.1.80 > 192.168.3.2.31225: tcp 0
22:12:45.868191 IP 192.168.3.1.80 > 192.168.3.2.7015: tcp 0
22:12:45.868360 IP 192.168.3.2.31296 > 192.168.3.1.80: tcp 0
22:12:45.868690 IP 192.168.3.1.80 > 192.168.3.2.31296: tcp 0
22:12:45.868861 IP 192.168.3.2.34624 > 192.168.3.1.80: tcp 0
Until i log into PPPOE. It all goes dead..
@girtsj You can download capture ?
I need a file packetcapture.cap
When is active ?
I so understand that now access to the modem is possible ?
@konstanti no. access is not working when pppoe session is live. cap file was generated when pppoe was inactive. I changed to wrong password so it cant log in to my ISP.
and you can get a cap file when pppoe is active ??
the file is empty
there's no traffic ?
@konstanti i believe so. There was nothing on the screen log, too. Seems like pppoe session kills it all. Think i am ready to give up. Been sctraching my head for about a month..
chpalmer last edited by
The modem interface has no "gateway" to set so will not be able to reach something outside its subnet without some special help upstream. You have to be in the same subnet to reach port 2.
What happens when you give the modem an address inside your LAN subnet and connect that to your LAN switch?
@chpalmer Yes, but why this stops working when ppp kicks in? It wouldn't work in all situations if it was a gateway thing.
In general, in such situations nat is required to access the router from lan. But again this seems unrelated.
@chpalmer if I give the modem address inside my lan subnet and connect it to switch everything is working! I have an active PPPOE session and can access modem GUI! Thanks!
Not the way things supposed be done but who cares as long as it works.
Thanks again for the idea.
chpalmer last edited by
Its the way that particular modem was designed. Ive got one I ran for a couple of weeks before going to bonded service at one of our shops. It was the only way I could make it work.. going from memory.
Since the PPPoe session creates a pipe through the interface anything outside the pipe on the WAN is unreachable from the router without some configuration to make it work such as what is described on the "accessing modem" page linked earlier. If a store bought router works out of the box I have to believe that the manufacturer has built something into that particular router allowing the connection. It would be like creating a leak somehow.
I could never make our Huawei work using the information from the modem access page either. But it did work with the ZOOM 15 series modems we were using.