WOL packets across subnets?



  • I have two particular subnets. 192.168.10.0/24 for wired devices and 192.168.20.0/24 for wireless devices. I like to wake up some PCs around the house by sending WOL packets from my phone. But, now that they're on different subnets, that's not working. Is there any way to configure pfSense to route WOL packets across subnets?


  • LAYER 8 Rebel Alliance

    You can send Magic Packets to any network directly connected to pfSense via Services > Wake-on-LAN in your pfSense WebGUI.

    -Rico



  • Right, but I have a WOL app on my phone that no longer works because now my phone and PCs are on different subnets, so I'm hoping there's a way to get WOL packets to hop across subnets so that the app resumes working.



  • @dstarr3

    WOL is at the Ethernet level, not IP, so routers will not pass it. The best you can hope for is a relay agent, similar to what may be used with DHCP.



  • Can you go into more detail about that?



  • @dstarr3 said in WOL packets across subnets?:

    Can you go into more detail about that?

    Not really, as I haven't done that. A relay agent receives the Ethernet frame and transmits it on another network. DHCP relay agents are available with routers from Cisco etc., but I haven't heard of one for WOL. As mentioned above, your only option would be to have WOL originate on pfSense, as it can see all networks.


  • Netgate Administrator

    Yes you would need some type of relay or proxy. For example:
    https://community.cisco.com/t5/small-business-switches/wake-on-lan-wol-across-different-vlans-on-sg-300-10/td-p/2013610

    I don't think anything included in pfSense by default can do that.

    Steve



  • Come on, WOL is not that complicated and it's well documented.

    The "Magic Packet" is sent on OSI L2, usually as UDP to the subnet's broadcast address and might be directed at one of a few ports. I typically use port 7. IMHO p:0 and p:9 work as well.

    So if you are on 192.168.1.0/24 and want to wake a machine on 192.168.2.0/24 you sent the Magic Packet to:
    UDP 192.168.2.255:7
    I did that from a dedicated Crestron control system but have no experience doing so from a phone.

    The Magic Packet itself is darn simple. It is 6x FF followed by 16x the MAC address of the sleeping host. No spaces or whatsoever in between.

    From a mobile phone your best bet might be to use the WOL page of your local pfSense.


  • Netgate Administrator

    Yeah, I just spent a while playing around with things in pfSense to see if I could reply/proxy it without installing anything else. But either I'm missing the right incantation or, quite likely, it is blocked somewhere I'm missing.

    Steve



  • @stephenw10
    Where did you sent the Magic Packet from?

    The rule I was using is pretty simple an allow from host "Control System" to UDP other subnet's broadcast address with destination port :7
    That's on an ALIX with 2.3.2 nano IIRC, but I doubt things have changed in this regard.


  • Netgate Administrator

    I was using the pfSense WoL client which appears to use port 40000 and also doesn't, from the GUI, allow you to specify a target IP.
    More testing needed obviously... ๐Ÿ˜‰

    Steve


  • Netgate Administrator

    Mmm, yeah it won't forward traffic to the broadcast address and that seems like the correct thing to do.

    I wonder if that was tightened up since 2.3.X....



  • Not necessarily ... that's Subnet Directed Broadcast.

    Try a translator for this page:
    https://decatec.de/software/magicpacket-unterstuetzt-nun-wake-lan-andere-subnetze/
    which features a Windows .exe to WOL in other subnets. I'm on a Mac so it's not for me.


  • Netgate Administrator

    Yeah FreeBSD doesn't do that AFAIK and hasn't for some time.

    As of March 2007, FreeBSD 7.0 WILL NOT forward directed broadcasts to directly attached local networks.
    This behaviour is compliant with RFC 2644. 
    

    Unless I'm misreading that. It is late here and I lost an hour of sleep last night! ๐Ÿ˜‰

    But that's the behaviour I'm seeing.

    [2.4.4-RELEASE][root@7100.stevew.lan]/root: wol -i 192.168.126.255 -p 9 00:0e:8e:24:cd:0a
    Waking up 00:0e:8e:24:cd:0a...
    

    That packet arrives at the pfSense interface the 7100 is in but never leaves the 192.168.126.X interface.
    It is passed by the firewall rules and opens states but only on the incoming interface.

    Running that same command on the firewall between the subnets wakes the client as expected.

    Steve


  • Netgate Administrator

    Wow horrendous workaround here: https://forum.netgate.com/post/525988 ๐Ÿ˜จ

    Haven't tried that. Not going to!


  • Netgate Administrator

    Mmm, just to confirm attempting to send those increments the counter packets not forwardable shown in netstat -s -p ip.

    I can't see any way to enable forwarding directed broadcasts either.

    This is the expected, and correct, behaviour as far as I can see.

    Steve



  • @jahonix said in WOL packets across subnets?:

    Come on, WOL is not that complicated and it's well documented.

    From that link:

    "it could be sent as any network- and transport-layer protocol, although it is typically sent as a UDP datagram to port 0,[6] 7 or 9, or directly over Ethernet as EtherType 0x0842."

    Take a look at what's sent on the wire, using Packet Capture or Wireshark. If it's bare Ethernet, then it definitely won't be routed. If UDP, with a broadcast address, then you'll have to figure out how to get pfSense to route it to the correct interface, when there's no network address to route with. There's a reason why broadcasts are not routed.

    BTW, when I used WoL, a few years back, it was bare Ethernet.



  • @jahonix said in WOL packets across subnets?:

    The "Magic Packet" is sent on OSI L2, usually as UDP

    UDP is layer 4. IP is 3 and Ethernet, 2.



  • @stephenw10 said in WOL packets across subnets?:

    Yeah FreeBSD doesn't do that AFAIK and hasn't for some time.
    ...
    It is late here and I lost an hour of sleep last night! ๐Ÿ˜‰

    Strange, I have it working this way, client uses is frequently with this video switcher.

    Don't worry about your sleep, same with me. Just 1 hour ahead... ๐Ÿ˜‰



  • @JKnott said in WOL packets across subnets?:

    @jahonix said in WOL packets across subnets?:

    The "Magic Packet" is sent on OSI L2, usually as UDP

    UDP is layer 4. IP is 3 and Ethernet, 2.

    Correct, I was wondering how long I could get away with writing it this way. ๐Ÿ˜‡
    I am using a UDP frame directed at the other subnet's broadcast address as mentioned before. No need to wireshark. And I'm not there often anymore.



  • Welp, I guess the solution is just to put my WiFi on the same subnet as my LAN. I was hoping to keep them separated, just for the sake of organization, but it's just causing too many problems. Oh well!


  • LAYER 8 Rebel Alliance

    I don't get the problem why you need some App when pfSense can do the job.
    Just create some User named "wol" or anything you want, give the privileges only to access Services > WOL
    pfSense_WOL-User.png
    Now when logging in with User "wol" you are redirected to Services > WOL without to need clicking anything in the WebGUI.
    Depending on your smartphone/browser you can even save the pfSense Login to your Homescreen and autologin User "wol".
    Now you have your selfmade pfSense WOL App and anything working...deal? โ˜บ

    -Rico


  • LAYER 8 Global Moderator

    yup @Rico method is how I would do it if ever need such a thing... But just not a fan of wol at all... If you want to get to so something leave it on..

    Its just too much of a pain doing wol for a few devices... What cost you like 2 bucks a month to just leave them on..

    I could see if you in the enterprise and had 1000 machines going into standby at night and every now and then you wanted to wake them up to do updates or something..

    What exactly are you trying to wake up? While your there on the network with your phone? Just go click the button on it ;) Are you in a 15K square foot mansion and can not be bothered to walk from the west wing to the east? Have the butler go hit the space bar ;)



  • @johnpoz said in WOL packets across subnets?:

    yup @Rico method is how I would do it if ever need such a thing... But just not a fan of wol at all... If you want to get to so something leave it on..

    Its just too much of a pain doing wol for a few devices... What cost you like 2 bucks a month to just leave them on..

    I could see if you in the enterprise and had 1000 machines going into standby at night and every now and then you wanted to wake them up to do updates or something..

    What exactly are you trying to wake up? While your there on the network with your phone? Just go click the button on it ;) Are you in a 15K square foot mansion and can not be bothered to walk from the west wing to the east? Have the butler go hit the space bar ;)

    I'd personally like to find some kind of work around. I dont live in a mansion or anything either but id like to just say "Hey Siri, Goodnight" and my tv shuts off with everything else homekit shuts down. Maybe thats what he wants too? Simple automated convenance.

    I hate it when people do this to other people seeking help. Ridiculing them for something they want to do. I mean sure you could go find a remote and shut it off, you could also unplug the TV and put it away in a box or take it back to the store and buy a new one each time too. Theres lots of different things you could do but not all of them are smart or make sense to do but theres some more options to toss at him/her when they ask again.

    For me I am trying to find a way to do this too because I have my IoT devices on one subnet but would like to have homebridge send the WoL packet to my TV thats on my LAN subnet to shut it off when I say "Siri Goodnight". I dont have a mansion myself but I just want simplicity of automation and this WoL issue is the last hurdle to clear.


  • LAYER 8 Global Moderator

    WOL does not work over subnet... Do you understand how WOL works? You send specific packet to the mac address (layer 2).. If you want to wake up something on another layer 2 network, then you need something on that other layer 2 to send the packet.

    Now it is possible - but you need something that has access to both the sender and the receiver. And you have to tell the guy between (router) to wake up dest device. This router needs to know the mac address of this dest device.. static arp entry can help with that, etc.

    Going to say this again - its not worth the hassle.. But sure go ahead and help them ;) You can always log into the pfsense web gui and if you have setup static arp, dhcp reservation for this device as example you can send the wol packet from there.. So sure there are work arounds - awaiting your code changes to pfsense to allow for such a thing...

    Get with your homebridge forum on how to have it send wol to different devices on different subnets.. Is that not a standard feature where you can say Wake Up X? Sure alexa and stuff can send the wol messages to device - but they have to be in the same layer 2 network!!



  • @johnpoz said in WOL packets across subnets?:

    WOL does not work over subnet... Do you understand how WOL works? You send specific packet to the mac address (layer 2).. If you want to wake up something on another layer 2 network, then you need something on that other layer 2 to send the packet.

    Now it is possible - but you need something that has access to both the sender and the receiver. And you have to tell the guy between (router) to wake up dest device. This router needs to know the mac address of this dest device.. static arp entry can help with that, etc.

    Going to say this again - its not worth the hassle.. But sure go ahead and help them ;) You can always log into the pfsense web gui and if you have setup static arp, dhcp reservation for this device as example you can send the wol packet from there.. So sure there are work arounds - awaiting your code changes to pfsense to allow for such a thing...

    Get with your homebridge forum on how to have it send wol to different devices on different subnets.. Is that not a standard feature where you can say Wake Up X?

    I guess you are too focused on being negative and not on what people are wanting to do. How you are a global moderator with that attitude I have no idea.

    Either way how is homebridge going to fix this? Homebridge is simply a hub for IoT devices sitting on the subnet. It can't route packets as it can only send them out on the broadcast address of the subnet its on. This would need to be done at the router level, which in this case, is my pfsense gateway. As for code changes..if theres work arounds then that is fine. How about just supplying people the workarounds instead of trying to argue?

    Here seems to be a workaround I am going to give this a try. This isnt an impossible task unless the BSD kernel blocks it from happening specifically which could be an answer you could supply. : https://forum.netgate.com/topic/30355/wake-on-wan/3



  • @jeremym said in WOL packets across subnets?:

    I'd personally like to find some kind of work around. I dont live in a mansion or anything either but id like to just say "Hey Siri, Goodnight" and my tv shuts off with everything else homekit shuts down. Maybe thats what he wants too? Simple automated convenance.

    That's not the sort of thing WoL does. WoL stands for Wake on LAN, which is a method to turn a device on. There is no corresponding function to turn it off.



  • @JKnott said in WOL packets across subnets?:

    @jeremym said in WOL packets across subnets?:

    I'd personally like to find some kind of work around. I dont live in a mansion or anything either but id like to just say "Hey Siri, Goodnight" and my tv shuts off with everything else homekit shuts down. Maybe thats what he wants too? Simple automated convenance.

    That's not the sort of thing WoL does. WoL stands for Wake on LAN, which is a method to turn a device on. There is no corresponding function to turn it off.

    Correct. What I am wanting to do is have the WoL packet sent to my TV to wake it up. According to the dev, the plugin then uses the Samsung API to manage commands after that such as power off. I didnt go into detail of how the exact plugin works because honestly I do not know other than the high level aspect I just typed here because its found on the wiki of the plugin.

    So if I can get the WoL packet to reach the TV then the plugin will utilize the Samsung API to do the rest. Just need to wake it up.

    However I do recall more detail I read a few months ago about how this plugin worked. It might have been in a GitHub bug someone opened and it was a reply from the dev. I think theres more "voodoo" to shutting it off than what I said above because honestly it should shut off after I manually power it on the way I have things configured now but it doesnt.

    The quick backstory of my little project is this..I had everything on the same lan working great. I decided to make things a bit more secure and created a separate vlan for my IoT devices. I wanted to leave my Apple devices and my Samsung TV on my regular lan. So I created an alias for my homekit hub devices (Apple TVs and HomePods), installed Avahi for mdns retransmissions across subnets, gave my hubs static IPs based upon their Mac in my DHCP server on the gateway, and opened up firewall rules so the devices on the IoT vlan could communicate with only the homekit hub devices on my lan. They cannot reach anything else on my lan. I created rules in reverse as well so I had no restrictions depending on what device initiated the connection request. For the wifi devices I got a cheap Linksys wireless router and put dd-wrt on it so it was as secure as I could get it "Linksys firmware is really out of date for this old thing so decided dd-wrt release from dec of 2019 is best I can do".

    All is working great except for this plugin. Which is what lead me here because I know what WoL is and I was hoping someone had a solution to get the packet to relay to the right subnet when homebridge sent it out.

    Here is a link to the plugin so you can take a look if you are interested in it. Works great when on the same subnet :)
    https://github.com/tavicu/homebridge-samsung-tizen/wiki


  • Banned

    This post is deleted!


  • @jeremym said in WOL packets across subnets?:

    What I am wanting to do is have the WoL packet sent to my TV to wake it up.

    Does your TV even support WoL?


  • Netgate Administrator

    If it's just one device then you should be able to add a static ARP entry for it and the appropriate port forward for whatever your application uses.
    When I looked into this before I could see no way to allow forwarding directed broadcasts.

    Steve


  • Netgate Administrator



  • @stephenw10

    It's certainly possible to set up a WoL relay agent.


  • LAYER 8 Global Moderator

    Just because you have something that will relay or forward (that device that has access to both L2s) doesn't mean its going to work with alexa or google home or homekit, etc. etc.

    Not without some major background work and setup most likely, and understanding the details of how your device you want to say wakeup X actually does that..

    My Alexa can turn on my TV, and off.. but I have my harmony remote in the same vlan as alexa, while my tv is in its own vlan. Both of these vlans are different than my other vlans. It would prob work without even... Since the harmony remote isn't in standby and the alexa should be able to talk to it over L3.

    But trying to find ways to move L2 data into another L2 is not the right approach.. Correct design of your L2s is better option from a security standpoint.. You need X to talk to Y via layer 2 - then put them in the same layer 2, its really that simple!!! Isolate that network from your other stuff..

    Do you trust alexa... do you trust your tv, do you trust your iot - well no that is why we isolate them.. But if X needs to talk to Y via layer 2 stuff.. The simple solution is just put them in the same L2 ;)


Log in to reply