Connecting two SG-1100's for Production and Lab
Apologies in advance, I’m sure this has been asked
and answered 1000 times. I don’t know the terminology.
Net - want to connect a SG-1100 to an existing SG-1100
to create a lab environment.
First SG-1100 OPT port (192.168.1.2/24) connected
to Second SG-1100 WAN port (192.168.1.1/24)
Second SG-1100 LAN port assigned 192.168.100.0/24
(I want Lab to use 192.168.100.xxx addresses)
What am I missing to get out to the Internet?
(I can access if I plug directly into OPT.
Connectivity is not an issue)
@csfshore Should just need to set a static route/gateway in the Lab SG-1100 pointing to 192.168.1.2 , that will work initially, you may have some odd problems from double NAT, but you have to start somewhere. Of course, don't forget DNS.
@bossaops Thanks for reply.
Do I do that on the SECOND (LAB) SG-1100
or on the "upstream" FIRST SG-1100??
(Make the Second SG-1100 LAB WAN port a gateway
and and set a static route from Second LAB SG-1100
@csfshore On the second(Lab) one.
OK, I have this so dorked, nothing works.
Hoping a picture will help
Have tried every permutation, and now have no gateways in
LAB box, (I delete with abandon) and pulled all my hair out.
What I would like is to treat the connection from OPT
(on PROD) to serve as my WAN connection in LAB.
I would like the LAB LAN port network (192.168.1.100)
to route to the Internet. I'd like to think I am close.... :-)
Thanks for any help
@csfshore If you change your LAN to 192.168.100.1/24 then you should be good to go, assuming nothing is a typo on the picture.
Other than that you might need to check if you have some boxes ticked in Interfaces > WAN Reserved Networks (scroll to bottom)
@bobbenheim Thanks for reply,
Damn - no that's a typo.
It should be 192.168.100.1/24!
However, (I'm pretty sure) that's where I started
with and it didn't work and was suggested that
a static route was needed.
Do I need a gateway on the LAB WAN SG-1100?
I'm a little cross eyed at this point and have deleted
so many gateways and static routes, I don't know
what "default" should look like. Thanks
Have you unticked Block private networks and loopback addresses in Interfaces > WAN?
Yes, that is unticked. I am at a point now
where I can ping external addresses numerically
and ping them by name, but I get no web traffic.
Nothing comes up in browser.....
Should I be doing something to the firewall??
@csfshore So you are able to ping IP addresses like 188.8.131.52 from hosts on your lab LAN?
@bobbenheim Yes, I am able to ping external ip addresses
numerically, and external sites by name (www.apple.com, etc.)
When I try www.apple.com (any external site) in browser, it just hangs
@csfshore Only rules needed would be allow all to any on OPT and of course NAT, which should already be present at your LAB SG-1100 by default.
Assuming you are using Windows have you checked something isn't blocked in the Windows firewall?
@bobbenheim On a Mac, but firewall is not turned on.
My thinking is that I need a static route, as the ICMP (ping) stuff goes through, but the higher level TCP/UDP doesn't
Does that make sense?
@csfshore If you can ping external addresses then you have a route outside your network, if you can resolve FQDN (DNS) then you got UDP working. How does your rules on OPT and on your LAB SG-1100 looks like?
@bobbenheim Only 1 rule on OPT (upstream SG-1100)
"Default allow OPT to any rule"
Downstream LAB LAN "Anti-Lock out rule" and
"Default allow LAN to any rule"
I DO have a gateway in the downstream LAB SG-1100
which is set to the address of the downstream WAN port
@csfshore You can try and do a packet capture on OPT and WAN in your LAB and see if anything gets through when your trying to access the WWW.
@bobbenheim OK thanks, that might be above my skill level, but I have been working my way through this and learning a lot. Appreciate your help. I know I could just
plug in a switch. :-)
Let me ask this another way, should this work?
Is what I am doing so bizarre and specialized that
I am pushing the boundaries of networking?
Perhaps rather than trying to troubleshoot, how would
this be set up with two out of the boxes SG-1100s?
I have no issue with starting "fresh"
@csfshore It should be possible and i have done it before, when i have tested some equipment, just not with two PFSense units but that shouldn't make a difference.
Doing double NAT is just another problem to deal with and is easier just to avoid. If you have connectivity on your Production LAN you could reset your LAB unit and connect it to LAN instead of OPT to rule out miss configuration on your Production unit.
@bobbenheim OK let me try that. The fact that I can connect directly to OPT and browse, suggests to me
that the issue is within the LAB box.
FWIW I did run packet trace and looked at logs, and
while I am not exactly clear what I am looking at I see nothing out of the ordinary but this:
/interfaces.php: Gateway, none 'available' for inet, use the first one configured. 'WAN_DHCP'
In looking through forums, that doesn't seem like a stopper
as it is not pervasive, just a few entries.
@csfshore How are you configuring IP on WAN at LAB, static or DHCP?
@csfshore lol. Well while I can't help but think I have missed something very simple, and I appreciate the help, but I am out of ideas.
I dl the .iso and installed on a NUC. Same thing. I can ping
by name and numerically from the downstream LAN.
I can browse externally using the upstream WAN cable (no connection to PfSense)
BUT when I am connected to downstream LAN, cannot
browse. Time for a switch!
@csfshore Can you show a screenshot of your LAB WAN Static IPv4 Configuration
@bobbenheim Sure. However, as I biffed the drawing above, thought I would change IPs, just to ensure I'm on the right one.
To level set:
Upstream SG-1100 OPT (192.168.48.1) is connected to
NUC LAB WAN (192.168.48.2 OR DHCP) LAB LAN is 192.168.55.1
When I use STATIC (as included) I am unable to ping EXTERNAL from LAB, when I use DHCP I am able to ping numerically and by name.
@csfshore As it says in the Static IPv4 Configuration field under IPv4 Upstream gateway you need to provide it with an upstream gateway, just enter 192.168.48.1.
@bobbenheim OK. I keep hearing about Static Routes.
Do I need a Static Route?
@csfshore If you are using a static IP you need to provide a gateway, otherwise the LAB SG-1100 wouldn't know where the exit to the world is. If you add 192.168.48.1 as upstream gateway you should be set.
Upstream OPT 192.168.48.1/24
Downstream WAN 192.168.48.2/24
iPv4 Upstream gateway (which I was prompted to create as there was none). 192.168.48.1 /24
Can (still) ping by name and numerically, browser just hangs
Plugged directly into OPT works
@csfshore Have you tried using another DNS, e.g. 184.108.40.206, on your mac? Other than that you could try resetting the SG-1100.
@bobbenheim Wish I had a nickel for every time I reset the
Some new info, apparently my sys admin (aka granddaughter) has done the same thing. She has put a Ubiquiti USG downstream on the "prod" LAN link, and it is working for her.
Thought to turn off her setup with downstream USG and try mine with downstream OPT pfSense (NUC at this point) - No Good.
I am at the point where I think there is a definite difference between the LAN and OPT ports on the upstream SG-1100
However, I will try a Ubiquiti USG on OPT.
Appreciate you hanging in here with me.
@csfshore Which version of PFSense is on the LAB unit?
Could you try and connect the LAB unit in place of the production one just to rule out the possibility that there might be something wrong with it.
@bobbenheim That's a good idea, and I thought of that
BUT my ISP is very twitchy wrt mac addresses, and I would have to engage them. SO, the LAB SG-1100 is off to school and I am using the 2.50 community edition on a NUC as the
downstream LAB router.
I was hoping for some type of "you have to do x to get the
OPT port to route downstream" or "SG-1100 board level y
needs a firmware update to use the OPT port..." Whatever.
Your guidance and my trial and error suggest that this should be possible very easily, so indeed the issue might
lie with the Upstream SG-1100, BUT since it works fine in
"production", (admitedly using only the LAN port) perhaps I replace with a unit that has more than one dedicated LAN port like a SG-2100 or SG-3100...?
@csfshore I don't know why I get these weird line breaks in my post, it looks fine in the preview window
@csfshore There isn't much to it, if you have an extra external IP address from your ISP you can do 1:1 NAT to OPT, otherwise you would just use outbound NAT. Other than that you just need to make allow rules on OPT and that is it, if it works when you connect directly to OPT it doesn't seem likely that is the problem perhaps cabling between the units, does it show any errors at Status > Interfaces?
@bobbenheim No errors in Status > Interfaces.
Only when I plug in the downstream router. When plugged in, I can ping by name and numerically. BUT what rules? I have never made any rules. Just plugged in downstream and expected to to work after seeing successful pings. Maybe that's it??
@csfshore you would need to do NAT on OPT at your production unit, but i assume that was created automatically since you can ping the outside. The rules are the same allow all that we already went through. Can you show screenshots of your rules on OPT and Firewall > NAT > Outbound on the production unit?
FWIW - I have connected a Netgear and a Linksys router to the downstream OPT port. Each of them worked as easily as @bobbenheim suggested it would.
Think this clearly points to my configuration of the original downstream SG-1100 and current downstream community edition NUC. I continue to be confused but undaunted!
@csfshore SOLVED! SOLVED!SOLVED!
It was the NIC on the NUC!
(I don't have disposition of the original downstream SG-1100) but it worked as easily as suggested with replacement NUC.
THANK YOU to all