PF Sense Setup
-
@jsmiddleton4 said in PF Sense Setup:
The modem was "seeing" the PFSense box as a LAN client.
Which is not a problem - you can for sure run double nat setup. As long as pfsense wan and lan do not overlap networks.. If your pfsense wan is say 192.168.1/24 - just make pfsense lan 192.168.2/24 or something.
Doesn't matter if pfsense wan gets an IP or doesn't get an IP, or gets an IP and can not go anywhere.. You would still be able to connect to pfsense lan from client on its lan.
-
I understand. He isn't or wasn't trying to setup a double NAT config though.
Go back and set up the modem so its doing just the modem piece, IP Pass through. That's what I was calling bridge mode. Pick the port he wants to be the WAN port.
I'd blast PFSense and start clean.
Then follow the PFSense document step by step for install/setup.
-
@jsmiddleton4 I would suggest he gets it working in double nat, before messing with any sort of bridge/passthru mode on his modem.
Once he has that working - it its minor to change over to pfsense actually getting a public IP.
-
If you read back through this thread it seems pretty clear to me that the WAN and LAN were swapped. Everything else is secondary to that, obviously nothing will work as expected in that situation.
the pfSense webgui could not be accessed from the LAN side. It can only be accessed from the WAN side. (using the LAN IP?) The only rational explanation for that is the LAN and WAN are swapped.
Steve
-
@stephenw10 quite true - and agree with you.. My point is before concerning with what IP is on pfsense wan.. I would make sure you can access it from the lan.. What pfsense internet/wan interface is doing or not doing has little to do with being able to access it via lan on initial setup.
-
Once he gets the modem configured the way its supposed to be.
-
@jsmiddleton4 said in PF Sense Setup:
way its supposed to be.
Supposed to be for what - out of the box it almost for sure it going to be natting. So you could argue that is the way it is "suppose" to be ;) There are plenty of instances in double nat, shoot even triple nat that cause the users no grief. So I would leave that until after.
He seems to be having a hard time getting even a basic setup. So I would get pfsense working to the point you can access it from something behind it on its lan. Before worry about what IP is on wan if any.. Yes it really helps you understand which interface pfsense is using for its lan and wan interfaces ;)
-
The way it is supposed to be for what he's clearly stated he's trying to accomplish. Which is not double NATing.
-
@jsmiddleton4 said in PF Sense Setup:
for what he's clearly stated he's trying to accomplish
Where did he state that?
@travelmore said in PF Sense Setup:
my goal is to monitor all the devices on my network (wired and wireless) and see how much bandwidth they are pulling and by what method (browsing, gaming, streaming, etc.)
That has zero do to with him double natting or not.
@travelmore said in PF Sense Setup:
I still am using my ISP-provided modem/router to hand out DHCP (I’d prefer to keep it that way until I get more familiar w/everything)
From that, seems more like he doesn't want to touch anything on his modem router. I am all for removing double nat... My point is might be better to just get his setup working with stuff behind pfsense before messing with anything at all on the router. If his isp device is working.. Then just connect pfsense behind it - get it working and clients behind it working before messing with the config of the isp device. That is all I am trying to say.
-
Have a good day John.
-
@jsmiddleton4 you too - but your over complicating it is all.. And seems like just confusing him if you ask me.
-
Again John, have a good day.
-
@jsmiddleton4 I appreciate your help. the Modem was not in IP Pass-Through mode. I didnt realize I had to do that. I thought I was just supposed to put the modem into bridge mode, which i did so by going into gateway function, clicking the residential gateway function, and selecting disabled (black circled option).
Putting the residential gateway function to disabled pushes the modem/router into bridge mode, so its literally just handing off the ISP internet to whatever device i plug into the modem. (At least that is my impression/understanding from doing this).
If PFSense should had out dhcp that is fine. As long I know I can just reset my router and put it back to how it was using a back up file (like i did last night) I am fine w/that.
I would like to learn how to setup PF Sense correctly from the start because then I will jot down the way that I got it setup, then get a lab setup and install it again on a lab to test different things w/it before throwing it into my home network production environment.
-
Correctly can be any number of ways.
My understanding is you wanted the modem to be first, PFSense box second doing the heavy lifting, hang everything off the PFSense box.
If that's what you're looking for the modem needs to be in IP Passthrough, not residential gateway, etc. Pick the port you want to be the ethernet WAN port on the back of the modem. Connect that one port to the ethernet, interface, that is configured as the WAN port for the PFSense box.
You're done with the modem. Everything else is the PFSense configuration.
-
@stephenw10 I will test things again this week. In the other thread (https://forum.netgate.com/topic/168766/setting-up-pfsense-on-my-home-network), it stated "where your modem/isp device would be connected to "wan" of pfsense, and your switch would be connected to "lan" interface of pfsense."
So that is what I did. I will have to boot up the pf sense box w/a monitor straight to it to verify if the cards are still as is. I was under the impression i had them correct i doubl checked 3 times but who knows maybe i got them mixed up.
-
Yes, that is correct and that is how you should connect them but it's easy enough to get them the wrong way round, especially if both your NICs are the same, like re0 and re1.
The best way to check is to use the console directly. At the menu choose option 8 to access the command line and then run:
ifconfig re0Look for the media and status lines to see how that is linked, for example:
[22.01-BETA][admin@apu.stevew.lan]/root: ifconfig re0 re0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500 description: OPT1 options=8209b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC,LINKSTATE> ether 00:0d:b9:37:30:10 inet6 fe80::20d:b9ff:fe37:3010%re0 prefixlen 64 scopeid 0x1 inet 10.200.200.1 netmask 0xffffffc0 broadcast 10.200.200.63 media: Ethernet autoselect (1000baseT <full-duplex,master>) status: active nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>Now unplug the NIC you think is re0 and run the command again. Make sure it shows the link went down.
Steve
-
@travelmore
Or from the console rerun the interface assignment steps, pick the one you want for WAN and LAN. At that time configure the WAN to be all DHCP/DHCP6, the LAN with a static IP, the DHCP range, nothing for DHCP6, save and boot.Then you'll know which interface is assigned to what, that the WAN interface is all DHCP and the LAN's static IP of the PFSense box.
On my Dell RE0 is the built in LAN port.
You'll know each is configured correctly.
Edit: Once you get the PFSense box configured initially to handle the heavy lifting you're not done. Like the Princess Bride you're mostly done but not all the way done. There's some DHCP6 configuring to do, DHCP6 server, etc.
Who is your ISP?
-
When you add a NIC of the same type as one that is built in that usually gets parsed first at boot and becomes the lowest numbered device. But not always! It depends of a number of things.
It's best to check physically. If your NICs support the auto-detection feature in the console assignment that is one way to be sure. Not all do though.Steve
-
Absolutely. Didn't say his was RE0. Said mine was.
-
He said his WAN is re0 in the first post but I don't see what the LAN is. I'm assuming it's re1 since that makes switching them accidentally much easier. Might not be though.
