PF Sense Setup
-
Again John, have a good day.
-
@jsmiddleton4 I appreciate your help. the Modem was not in IP Pass-Through mode. I didnt realize I had to do that. I thought I was just supposed to put the modem into bridge mode, which i did so by going into gateway function, clicking the residential gateway function, and selecting disabled (black circled option).
Putting the residential gateway function to disabled pushes the modem/router into bridge mode, so its literally just handing off the ISP internet to whatever device i plug into the modem. (At least that is my impression/understanding from doing this).
If PFSense should had out dhcp that is fine. As long I know I can just reset my router and put it back to how it was using a back up file (like i did last night) I am fine w/that.
I would like to learn how to setup PF Sense correctly from the start because then I will jot down the way that I got it setup, then get a lab setup and install it again on a lab to test different things w/it before throwing it into my home network production environment.
-
Correctly can be any number of ways.
My understanding is you wanted the modem to be first, PFSense box second doing the heavy lifting, hang everything off the PFSense box.
If that's what you're looking for the modem needs to be in IP Passthrough, not residential gateway, etc. Pick the port you want to be the ethernet WAN port on the back of the modem. Connect that one port to the ethernet, interface, that is configured as the WAN port for the PFSense box.
You're done with the modem. Everything else is the PFSense configuration.
-
@stephenw10 I will test things again this week. In the other thread (https://forum.netgate.com/topic/168766/setting-up-pfsense-on-my-home-network), it stated "where your modem/isp device would be connected to "wan" of pfsense, and your switch would be connected to "lan" interface of pfsense."
So that is what I did. I will have to boot up the pf sense box w/a monitor straight to it to verify if the cards are still as is. I was under the impression i had them correct i doubl checked 3 times but who knows maybe i got them mixed up.
-
Yes, that is correct and that is how you should connect them but it's easy enough to get them the wrong way round, especially if both your NICs are the same, like re0 and re1.
The best way to check is to use the console directly. At the menu choose option 8 to access the command line and then run:
ifconfig re0Look for the media and status lines to see how that is linked, for example:
[22.01-BETA][admin@apu.stevew.lan]/root: ifconfig re0 re0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500 description: OPT1 options=8209b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC,LINKSTATE> ether 00:0d:b9:37:30:10 inet6 fe80::20d:b9ff:fe37:3010%re0 prefixlen 64 scopeid 0x1 inet 10.200.200.1 netmask 0xffffffc0 broadcast 10.200.200.63 media: Ethernet autoselect (1000baseT <full-duplex,master>) status: active nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>Now unplug the NIC you think is re0 and run the command again. Make sure it shows the link went down.
Steve
-
@travelmore
Or from the console rerun the interface assignment steps, pick the one you want for WAN and LAN. At that time configure the WAN to be all DHCP/DHCP6, the LAN with a static IP, the DHCP range, nothing for DHCP6, save and boot.Then you'll know which interface is assigned to what, that the WAN interface is all DHCP and the LAN's static IP of the PFSense box.
On my Dell RE0 is the built in LAN port.
You'll know each is configured correctly.
Edit: Once you get the PFSense box configured initially to handle the heavy lifting you're not done. Like the Princess Bride you're mostly done but not all the way done. There's some DHCP6 configuring to do, DHCP6 server, etc.
Who is your ISP?
-
When you add a NIC of the same type as one that is built in that usually gets parsed first at boot and becomes the lowest numbered device. But not always! It depends of a number of things.
It's best to check physically. If your NICs support the auto-detection feature in the console assignment that is one way to be sure. Not all do though.Steve
-
Absolutely. Didn't say his was RE0. Said mine was.
-
He said his WAN is re0 in the first post but I don't see what the LAN is. I'm assuming it's re1 since that makes switching them accidentally much easier. Might not be though.
-
@stephenw10
On his Dell the built in Ethernet port is not close to where he'd have an add in NIC card. I have the same layout. Once he knows which is WAN, which is LAN, easy to keep them sorted. -
@stephenw10Thank you. I will try this. Yes my LAN is re1. its a 2nd card i added. WAN is re0 the 1st card that is built into the dell. I will double/triple check i know setting it up i kept having to jot it down to remember what was what.
-
@jsmiddleton4 I thought DHCP6 wasnt used yet. From what i've seen w/videos no one configures DHCP6 or leaves it as default settings.
my isp is buckeye cable. no way out because they are a monopoly and i dont trust them. its not every month my usage goes over my data cap just certain months (nothing with a pattern or like reoccuring every dec. type thing, its sporadic) but they keep saying oh you are over data and im like i havent changed anything. i dont stream games the NASs that have have been shut off for at least 6 months and im just now starting to turn them back on.
so im wondering if somethings going and pulling data consistently that im not aware of which is why i wanted to start looking at PFSense and its abilities.
-
I use DHCP6. Not sure its not in play now.
With IPV6 and PFSense some of the ISP’s require certain settings. Mine is Comcast. I found a step by step guide from another Comcast user in my area. I’m in Fort Wayne.
That’s down the road though. First is getting everything working the way you want.
PFSense will give you very tight control.
-
I have not found any post yet from someone who uses your ISP that has IPV6 setup and working on a PFSense box. Would be helpful of course as their working setup would guide your's.
What I did find is your ISP is IPV6. Several big announcements about it.
You do NOT need IPV6 for PFSense to work. This is strictly on the "To do" list, not on the "required" list.
When you get there, might have to contact your ISP for optimal IPV6 config.
-
@jsmiddleton4 thank you for your help. After putting the router/modem into IP Passthrough and reinstalling PF Sense its finally working!! I jotted everything step wise down and have a backup of this working config. I have a static ip for LAN (w/dhcp enabled as well) and WAN is getting a public 72.241.x.x address (dhcp also set for that as well).
The one thing that I am confused on is my wireless SSID that was from my router/modem is still up and working which is fine but I cant remote into my hardwired devices from my wireless.
Everything I read about IP Passthrough mode, indicated that my wireless would no longer work but that doenst seem to be the case as I am connected to my wireless now. Dont get me wrong I am VERY grateful it works because I was starting to think okay now I have to setup some old routers for APs as wireless (which is fine just more work). Either way i'd have to probably set them up in PF Sense...which I am guessing is what I have to do now that my wifi is working is add it to pf sense probably.
** Edit, something I just noticed is, the wifi seems to be stable stating connected (on my computer that is wireless and my phone), then i noticed on my phone about 15 min later, it displays ssid as internet may not be available! then give it a minute and it will say connected and stay that way for a while...so maybe because the modem is in passthrough mode the wireless just isnt as strong as it is when its not in passthrough mode. If that is the case i have no issue setting up APs for a more solid boost of wireless.
FYI- yes I have my Hitron modem/router in IP Passthrough mode, specifically looks like this.
BUT I also have a wifi extender which im betting that is casting my 'original' SSID that was programmed from my router/modem.
Now my question is...how do I get my wireless devices to communicate w/my hard-wired devices & vice versa?
I have pinged the IP of my pfsense box and my pihole box (both are hardwired) and I cant connect to them.
When I setup pf sense tonight I was connected via hardwired connection from the switch.
Thank you everyone for your help and support. I am so grateful for all of your input. I am interested if you guys have any favorite plugins you use for monitoring bandwidth/devices and why?
-
CONGRATS!
Will get to your questions in a moment. For now, savor your victory!
Edit: Is part of your victory you had the PFSense ports wired correctly? WAN to WAN, LAN to LAN? Cables weren't swapped?
-
Wireless
SSID is not why you aren't connecting via wireless to hard wire clients. Assuming hard wired means those clients are connected to the PFSense router.
I'm guessing you can't connect to wired clients via wireless because the PFSense router is doing its job. Your wireless clients are getting IP information from some device other than the PFSense router. Which means those clients are not part of the big happy PFSense family. PFSense won't let them pass.
Need to back up a bit.
What is acting as the wireless access point which is also likely to be the master and the wifi extender the slave?
Wifi extenders typically don't give out any IP addresses or you set them statically. Something is managing the wifi extender.
You maybe able to use your modem's wifi. Might need to manually configure it. Wireless AP's, other than configuring SSID, radio options, etc., don't need setup in PFSense. Wireless AP's are just another wired client. Based on your diagram you'd plug a network cable into your switch which goes to the wireless AP.
There are wireless options in PFSense. A simple wireless AP doesn't need setup there.
My guess is you'll need to go back into your router and turn off its wifi. I'll read about it and see if there's a way to use it. Would require ports 1-3 to be enabled as LAN ports. Could be picking one port to be the outgoing WAN pass through port keeps the others in the mix. Possible. Would think unlikely.
Unless you want to do what others have suggested and double NAT. Your wifi wouldn't be part of the PFSense protected family. At least I don't think so. Double NATing means the modem is its own thing, PFSense is its own thing.
So which port is port 4? The one by the coax jack? The bottom Ethernet port is 4?
-
Yeah interesting. Using the wifi when it's in bridge mode is kind of undefined. You might check what public IP wifi clients end up using. It's probably going to be the same IP pfSense is using as a gateway.
@travelmore said in PF Sense Setup:
Now my question is...how do I get my wireless devices to communicate w/my hard-wired devices & vice versa?
Both those things are going to be difficult to impossible because there is no route between them. Using a separate access point connected to pfSense is going to be much easier if you can.
Steve
-
WiFi modes: Access point
It list AP as possible in the documents. Still digging.
Seems it would need another network cable from PFSense to Port 1-3 however.
-
@stephenw10 said in PF Sense Setup:
Using the wifi when it's in bridge mode is kind of undefined
This.. As mentioned what IP is your wifi client getting.. Does this gateway device also provide nat to your wifi devices while your getting public IP on pfsense, etc.
The better setup is to forget doing anything on that isp device other than providing pfsense internet and public IP. And put all of your devices behind pfsense, be wired or wireless (via AP)..
