Access Point Admin portal different subnet help?

[cgi2099]

@cgi2099
Tp-Link just confirmed this cannot be setup at the AP level. It has to be done either on the router or switch, whichever it is connected too.

[johnpoz]

@cgi2099 what part are you not understanding about the outbound nat rule?

Create a rule on your outbound nat page, like this

Lets say this AP was on my dmz network (192.168.3.0/24) at .100

And I wanted devices from my lan network 192.168.9.0/24 to be able to talk to it. Since this device is too stupid to have a gateway, or filters traffic that is not local you trick it into thinking your talking to it from the pfsense IP address on this network.

So change to hybrid mode and create an outbound nat on the interface that this AP is connected, in my example its my dmz interface.

Now any client trying to talk to 192.168.3.100 from the 192.168.9.0 network will get natted to pfsense IP on this interface - in my example 192.168.3.253

[stephenw10]

Switch Outbound NAT to Hybrid mode.

Add a new rule on the VoIP interface.
Source: network 192.168.1.0/24
Destination: network (the AP IP)/32

Leave everything else as the defaults.

But you really should be able to allow the AP to reply directly to this and doing that would be a much nicer solution.

Steve

[stephenw10]

We are assuming you're trying to actually access the AP directly here but that is that a centrally managed device? Some sort of cloud management portal?

That's a real AP though. I'm sure it can be configured to allow access from a different subnet.

[cgi2099]

@stephenw10
@johnpoz

This worked great thank you :)

[cgi2099]

@stephenw10

There is an option to set a gateway on the AP maybe this is it? I am scared if I set it to anything other than 192.168.3.1 I will lose access and have to factory reset.

[cgi2099]

@cgi2099
TpLink wants you to use there controller localhost software to manage APs on different subnets it looks like. That is what they told me to use.

But the NAT outbound has it working which is good enough for me :)

[johnpoz]

@cgi2099 said in Access Point Admin portal different subnet help?:

I am scared if I set it to anything other than 192.168.3.1

what is pfsense IP address, why would you have it set anything other then your gateway - which I was assuming was pfsense. But yeah if its gateway is something else, then no wonder you can not talk to it through pfsense without the outbound nat - its sending it reply to its gateway.

[cgi2099]

@johnpoz

To access pfSense I log into 192.168.1.1

I have one nic setup to 192.168.1.1/24

and one nic setup to 192.168.3.1/24

the other two nic's are not being used or assigned.

The POE switch is plugged into the 192.168.3.1 nic and the AP into a port on it, I assume that is why the AP assigned a 192.168.3.1 gateway?

So should this be set to 192.168.1.1 instead of 192.168.3.1?

[johnpoz]

@cgi2099 no the gateway would be 3.1 so its not that your ap doesn't know how to talk back, it just chooses not too..

[stephenw10]

Yup, that ^.
3.1 is the correct gateway. If it had no gateway at all it wouldn't have a route.
It must be blocking access based of the source.

But if OBN is working for you....

Steve

[cgi2099]

@johnpoz
@stephenw10

Yes working great, thank ya'll so much :)!