Do I use NAT?
-
Hi all
I need some help, seems I'm out of my depth for now.
I hope the attached picture will explain well enough.
I have a device provided by the ISP, I am not able to manage it, I can only see some settings and make minor changes. But nothing even close to what you would want. This upset me so I got a Netgate to manage my internal network.
The ISP device uses IP 192.168.1.1 and uses DHCP. Can't change that.
I'm trying to connect the WAN port of the Netgate to the ISP box. I set it to DHCP so it gets an address from the ISP box. All well and good.
I set the LAN to static IP (192.168.10.1) and configured DHCP for just a normal range (192.168.10.0/24).
Connecting a laptop to one of the LAN ports gets me a 192.168.10.* IP address, and I can connect to the Netgate GUI on 192.160.10.1
However the laptop is not able to access the internet. I suppose I have to do some NAT setup to go from internal network 192.168.10/0 from the LAN to 192.168.1.0/24 on the WAN in order for it to forward packets to the ISP box?
I tried this but so far am unable to get things to work. I'm not even sure if I'm setting up the WAN port correctly in this situation. (when connecting to the ISP box directly and getting a 192.168.1.* IP, I can reach the Netgate WAN port on the IP provided by the DHCP delivered IP address after setting up a firewall rule to allow this traffic, so I can load the web GUI)
Any advice / tips / ... would help. How do I setup the WAN port correctly in this situation and how do I get traffic from the 192.168.X0.0/24 networks to the internet? Thank you for reading.
-
@drk out of the box pfsense would nat lan traffic to whatever the wan address is. Lan would have default any any rules.. Lan devices would work out of the box with really nothing to do but clickly through the setup.
When you add other interface, they would have no rules - so yeah you would need to allow rules on the interfaces. But nat would automatic be setup to the wan as well - unless you messed with the automatic outbound nat rules.
From your lan device can you ping the isp devices IP 192.168.1.1?
-
@johnpoz hi and thanks for the reply
The 192.168.10-20-30-40.0/24 networks are ones I plan to setup for segmenting the network. So far I have kept it simple and only set the LAN IP to 192.168.10.1 and the DHCP range to 192.168.10.0/24, no further changes made.
I am not able to reach the 192.168.1.1 IP from my LAN device.
Just got back home so in a bit I will just reset the Netgate again (it's a 2100 in case that matters but I suppose not) to see if there is a change in behavior. Though that is what I did last night. Just leave everything to default except the LAN IP (192.168.10.1) which caused the DHCP to default to a class C /24 network pool. Oh and I also deselected the blocking of private and bogon IPs on the WAN since the upstream (192.168.1.1) falls into that range.
That's what I did, I'll repeat that setup again to see if for some reason the behavior changes. From what you say it sounds like it should work :)
-
@johnpoz I did another factory reset and am now online using the Netgate 2100 fro, the LAN side. The one thing I did do differently this time is to keep the default LAN network IP. So the Netgate LAN is 192.168.1.0/24, same as the ISP box.
But at least I have internet now. Thanks for the quick reply earlier. I'm going to hang around and soak up a lot of info from this forum
-
@drk said in Do I use NAT?:
So the Netgate LAN is 192.168.1.0/24, same as the ISP box.
that could be very very problematic.. You should change your lan IP to something that doesn't match up with your wan.
-
@drk Iâm surprised itâs working with the same subnet on both sides. Normally a router doesnât know where to send packets.
If youâre trying to use other switch ports for different networks see https://docs.netgate.com/pfsense/en/latest/solutions/netgate-2100/configuring-the-switch-ports.html
By default only LAN has rules allowing traffic . If you add interfaces youâll need to add your own rules e.g.
Block from LAN2 to This Firewall port 443/22
Block from LAN2 to LAN
Allow from LAN2 to any -
@johnpoz @SteveITS yes, exactly, which is why I originally changed the LAN IP to something else. But when I did that, I had the connectivity issues. However having it in the same address range seems to work perfectly fine for some reason. When going to the 192.168.1.1 IP I get the Netgate GUI, and not the ISP box login. So it seems to just be doing alright.
Though I would prefer to move it over to another range though.
I'll have another look and try tomorrow. I managed to move my entire network over without a hitch because it was all in the same range anyway.
-
@steveits @johnpoz I'm happy to say that it all worked out. I managed to get the netgate working as it is supposed to with different LAN segments. The netgate WAN port now receives a public IP which makes things a lot more simple as well. I setup WireGuard and am able to make remote connections with the peers I have configured. This thread can be closed :)
