Unable to access Transparent Bridge (WAN/LAN) from LAN
-
@swears123 said in Unable to access Transparent Bridge (WAN/LAN) from LAN:
Do I need any other firewall rules in the LAN1 or WAN interfaces?
The you have to add the rule on the incoming interface, so LAN.
But if it is needed depends on the tunables settings.When I set the Default Gateway to the Cable Modem address (in the Bridge Interface), I receive the following message:
The following input errors were detected:
The gateway address 192.168.100.1 does not lie within one of the chosen interface's subnets.You have to set the network mask properly. You might need a /24.
-
Yes, the bridge or one of the interfaces needs to have an IP to be accessible. That IP needs to be in the UDM WAN subnet (192.168.100.0/24) if pfSense is going to use it to check for updates etc.
It doesn't have to be though as long as the UDM router knows how to reach it.Steve
-
@viragomann said in Unable to access Transparent Bridge (WAN/LAN) from LAN:
But if it is needed depends on the tunables settings.
Thanks. Adding a /24 allowed me to add 192.168.100.1 as the default gateway. However, when I did this the internet no longer worked.
-
@swears123
Are you really sure that you've disable NAT in Firewall > NAT > Outbound? -
@viragomann Correct. Outbound NAT is disabled:
Disable Outbound NAT rule generation.
(No Outbound NAT rules) -
@swears123
I assume you're talking about the internet access on devices in the 10.50.10.xxx network?I cannot think of any reason, why the default gateway on pfSense should have any impact if you have disabled NAT.
What do you get exactly?
Can you still access the modem?Are the routes and the DNS settings correct on the device?
-
Yes, that is correct. Devices on 10.50.10.xxx lose internet when I add the default gateway of 192.168.100.1 in pfsense. As soon as I delete the default gateway, internet returns.
I still have access to the Unifi Console as well as the upstream Cable Modem when the default gateway is added, however, I still cannot access pfsense from the 10.50.10.xxx network.
I haven't made any changes to routes/dns settings so I assume those are okay.
-
@swears123
Does this also happen if you remove the gateway from the interface settings, but add a gateway in System > Gateways and set it as default then? -
@viragomann Yes, it does.
-
@swears123
The gateway is only for pfSense itself. However, without it you should be able to access pfSense from behind the UDM at least. Does this work? -
@viragomann No access to pfsense from behind udm (10.50.10.xxx) network with or without default gateway.
I'm using the IP address 192.168.100.2 for the pfsense bridge interface.
-
What's the UDM WAN IP?
-
@stephenw10 That would be my external ISP IP address (which I don't want to show on here ;) )
I tried setting that as the Gateway in PFSense but I got an error.
-
@swears123 said in Unable to access Transparent Bridge (WAN/LAN) from LAN:
That would be my external ISP IP address (which I don't want to show on here ;) )
No need to post it here, but this is something what should have been mentioned before.
So the UDM does PPPoE or something alike?It needs to have an IP the modems LAN / pfSense network to get access, maybe es an alias and it need to do masquerading to this IP on traffic which is destined to pfSense.
-
@viragomann Fair enough.
WAN on the Unifi set to DHCP and it pulls the external IP (not the modem, I assume by design). I suppose I can try to set a static IP on the Unifi WAN to the modem's IP. Does that make sense?
I don't know anything about masquerading/Alias'.
-
Yes, if the UDM has a PPPoE WAN then the default gateway on pfSense should be an IP on the UDM in the modem subnet. Or no gateway.
Why are you adding pfSense here though? It doesn't appear to be doing anything useful.
-
@swears123
You need an additional IP on WAN aside the DHCP.This is called IP alias in pfSense.An upstream router commonly have masquerading enabled. That means, it translates source IP in upstream packets into its WAN IP.
So since the UDM has a public IP, I expect it does this as well. However, for accessing pfSense you need to translate it to the second WAN IP in 192.168.100.0/24.
If this is not possible you can add a static route for the 10.50.10.0/24 to pfSense and point it the the UDM and hope that it works. -
@stephenw10 Thanks.
I'm looking to offload the firewall/security to the pfsense as the Unifi Dream Router has a very weak CPU and can't seem to handle high throughput with IDS/IPS enabled.
The Unifi uses DHCP on the WAN side to pull the IP (but only shows the external IP, not cable modem IP)
-
@viragomann I added a static route in pfsense to point to 10.50.10.0/24. Is this what you recommended?
-
@swears123
You need to add the UDM IP (this one in 192.168.100.0/24) as gateway first, then add the route for the 10.50.10.0/24 network and point to the UDM gateway.
