Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    ATT Internet AIr

    Scheduled Pinned Locked Moved General pfSense Questions
    290 Posts 5 Posters 46.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      ahole4sure @stephenw10
      last edited by

      @stephenw10 not sure

      1 Reply Last reply Reply Quote 0
      • A
        ahole4sure @stephenw10
        last edited by

        @stephenw10
        So for thee reinstall it does ask for rescue from a config.xml file. Then asks me where - I click on ada0 disk. and click ok and it immediately goes baack to thei main install screen

        I first tried ZFS but the end it said I only had one disk, not enough disks for mirror

        I went back to look at UFS install and it gets to a point that it asks if I want to partition the disk and it says it will wipe the disk ....

        Wonn't that then erase my config file ??

        G 1 Reply Last reply Reply Quote 0
        • G
          Gblenn @ahole4sure
          last edited by

          @ahole4sure Sounds like you are in fact looking at a complete reinstall unless you have a backup somewhere? Is it possible you have downloaded some config at some point? It would be in your Downloads folder and is named like : config-pfSense.something-date.xml

          A 1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            Which installer are you using? The Net Installer will ask you where to recover the config from and then shows you that it has recovered a config.

            For ZFS you should choose stripe not mirror if you have just one disk.

            1 Reply Last reply Reply Quote 0
            • A
              ahole4sure @Gblenn
              last edited by

              @Gblenn @stephenw10

              Thanks guys - I spent about 10 hrs yesterday in between snaking out a stopped up drain pipe in our house !!

              Had a time getting HaProxy back up and going

              The other thing I found and came to the conclusion -- the dhclient issue with trying to set the ATT WAN to DHCP -- the problem seems to be on ATT or the Nighthawk end! They seems to work fine (a little glitchy) when connected static but neither connecting straight to the psfsense interface nor via VLAN will the dhclient reliably get an IP, etc

              Thanks for input ! Do you guys use anything to auto backup the pfsense config remotely (not on the pfsense box)

              G 1 Reply Last reply Reply Quote 0
              • G
                Gblenn @ahole4sure
                last edited by

                @ahole4sure Yes it's under Services / Auto Configuration Backup. It backs up your config to Netgate servers for free.

                Just make sure to save the encryption password somewhere...

                1 Reply Last reply Reply Quote 1
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  That ^. Just enable the ACB service.

                  Though I also like to have local backups for convenience. At least recent enough to get back up and running and then pull in the most recent backup from ACB.

                  G 1 Reply Last reply Reply Quote 0
                  • G
                    Gblenn @stephenw10
                    last edited by Gblenn

                    @stephenw10 To be honest, I have never even thought about the ABC service as I always do backups every time I make any material changes. Keep them on my NAS which also has a remote backup for extra safety.

                    But now I'm thinking I might try this as well... it would certainly provide some extra safety.

                    A 1 Reply Last reply Reply Quote 1
                    • A
                      ahole4sure @Gblenn
                      last edited by

                      @Gblenn @stephenw10

                      So after some more work and time for dust to settle after re configuring everthing .. I have gotten 72hr of stable connection from both ATT modems - the one connected directly to the igb2 interface and the one connected to igb3VLAN20

                      However I was never able to reliably get the dhclient to work and to be able to use DHCP for the connecctions
                      I got this form my ATT rep yesterday who was able to talk to ATT backend people - the following was thier response :
                      Below is the response from the ticket I put in:

                      “If a cellular device is in IP Passthrough mode; (NightHawks, AIA-B, etc) they only pass the static IP that is provisioned with a Shared APN, to the backend appliance that is attached, via the RJ45 connection.”

                      Does that make sense that they [ATT] would do this?

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        Not really sure why they would do that. It could simplify the configuration at their end. That doesn't really explain why it works for a while though.

                        A 1 Reply Last reply Reply Quote 0
                        • A
                          ahole4sure @stephenw10
                          last edited by

                          @stephenw10 I agree -- it was even more weird in that when I first connected directly to the interface it configured fine with using DHCP and seemed to remain connected for at lest a couple days. After the VLAN testing started that's when things got really difficult ....

                          On another note - during my debacle with my pfsense box this past weekend (I have a Protectli FW4B) , I ordered a replacement (assuming possible hardware issue). Apparently it was just a software issue and my original device is functioning as it should. Initially I thought about keeping the new device and keeping a spare around since I have 2 business locations dependant on them. The question is - do you thinnk there is much differnce in the Fw4C that I just recieved and any reason to swap out the FW4B for the FW4C?

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            The only significant difference I see are the NICs. The 2.5G NICs on the 4C are faster but auto-negotiate only. If you ever want to use fixed speed igb NICs will do that.

                            A 1 Reply Last reply Reply Quote 0
                            • A
                              ahole4sure @stephenw10
                              last edited by

                              @stephenw10
                              Hey sir thanks again for all your help

                              I have another issue realted to my lost pfsense setup this past weekend ....

                              I have reconfigured haproxy and I think I have things working , mostly

                              My continued problem (and I wanna be sure I solve in the most direct fashion) is as follows:

                              if I go to https://mysyno.mydomain.com externally - then things get point to my NAS and more imprtantly to the proper port for the managment program
                              if I go to https://mysyno.mydomain.com internal (on my LAN) , not only do a get a warning about the website not being secure , when I push past the warning it basically takes me to https://mysyno.mydomain.com:443 (the wrong port)

                              internally if I put https://mysyno.mydomain.com:correctport then it goes corerectly to the management program

                              bottom line is that internal requests seem to be bypassing haproxy

                              I had this working correctly in my setup that I "lost" (by stupidly not having a backup) -- what is the most direct way to fix this??
                              I noticed that in DNS Host Overides section there is no option for entering a port

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                mysyno.mydomain.com resolves to the pfSense WAN IP address?

                                What cert error is shown? What cert is shown?
                                Is it the pfSense webgui cert? That would imply you're hitting a port forward which you shouldn't need with HAProxy.

                                A 4 Replies Last reply Reply Quote 0
                                • A
                                  ahole4sure @stephenw10
                                  last edited by

                                  @stephenw10
                                  I have no ports forwarded
                                  Attached is an example of the cert error when going internally to https://mb.mydomain.comImage 12-12-24 at 5.52 PM.jpeg

                                  1 Reply Last reply Reply Quote 0
                                  • A
                                    ahole4sure @stephenw10
                                    last edited by

                                    @stephenw10

                                    and https://mysyno.mydomain.com resolves to the internal IP 192.168.144 but to port 443
                                    and haproxy is supposed to send it to 192.168.1.144:5001

                                    1 Reply Last reply Reply Quote 0
                                    • A
                                      ahole4sure @stephenw10
                                      last edited by

                                      @stephenw10 and I mean internall

                                      It works correctly externally

                                      1 Reply Last reply Reply Quote 0
                                      • A
                                        ahole4sure @stephenw10
                                        last edited by ahole4sure

                                        @stephenw10

                                        So I activated NAT Reflection > Pure NAT

                                        I now can access several of my services internally and externally — all of which are https through harrows

                                        The only remaining issue, even after enabling the NAT reflection, is the firewall interface which is reachable external via https://pf.mydomain.com
                                        But internally only available by adding the port :8000

                                        So NAT reflection fixed everything except firewall management page!IMG_0373.jpeg IMG_0374.png IMG_0375.png IMG_0376.jpeg

                                        stephenw10S 1 Reply Last reply Reply Quote 0
                                        • stephenw10S
                                          stephenw10 Netgate Administrator @ahole4sure
                                          last edited by

                                          @ahole4sure said in ATT Internet AIr:

                                          So I activated NAT Reflection > Pure NAT

                                          I now can access several of my services internally and externally

                                          Then it's not using HAProxy since that would redirect traffic past HAProxy entirely. NAT reflection only works with port forwards and you shouldn't have any of those if you're using HAProxy. It sounbds like you must have them though.

                                          You have the pfSense webgui set to use port 8000 directly?
                                          Do you still have the port redirect enabled in Sys > Adv > Admin Access: WebGUI redirect ?
                                          That should redirect http requests to https on port 8000.

                                          A 1 Reply Last reply Reply Quote 0
                                          • A
                                            ahole4sure @stephenw10
                                            last edited by

                                            @stephenw10 I have NO port forwards
                                            see pic

                                            I have been trying to get something else to work. I saw a post where someone did an haproxy frontend on to listen on the LAN and then forward to the correct port
                                            see pic

                                            Image 12-13-24 at 7.17 AM.jpeg

                                            I was thinking it was working last noght but then when I got up this AM it didn't seem to be working , BUT after i reached the firewall by 192.168.1.1:8000 the forst time , it then began working

                                            Also wondering if I should have my wildcard domain cert here or should I leave as the default webui config?
                                            ssee pics

                                            Image 12-13-24 at 7.18 AM.jpeg

                                            Image 12-13-24 at 7.19 AM.jpeg

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.