Layer 2 connection issue with Android to PC app
-
Hello,
So I don't know if I'm posting this in the right place or not, but it does deal with a Layer 2 issue I'm having. I went to support on this, but it is beyond the scope TAC Lite support and I was advised to ask here. I'm a beginner at this stuff, so anyway here goes. I am using a SG-1100 by the way.
My issue has to do with an Android app called Sweech and what this does is when you turn it on, it gives you an IP address to put into a browser address bar. For example, 192.168.0.x:4444 (where x ranges from 3-7). Upon doing that, it connects you to a WebUI where you can easily move files between the phone and PC wirelessly. However, the connection times out when the 1100 is in the mix. When it's not, the app works as intended.
I was advised by support staff that this app works by allowing connections between devices on the same Layer 2 broadcast domain and as such, this is unlikely to be a firewall issue and that it is likely something incidental to the firewall being in place. I don't yet know enough about how all this works and so I don't even know where to begin to look for how to resolve this.
My know-how with networking is fairly weak, so I don't have much experience tweaking this stuff. My setup is just a cable modem (ARRIS Surfboard) going to the 1100 going to the back of this PC. No fancy settings on the ARRIS and the 1100 is running on default settings. I just reinstalled pfsense on it via USB and updated it. I only did enough to get it working with my network connection and configured nothing beyond that.
If anyone here has any ideas or want me to try to get some information. let me know how to do that and I'll do that as soon as possible. My replies may be sporadic.
Thanks in advance for any assistance and sorry for the long post. I wanted to give as much info as possible.
-
@sessh said in Layer 2 connection issue with Android to PC app:
this app works by allowing connections between devices on the same Layer 2 broadcast domain and as such
Which would have zero to do with pfsense, zero!
What are you using for wifi?
So your pc is connected to pfsense via a wire.. Where are you running sweech, on your phone, a tablet? How is on this same network as your pc? You running some wifi router, an AP?
-
@johnpoz
I bet he is using ARRIS surfboard wifi which will end up being on the WAN side of pfsense -
@kiokoman said in Layer 2 connection issue with Android to PC app:
ARRIS surfboard wifi
they make a gateway that is true i guess G54, or like a SBG8300 or something.. Those are not cable "modems" like he said.
But yeah putting a Layer 3 router between your L2 networks would kind of break such software ;)
Wouldn't he notice that his Ips are on different networks.. Ah his 192.168.0 vs pfsense default 192.168.1
good catch!
-
@sessh said in Layer 2 connection issue with Android to PC app:
between devices on the same Layer 2 broadcast domain and as such
This means you have to be on the same LAN, with no routers in between. This is not a pfSense issue.
-
Thanks for the replies.
Yes the support guys said it was likely not a firewall issue and was incidental to the firewall being put in place. My apologies if it wasn't appropriate to ask here, but that's what support staff suggested I do.
I am using Sweech on an Android phone.
Yes I am using the wifi on the ARRIS Surfboard SBG7580AC Modem/Router combo. Based on what you guys are saying, it sounds like this isn't really fixable? Is that right? So.. it's not working because I connect via 192.168.0 for Sweech but the 1100 is on 192.168.1 and this is the issue?
-
@sessh Its fixable - just use wifi behind pfsense. Get an AP, or use some wifi router you get as just an AP. So the 2 devices you want to use this software on are on the same L2 network.
-
Ok, I think I get it now. It's connected to wifi that's on the 192.168.0 LAN which is upstream of the 1100. I assume when you say "behind pfsense", you mean downstream of the 1100 correct? Then if the phone is connected to that wifi, it will use the 192.168.1 LAN instead. The issue is that currently, it's connected to the LAN in front of the 1100 and is therefore not getting through it to the PC. Do I have that right? @johnpoz
Sorry again if my question annoyed anyone here due to it not being an issue with pfsense. I do appreciate the replies. I did search around based on what you told me prior to this recent message. I'm tryin! :)
-
@sessh exactly... You have a L2 in front of pfsense or upstream - pfsense wan.. your 192.168.0 network. Then your L2 network behind pfsense or downstream of it pfsense LAN.. Which is the 192.168.1 network..
Devices can talk to each other if you allow via firewall rules, and or port forwards if going from wan to lan, etc. But not sure what ports that software uses, etc. Or even if designed so it could talk via the software. From the quick reading I did on that software - the 2 devices that you want to share files between need to be on the same L2/L3 network. So either both your devices need to be on pfsense wan or lan network.
Normally when users want upgrade to using pfsense, they put the wifi behind pfsense, on its LAN or another vlan behind pfsense, etc.
Get another AP to use as your wifi, so all devices are on pfsense LAN, the 192.168.1 network. Then they can use that software to share files if you want.
-
I see. People would usually have a dedicated router and put that behind the pfsense instead of having a modem/router combo sitting in front of it. I was planning on grabbing a router/AP already anyway eventually. Hopefully I can ask around here for the best way to set that up with the 1100 when I get there. @johnpoz
Also I believe the program uses port 4444 by default and I think I can change that.
-
@sessh well unless your blocking access on port 4444 in pfsense, your device on your lan where the default rules are any any should be able to talk to your phone/tablet on your wifi on the wan IP 192.168.0.x from its 192.168.1.x address.
What you wouldn't be able to do is talk from your wifi network to something behind pfsense on its lan without setting up a port forward.
You already have a router pfsense - you just need an AP.. I would suggest something that can do vlans.. So in the future if you want you can create multiple wifi networks that are on different networks.
the only reason a device on your lan say 192.168.1.x couldn't talk to 192.168.0.x:4444 would be if you altered the default lan rules. Or doing some sort of policy routing where your sending traffic on your pfsense lan out some vpn or something.
-
@johnpoz That's the thing though. I haven't changed any of the rules, I assume you're talking about the rules in Firewall / Rules / LAN in the pfsense UI right? It's all default. I had an issue where I needed to reinstall pfsense via USB which went successfully, so whatever got set during that process is what it's set at now. I didn't manually change anything myself. Even before having that issue, out of the box, this issue was present.
I actually can't even log into the modem's UI because it's at 192.168.0.39
-
So if I have this right, you're saying that unless I changed the default rules (I haven't), 192.168.0.3:4444 should have no issues connecting through the 1100. Yet this isn't working.
Am I to assume there are no rules or settings that can be put into place to allow this connection to happen or even to allow certain IP addresses from the 192.168.0.x network to pass through by the 1100? The only option is to buy a router/AP (I use those interchangeably because I am under the impression that almost all routers you can buy today can function as an AP) and that's all? It doesn't seem like that option would allow me to connect to the modem UI via 192.168.0.39 either based on this conversation. There's really no options here to make this work other than just removing the 1100 entirely?
-
@sessh said in Layer 2 connection issue with Android to PC app:
So if I have this right, you're saying that unless I changed the default rules (I haven't), 192.168.0.3:4444 should have no issues connecting through the 1100. Yet this isn't working.
No, johnpoz is saying you should have no issue connecting TO 192.168.0.3:4444 residing on the WAN side (LAN of Arris) FROM a browser on your pfsense LAN (192.168.1.NNN). Since this is an outgoing connection and similar to you accessing any webpage on the internet.
I actually can't even log into the modem's UI because it's at 192.168.0.39
This is strange however... and you are positive this is the IP of the modem? And is the WAN IP on pfsense also in the 192.168.0.N subnet, or do you have a public IP perhaps?
Am I to assume there are no rules or settings that can be put into place to allow this connection to happen or even to allow certain IP addresses from the 192.168.0.x network to pass through by the 1100?
It should work as long as the connection is inititated from inside pfsense (LAN side). However, for anything to connect with something on the LAN side of pfsense, you need to start opening ports. So if you had the PC on the 192.168.0 side, you would create a NAT rule opening port 4444 towards 192.168.1.3 (Android phone). Since this seems to be the direction Sweech is working?
The only option is to buy a router/AP (I use those interchangeably because I am under the impression that almost >all routers you can buy today can function as an AP) and that's all? It doesn't seem like that option would allow >me to connect to the modem UI via 192.168.0.39 either based on this conversation. There's really no options here >to make this work other than just removing the 1100 entirely?
As already pointed out, when upgrading to pfsense, you probably want to make use of it for everything, not just LAN connections. This would typically mean that you move wifi so that it resides on the LAN side of pfsense. Commonly some form of AP is used (as the are often cheaper than routers even if routers can function as APs). It also means turning off wifi on the ISP provided device, or in some cases ditching it alltogether and connecting directly into pfsense. Alternatively you turn on bridge mode on the Arris, which would give you a public IP on pfsense.
And as I already said, it's strange that you can't connect to the Arris UI, there shouldn't be anything blocking that.
-
@sessh the only think I could think of why you couldn't access the UI of your router in front of pfsense, is put it into bridge mode and pfsense gets a public IP? Or your using maybe a PPPoE type of connection on pfsense. Or you policy routing?
Does pfsense wan have an IP on the 192.168.0 network?
Oh other thing that could cause a problem is the mask on the 192.168 networks - are they both /24?
-
Ok wait.. just to clarify something before going further. When you say:
@johnpoz Or doing some sort of policy routing where your sending traffic on your pfsense lan out some vpn or something.
.. are you referring to having a VPN installed on the 1100 or having one involved at all on any of the devices connected to the 1100 LAN? I assumed it was the former, but there is one on the PC and one the phone (on 192.168.0). However, I have both Sweech and one of the browsers on the PC in split tunneling mode, so it shouldn't be affecting anything when using that browser? Is that wrong? I just verified that the one browser is using my real IP with the correct location. Even using that one, I still can't connect to 192.168.0.39.
The PC is connected via Ethernet to the 1100, so the PC is on the 192.168.1 side. The phone is on the 192.168.0 side along with the Arris. On the main pfsense Dashboard page where it lists the Interfaces on the bottom right, it says the WAN is 192.168.0.4 and the LAN is on 192.168.1.1.
I can connect to 192.168.0.39 and Sweech if I connect to the Arris via Ethernet or wireless using a laptop and I can access 192.168.0.39 from the phone, but then I can't connect to the 1100. It's either one or the other. So, I am positive that 192.168.0.39 is the IP to log into the Arris.
So provided there's no issues with that, I will try creating that NAT rule to open a port for Sweech.
-
@sessh Hmm, the split tunnel may not cover 192.168.0 network, only the 192.168.1 that the PC actually knows about. So what happens if you disable the VPN completely on the PC? I have that exact problem with my work PC...
-
@sessh said in Layer 2 connection issue with Android to PC app:
So provided there's no issues with that, I will try creating that NAT rule to open a port for Sweech.
you don't need a port forward for something on your lan talking to your wireless device.. But yeah a vpn on that device would mess that access.
Also if your going to create a port forward from your wifi to your lan behind pfsense, the vpn on the device on your lan would still mess with that.. And you would have to access your 192.168.0.x IP of pfsense wan that you forward to the 192.168.1.x on your pfsense lan.
-
@sessh said in Layer 2 connection issue with Android to PC app:
Ok wait.. just to clarify something before going further. When you say:
@johnpoz Or doing some sort of policy routing where your sending traffic on your pfsense lan out some vpn or something.
.. are you referring to having a VPN installed on the 1100 or having one involved at all on any of the devices connected to the 1100 LAN? I assumed it was the former, but there is one on the PC and one the phone (on 192.168.0). However, I have both Sweech and one of the browsers on the PC in split tunneling mode, so it shouldn't be affecting anything when using that browser? Is that wrong? I just verified that the one browser is using my real IP with the correct location. Even using that one, I still can't connect to 192.168.0.39.
If you are able to edit the settings for the VPN, then on the phone, you might need to add the 192.168.1.0/24 network to the IP range to EXCLUDE from VPN. And on the PC you definitely have to do the same, but here it is 192.168.0.0/24 network that should be excluded.
But a quicker way to test is from the PC where you simply disable the VPN and then try to log on to the Arris. -
@Gblenn said
Hmm, the split tunnel may not cover 192.168.0 network, only the 192.168.1 that the PC actually knows about. So what happens if you disable the VPN completely on the PC? I have that exact problem with my work PC...
This was correct. When i disable the VPN and try to access the Arris or Sweech, it allows me to do it from the PC. I use NordVPN and unfortunately, they don't seem to have made it easy to whitelist IP addresses at least on Windows. (I'm not yet on to Linux, but soon!) I might just switch VPN providers, I've kinda been looking for a reason anyway. It seems other VPNs make this a lot easier to do.
At any rate, I'm glad you guys were able to help me at least find out why this is happening even if I can't fix it via VPN whitelisting. Networking has always been a hole in my tech knowledge base, so perhaps it's time to improve on that. :)