GigaClear Install,.. any advice....
-
After several yrs of BT,.. and their FTTC service,.. delivering a 72/20MBps Up/Down speeds,... and even though I am probably only a few hundred yard from the 'cabinet',. ( and even closer to the exchange ),.. I have noticed that over time ( several months ),.. this speed begins to roll-off,... and the longer I leave it,.. the more degraded the signal becomes,... Having chatted on this forum trying to resolve my poor performance it seems the truth was probably out of my control.If after some months I tweak BT,.. they send someone out,.. (I assume ) they fiddle with the copper in the cabinet,.. and full speed is resumed for a few more months.
current Pfsense s/w is Version 2.8.1-RELEASE (amd64)So trying to turn a new leaf,.. I have decided to see how fibre with Gigaclear performs,.. I have seen how customer service was an issue in the early days,.. but what do I have to loose,..
In an effort to pre-empt any pfsense config issues I need to perform...ATM,. I have a simple PPPoE connection via my 1_WAN h/w connection,.. this has a few rules under it, which redirect some connections/ ports to enable connection to 'local' media devices etc.
I have a spare port on my pfsense h/w box which I have designated '2_WAN',.. to which I plan to connect the Gigaclear supplied router and 'unfiltered ip' port to, as I was told.My local network is connected via LAN1, which has a simple rule connecting * to *,.. as per image
Some things I am trying to rationalise in my mind, is if the gigaclear router 'gets' its own ip address,.. how do I map this to my 2_WAN port... which will be on a different IP range... do I change to ip address of my 2_WAN port...
Please forgive me if these are 'dumb' questions,.. I am just looking for some help and guidance... which may help others... who have faced/and facing the same questions..
Many Tx
KR -
If it's behind Gigaclear's router then the pfSense WAN_2 port will be in the private subnet that router is using on it's LAN.
So the biggest issue you might face there is a subnet conflict if it's using 192.168.1.X and you are also using that on pfSense's LAN.
You can probably remove the Gigaclear router entirely and just connect to pfSense dircetly so it gets a public IP on WAN_2. That depends how they are providing the connection though.
-
The first thing I’d check before moving cables is the addressing. If the Gigaclear box hands 2_WAN something like 192.168.1.x and your LAN is also 192.168.1.0/24, change one side before testing or routing will look broken in odd ways. If you keep their router in front, pfSense just treats 2_WAN as DHCP on that private subnet and any inbound forwards may need to be done on both devices unless the unfiltered IP mode is really bridge/DMZ. If the ONT/router can be bypassed, direct pfSense on WAN_2 is cleaner, but confirm whether they require DHCP, PPPoE, VLAN tagging, or a specific MAC first.
-
tx for the responses guys,... fyi,.. my local LAN is on a 192.168.3 x network...
just looking at connection types... and I think I need to find out what the actual hardware is.... -
I'd expect it to 'just work' then. But it would be better to put the public IP on pfSense directly if you can.
-
@stephenw10
Fingers crossed,... ( Trying to understand the config ) Looking at the system>Routing>Gateways menus.... I currently see 1_WAN_PPPOE as the default route....
This is thus defining the way any internal LANs make a connection to the WAN with Appropriate rules....... if I edit these there is an option to 'Disable' these routes,... or to mark the Gateway as 'Down',.... either will stop IP traffic from being routed down this connection....
I assume,... that when 2_WAN is live ,.. it will be seen as the default gateway,.. and route IP traffic via 2_WAN....
And,.. I setup a Rule ( * to * ipv4 and 6 as shown in png above) to link 2_WAN to LAN1,
Are there any other settings I need to be aware of???
Pls say, if I am barking up the wrong tree,.. I am just trying to ensure I don't put my foot in it.... and screw things up..
thankyou.. -
You can set the system default gateway there in System > Routing > Gateways. If nothing else is set that setting will determine which WAN all traffic uses,
You can setup a failover gateway group and set that as the system default gateway. Then it will failover all traffic as defined in that group. Note you cannot use a load-balancing group there.
In addition you can policy route specific traffic by setting a gateway or gateway group on firewall rules as you mentioned. That will override the system routing so you can set, for example, a specific internal client to use WAN1 whilst everything else uses WAN2.
See: https://docs.netgate.com/pfsense/en/latest/multiwan/strategies.html
-
@stephenw10
OK gigaclear install to the property complete,..
External Box to join external cable/fibre to single fibre which is then fed into the property
This then connects to the fibre to fibre modem,...
The GigaClear install the connect this to the Amazon managed eero router,.. quite a heavy box that seems quite impressive...
Any way I digress,...
Having connected the modem directly to the my pfsense box,... I have managed to configure a 2_WAN connection, I 1st had to disable kia dhcp on 2_WAN, so the connection would attach to the modem supplied IP address of the format 10.xx.104.241... with DHCP connection type, this seems to randomly change as the config changes/updates,.. so not static.
and having disabled 1_WAN,.. 2_WAN became to default route I added a rule to link from 2_WAN to LAN1,... and bingo...
internet speed of,..
After being slightly side tracked by a down server,.. ( we had a brown-out last night and my server had not recovered , so it needed sorting with a full power off - on )
Upon my return to my admin computer,.. internet access was gone,.. site unreachable,.. and I had changed nothing,...
After some prolonged config changes,,. and many failures to connect,.. I resorted to a pfsense pre-update config file,.. (thank-goodness for backup configs )
An can now connect via the old BT PPPoE connection...
Am I missing something or is the modem expecting to 'only' talk to a eero router.... and it times out...
I have tried creating various 'routes' for IPv4 and 6 but to no avail
with a rule to connect,...
Any thoughts... suggestions...
Thankyou... -
That firewall rule on LAN does nothing. It matches the single address on the pfSense LAN as source and that's already inside the firewall. And the destination is the single address on the WAN2 interface which you're unlikely to ever try accessing.
If you're trying to force LAN traffic via WAN2, while leaving WAN1 as the default route, you need to set the WAN2 gateway on the allow any rule.
What's does WAN2 look like in Status > Interfaces? Does the WAN2 gateway show as up?
-
@stephenw10
Am I messing the rules up... so I need allow any to any in the 2_WAN interface,. so that rule links the LANs to the WAN... but the rule is a 2_WAN rule,.. and NOT a LAN rule... -
Ah it's a 100.x.x.x address (not 10.) so CGN. Unfortunate but should work fine.
No you don't need any rules on either WAN.
The route LAN traffic takes is determined by the system routing in System > Routing > Gateways.
Unless it is policy routed by a firewall rule on the LAN on the way out.
So if you want to use WAN2 either set it as the default gateway or add it as a gateway on your pass any rule on LAN.
See: https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html#configuring-firewall-rules-for-policy-routing -
Thanks followed what you said...
Disabled kia DHCP on 2_WAN
Enabled 2_WAN as type DHCP,..
Rules as follows :
should my 2_WAN any to any Rule be at the top or bottom of the list,.. as this will determine how things are processed,...
I do like this... lets me see how long it stays,.. once I disable 1_WAN... ( btw Whats CGN pls)
-
2_WAN seems to have become the default,.. by default... -
If you leave the default route set to automatic pfSense will switch to the next available gateway when if the current one goes down. That may not be a gateway you want.
I always recommend setting a gateway or gateway group there.Where are those firewall rules set? That's the LAN interface?
Those rules look very wrong!
The '2_WAN address' is just the interface address. It's not anything else like other public IPs on the internet. The
2_WAN subnetis only the 2_WAN address and the gateway. Still not anything else on the internet.More importantly the LAN rules filter traffic coming into the LAN interface. That means they can only come from the LAN subnet. They can never have any 2_WAN address/subnet as source.
But all of those rules are below the allow all rule so nothing will ever hit them. All traffic from LAN will be passed by the allow all rule without any gateway set.
-
@stephenw10
Thankyou for your guidence....
Ah,.. CGN,.. Found this reference stuff for anyone following along:
CGNAT vs. Local Private IPs
While you might sometimes see IP addresses starting with 10. in local area networks, the 100.64.x.x range is completely different. [1, 2]
• The 10.0.0.0/8 range is for your local private network (e.g., home or office routers).
• The 100.64.0.0/10 range is the dedicated ISP Shared Address Space. [1, 2, 3, 4]
If your device—like a mobile phone on cellular data or a router connected to an ISP—has an IP address starting with 100.64. to 100.127., it indicates you are behind CGNAThttps://en.wikipedia.org/wiki/Carrier-grade_NAT
.
Anyway my Rules... I did wonder about them,. but 'there what the system put in for me',. so I assumed they were sort of 'default rules, however when I looked I realised they were copies of old rules I had started to play with when I first created my system some 6 yrs ago, so of no use now.
So deleted them,. and back to basics to see what I really needed.. I have now settled on the following as my base rule set....
for the WAN
and for the LAN
I have spent most of yesterday trying to get 'Port Forwarding', working again,...(hence the disabled ICMP rule on the WAN), to ping test to my modem,... but this does not work...
I used the commandcurl -4 icanhazip.comto find out what my external IP address is,.. but I have not been able to connect or ping this address,.. or am I missing the obvious.
As the displayed address for the pfsense interfaces WAN address,.. which is different to the ' icanhazip.com' returned address, as one might expect with a CGN address range.
Am I making some incorrect assumptions ,.. -
You don't need a pass rule on any WAN to allow outbound internet access.
Rules on the WAN interfaces only filter inbound traffic. All outbound traffic is allowed by default. Only floating rules can be set as outbound.
So the only pass rules you would normally have on a WAN are for port forwards or services running on the firewall itself.
Outbound internet connections are filtered where they come into the firewall, on the LAN interface here.
If you want to policy route traffic via a specific gateway that is where you would set it. So in your example almost all traffic is being passed by the 'Browsing ports rule'. You can see it currently doesn't have a gateway set. If you edit that rule and set the 2_WAN gateway in the advanced section then that browsing traffic will be forced via 2_WAN.You will not be able to get port forwards working using 2_WAN because it is using CG-NAT. You are given a 100.66.x.x IP address but that is not publicly routable. The ISP is NATing you to that address from a real public IP and hence external traffic cannot reach the pfSense 2_WAN interface.
-
Thankyou Stephen,..
@stephenw10 said in GigaClear Install,.. any advice....:So the only pass rules you would normally have on a WAN are for port forwards or services running on the firewall itself.
..So I don't even need the !Private_IPv4s rule on the WAN?,.. or should this be on the LAN.
@stephenw10 said in GigaClear Install,.. any advice....:
You will not be able to get port forwards working using 2_WAN because it is using CG-NAT.
Ah that explains my fruitless attempts to get it working,..
Spoke with GigaClear this morning,.. No problem,. 'we'll set you up with a fixed IP,.. it will take about 30mins,.. and ATM there is no charge as the billing mechanism is broken'.
That's a winner winner in my books...That makes so much more sense with your little ( big) pointers,... Tx again
-
@diyhouse said in GigaClear Install,.. any advice....:
Spoke with GigaClear this morning,.. No problem,. 'we'll set you up with a fixed IP,.. it will take about 30mins,.. and ATM there is no charge as the billing mechanism is broken'.
Ha, nice. Yeah that's pretty big win.
@diyhouse said in GigaClear Install,.. any advice....:
..So I don't even need the !Private_IPv4s rule on the WAN?,.. or should this be on the LAN.
Exactly, you don't need that rule. Rules on any WAN interface only filter inbound connections.
Filtering traffic from LAN side clients opening connections to the internet is done on the LAN interface, yes. And that includes policy routing any traffic you might want to there.So you might have a general rule that sends traffic from the LAN subnet to a gateway failover group. And then above that have a specific rule for a single LAN IP to just one WAN. Or to a failover group that goes the other way so it has priority. There are a lot of combinations!
-
@stephenw10
Tx Stephen,... went out AM and when I came back IP had changed andsaid in GigaClear Install,.. any advice....:
curl -4 icanhazip.com
showed the same address as pfsense interfaces...
Then although my initial activity to get mythtv working was not working... I could see the Rule was actually processing data,.. further research on the mythTV side showed there had been security enhancements which I was now not accounted for.
As other apps were working.So thumbs up from me... GigaClear is delivering so far, albeit a small sample window
So, we shall see how this provider performs,.. so far I have no issues,. ( good, almost immediate customer service action ). speed is approx. 5x what I had with BT,.. at approx. 1/3 the price of BT... so I am not complaining..
