Looking for help re-arranging my network

TheBetterSort

@TheBetterSort:

As I mentioned before, No. It will only hand out IPs if I change the IP to something other than 192.168.1.1.
This is with NOTHING ELSE connected.

Eh. Have you rebooted the devices (the DHCP clients)?

Yes.

edit: After rebooting the pfSense box itself, now it will accept devices as 192.168.1.1.

doktornotor

Well, then post some screenshots of the configuration. I'd once again urge you to consider that you can only have one and exactly one DHCP server on any one network normally. Definitely STILL not convinced even about this being the case, considering "Also, If I turn off WAN and DHCP on the DD-WRT router, I lose the ability to go to it's configuration page…"

kejianshi

Please tell me exactly how your internet flows. From the ISP > Modem > PFsense.
How many NIC ports does pfsense have?

(This is a physical machine? I'd hate to find out on page 4 of the thread its a VM)

Also, tell me how you went about assigning WAN and LAN?
Are you 100% sure you don't have your WAN and LAN cables swapped on pfsense? Thats crazy easy to do.
Unplugging a cable then plugging it back in should show which interface was affected. That will make it easy to know if you swapped them by accident.
If you plug and unplug a cable into both ports seperately and the other end is attached to a computer it will tell you which interface that is. For example em0.
Make sure the interface you are calling LAN is actually correct.
Once, I even accidentally assigned LAN to a firewire interface… YES it can happen.

Assuming they are not swapped. Did the WAN get an IP from your ISP?

If it did, lets get into IP assignment on the LAN

did you make its IP 192.168.1.1? did you tell it to use DHCP on that interface? And then did you assign a DHCP range that doesn't overlap with the IPs your DDWRT switches will use? for instance start at 192.168.1.55 and end 192.168.1.155 (leaving big gaps before 55 and after 155 for static maps)?

If there is something wrong with those assignments you can reassign interfaces or IPs via the pfsense console. (I assume there is a monitor/keyboard attached)

kejianshi

doktornotor is right. Configuring the DDWRT correctly as switch REQUIRES shutting off its DHCP as final step. If you don't get all those services turned off, it will break pfsense. You will later be able to access the DDWRT menues via static IP you should have assigned it. What you do is as you are disabling this and that service in DDWRT, at every screen you SAVE settings (NOT APPLY). Then after you are sure all the setting are correct. Firewall all set to off, no SPI, no routing, no DHCP, no services like VPNs active and everything. And you have set a static IP. Then you APPLY settings and reboot DDWRT. Hope you wrote down its static IP, admin username and password because that is where you will access it on the LAN.

If you made even the slightest deviation from this, you will only break your network.

TheBetterSort

This is my configuration. And yes, the WAN got a public IP.
I set the LAN IP to 192.168.1.1 (this works now), I started DHCP and gave it a range of 192.168.1.100-192.168.1.254

And yeah, there's a monitor and keyboard attached.

podilarius

Have done anything with the outbound NAT? Again, if you traceroute from a computer on the LAN to say 8.8.8.8, what do you get?

kejianshi

Your network is arranged fine.
If pfsense hands out DHCP after a reboot and workd without DDWRT attached the DDWRT is a problem.

Need to make sure all services on it are off. It will work, although it needs to be exactly correct.

TheBetterSort

Alright, I'm going to set it all up again. I'll be back in a few minutes when I get internet access again.

Thanks, all.

kejianshi

Another little trick I do is I save several configurations of DDWRT.

I set it up as a basic wireless router then I save the config on thumbdrive.
I set it up as a wireless router and with a Openvpn Client to pfsense then I save the config on thumbdrive.
I set it up as switch and wireless AP then save the config on thumbdrive.

Then later, if I get ready to go somewhere, I can just restore the openvpn client config grab it and go.
When I'm back home, restore the switch/AP settings.

Very convenient. If you don't miss some little setting and break pfsense.

TheBetterSort

Alright, I changed some settings and now things are working ALMOST as they should.
From here on out, they're DD-WRT config problems.

The wireless radios never come up. So I have no wireless.
Also, could you please give me step by step instructions on how to get to the DD-WRT configuration page when it's set up this way?

The pfSense box's IP is 192.168.1.1 and the DD-WRT switch's IP is 192.168.1.2

kejianshi

well - I always go to http://192.168.1.2 or https://192.168.1.2

(hope you didn't turn off access to the administration)

After that, you can turn on wireless and set that up. (I use E2000s for this. They are "slower" but super compatible)

I have several nice high dollar switches in the basement that are plugged directly into pfsense. I have dual CAT6 cables to all rooms in the house. I usually attach a DDWRT to those in the rooms on the second and third floor for additional switch ports and AP and because I like to have wireless N if I want it.

TheBetterSort

I tried that, but It doesn't work. It times out. I can't ping it either.

And yes, web administration and remote administration are both on.

Please don't tell me I have to restart again.

johnpoz

"DD-WRT switch's IP is 192.168.1.2"

So why would you need to ask how to access its configuration page if you set its IP?? How do you think you would access it?? How were you accessing them/it before??

kejianshi

DDWRT will just sit there like a big dumb SH$% if it doesn't get its IP from pfsense. Is it getting an IP? Can you access the pfsense menu to check?
(This has turned into more of a DDWRT issue than pfsense issue, so not best site to get that answer. But I know the answer so I'll answer)
Technically bad form though I suppose.

kejianshi

"I can't ping it either". Makes me think SPI firewall is still running. I've never actually tried to ping mine but I'll give it a shot.
Also, incase you handled the deactivation and allocation of the wan port wrong on DDWRT, put all cables on only the "LAN" ports. And try.

Ping works for me… And Web GUIs

johnpoz

Its a LAN PORT, that can be a dhcp server it sure an the hell is not using dhcp to get an IP address.. If you set it up to 192.168.1.2 then that is what you would access it on. If you can not ping it, it has nothing to do with the firewall - since that is from the wan side you would have to enable it to answer ping. Lan answers ping out of the box.

Your firewall is not going to be doing anything on dd-wrt because it only works between the lan/wlan bridge and the internet - it does not do anything between wlan/lan - so you might as well just disable it to save resources, etc.

If you set it IP correctly, and are connected to its lan ports with correct IP on that same network then if you can not ping it - you setup its IP wrong, you have a bad cable or your box your using is not correct ip, etc.. Or port is bad on dd-wrt lan or our pc..

Troubleshoot layer 1, then 2 then 3 – its really easy ;) is your cable good.. Do you see mac? etc..

Setting up a router as ap is like a 2 min thing.. You assign it an IP, disable its dhcp server - connect to its IP and setup wlan.. If you spend more than 5 minutes tops you got something major wrong!

kejianshi

Yeah - I can sympathize… Even knowing exactly how something should be, I've been baffled by some pretty stupid stuff before. Soooo simple like "why the hell did I plug my WAN cable into my LAN port... When did I do this?". Stuff that makes me want to slap myself.

Oh - And yesterday my wife upon learning that my laptop screen "turns and swivels" turned it 720 degrees... Trashed it.

That must have taken some serious stubborn twisting.

$4000 Laptop... My GOD must I explain the definition of "swivel"?

TheBetterSort

I can confirm that I turned the SPI firewall off and set it's IP to 192.168.1.2, and that I set the WAN port to Switch.

I really don't know what's going on. Wireless still doesn't work either.

kejianshi

Well - I'm not there so I can't do it personally. I promise you, some setting is wrong. Maybe try doing a hard 30/30/30 reset and start from fresh.
I'm going to read that link you sent and make sure their directions are correct.

johnpoz

so you set wan to switch - so your using wan? Us a actual LAN port!!

Again there is nothing too this, if your having issue than a HARD reset might be in order.. Just reset your dd-wrt router.. Change its IP to your 192.168.1.2, turn off its dhcp server, connect it to your network via one of its lan ports = shazam is a AP.. that is all there is too it! Its at best 2 minutes..

You can tweak and play with other setting later like turning of spi, moving wan port to lan, etc.

connect your pc to its lan port nothing else - if after you change its IP to 192.168.1.2/24 and your pc is on 192.168.1.0/24 and you can not ping it - then you didn't change its IP right ;)