Can't access from WAN to LAN



  • Hi

    I got this issue.

    My setup:

    WAN: ISP UPLINK
    LAN: Public IP

    I can't ping to a public ip (switch) behind lan from remote (external network)
    I CAN ping from the firewall to the ip which is behind LAN…

    IP is 62.116.200.140

    What have I done wrong? Since i can ping from the firewall itself, i assume it is a setting on firewall which is blocking access from outside.







  • Rebel Alliance Global Moderator

    You can not just put a public IP on your lan and expect it to work, by default pfsense is going to NAT. Did you disable that - and is that public IP space you put on your lan actually routed to you?



  • I see, but NAT is "disabled" - there is no rules for nat or options which indicate that NAT is ON….
    Yes is it public.


  • Rebel Alliance Global Moderator

    I agree that address is public.. And I can ping the IP on your wan.

    ping 62.116.223.134
    PING 62.116.223.134 (62.116.223.134) 56(84) bytes of data.
    64 bytes from 62.116.223.134: icmp_seq=1 ttl=45 time=132 ms
    64 bytes from 62.116.223.134: icmp_seq=2 ttl=45 time=129 ms

    But if I do a traceroute to that network you put on the LAN, I don't end up at your wan IP.. So how is it that network your putting on the lan is routed to you??

    
     traceroute -n -I 62.116.200.129
    traceroute to 62.116.200.129 (62.116.200.129), 30 hops max, 60 byte packets
    
     <snipped>14  4.69.143.173  127.475 ms  128.839 ms  127.217 ms
    15  4.69.142.169  126.735 ms  126.078 ms  125.980 ms
    16  4.69.137.154  129.194 ms  129.897 ms  129.892 ms
    17  212.73.252.6  126.615 ms  131.071 ms  129.711 ms
    18  93.176.93.105  130.944 ms  127.205 ms  126.893 ms
    19  93.176.93.105  4741.391 ms !H * *</snipped> 
    

    that !H is telling me that 93.176.93.105 doesn't know how to get to next hop, or that he should be able to talk to that IP, but its not answering, doesn't have mac, etc.  You sure that network is not suppose to be on the WAN of your box?  There is a huge difference between an ISP giving you a network to use, and routing a network to you.

    But I can trace to your wan

    
    16  4.69.137.154  131.230 ms  132.737 ms  132.722 ms
    17  212.73.252.6  132.034 ms  126.071 ms  129.847 ms
    18  93.176.93.105  125.747 ms  127.097 ms  127.168 ms
    19  62.116.223.134  127.476 ms  130.852 ms  131.720 ms
    
    

    See that 93.176.93.105 knows how to get to your wan address, but seems not to know how to get to that network you put on your LAN.


  • Rebel Alliance Global Moderator

    Where is the info from your ISP that that 62.116.200.128/27 is routed to your 62.116.223.134 address?

    As you can see from the trace - no it does not route to your wan IP…  From what it looks like to me is that network should directly be connected to that last hop.. !H normally means the host is not reachable.



  • @johnpoz:

    Where is the info from your ISP that that 62.116.200.128/27 is routed to your 62.116.223.134 address?

    As you can see from the trace - no it does not route to your wan IP…  From what it looks like to me is that network should directly be connected to that last hop.. !H normally means the host is not reachable.

    My ISP gave the info, and using it on that way is also working very well - as long as I don't have pfsense in middle.
    I can ex. give my host all static ip on 62.116.200.128/27 network with gateway 62.116.223.133 or .134 (with pfsense). They all works great.


  • Rebel Alliance Global Moderator

    Again there is a HUGE difference between an ISP giving you a netblock to use - and routing that netblock to you.

    As to your hosts working from behind pfsense..  Outbound - ok, if you give a host an IP on 62.116.200.128/27 and then set his gateway to 62.116.223.133 – that is not really a valid configuration.  Your gateway needs to be on your actual network!!

    Thought you said you turned off NAT?  Not from the creds you sent me, I just logged in an your nat is still there..

    These details your ISP gave you about that /27 -- did they give you a gateway for that network?




  • Sorry, i did delete the outbound rules, but tried to set it on (another interface). no difference.

    Now deleted again.

    PM on the way….


  • Rebel Alliance Global Moderator

    If that network is suppose to be routed to you - then you would turn off nat.  If that netblock is just addresses you can use on your wan interface.  Then you would create them as VIPs and nat to the local addresses behind pfsense to access them from the pubic.

    If they were giving you that /27 to use on the wan, you should have a gateway address in that /27 which is there device.  If they are going to route it to you.  Then that should show up in the traceroute - which it does not.

    So I would suggest you contact your ISP for details of what you can or can not do with that /27..  But in a normal setup you would not setup a gateway address on a different network segment like you suggested with this.

    "I can ex. give my host all static ip on 62.116.200.128/27 network with gateway 62.116.223.133"

    That is not a standard sort of setup, and many OSes will not even allow you to do that - windows for example would tell you to get bent if you tried to do that..



  • Thanks i will make some further test with .134 as gateway and other scenarios.

    I will return  :)

    Thanks so far!  ;)



  • Okay SOLVED!

    I just had to bridge WAN and LAN….

    Now everything works....  :)


  • Rebel Alliance Global Moderator

    NO!!!  That is NOT how you would do it!!

    That is NOT a routed solution.



  • Damn….  :-\

    Why is this not a "proper" solution?  :)


  • Rebel Alliance Global Moderator

    Because its NOT Routed like you stated from your isp..  Tell them to FIX their problem!

    You stated in PM, that ISP gave you this info

    "IP adresser: 62.116.200.128/27 will be routed to 62.116.223.134"

    That is NOT what is happening, as I stated before - from a trace it looks like that router thinks your IP range should be directly connected.  Which is not a route to your 223.134 address.

    You do understand a bridge from public INTERNET to your LAN is going to just be Filled with NOISE!!



  • SO TRUE!!!

    My ISP have looked into it, there was some routings issues… now fixed!

    Bridge mode is OFF now - Seems like it is working correctly now. Traffic is being routed correctly. :)

    Thanks a lot!!!!!


  • Rebel Alliance Global Moderator

    You sure??  I don't see your 223.134 in the trace??

    17  212.73.252.6  131.313 ms  127.157 ms  131.363 ms
    18  93.176.93.105  132.265 ms  132.466 ms  130.824 ms
    19  62.116.200.129  140.069 ms  139.443 ms  139.987 ms