Can't access from WAN to LAN
-
Hi
I got this issue.
My setup:
WAN: ISP UPLINK
LAN: Public IPI can't ping to a public ip (switch) behind lan from remote (external network)
I CAN ping from the firewall to the ip which is behind LAN…IP is 62.116.200.140
What have I done wrong? Since i can ping from the firewall itself, i assume it is a setting on firewall which is blocking access from outside.
-
You can not just put a public IP on your lan and expect it to work, by default pfsense is going to NAT. Did you disable that - and is that public IP space you put on your lan actually routed to you?
-
I see, but NAT is "disabled" - there is no rules for nat or options which indicate that NAT is ON….
Yes is it public. -
I agree that address is public.. And I can ping the IP on your wan.
ping 62.116.223.134
PING 62.116.223.134 (62.116.223.134) 56(84) bytes of data.
64 bytes from 62.116.223.134: icmp_seq=1 ttl=45 time=132 ms
64 bytes from 62.116.223.134: icmp_seq=2 ttl=45 time=129 msBut if I do a traceroute to that network you put on the LAN, I don't end up at your wan IP.. So how is it that network your putting on the lan is routed to you??
traceroute -n -I 62.116.200.129 traceroute to 62.116.200.129 (62.116.200.129), 30 hops max, 60 byte packets <snipped>14 4.69.143.173 127.475 ms 128.839 ms 127.217 ms 15 4.69.142.169 126.735 ms 126.078 ms 125.980 ms 16 4.69.137.154 129.194 ms 129.897 ms 129.892 ms 17 212.73.252.6 126.615 ms 131.071 ms 129.711 ms 18 93.176.93.105 130.944 ms 127.205 ms 126.893 ms 19 93.176.93.105 4741.391 ms !H * *</snipped>that !H is telling me that 93.176.93.105 doesn't know how to get to next hop, or that he should be able to talk to that IP, but its not answering, doesn't have mac, etc. You sure that network is not suppose to be on the WAN of your box? There is a huge difference between an ISP giving you a network to use, and routing a network to you.
But I can trace to your wan
16 4.69.137.154 131.230 ms 132.737 ms 132.722 ms 17 212.73.252.6 132.034 ms 126.071 ms 129.847 ms 18 93.176.93.105 125.747 ms 127.097 ms 127.168 ms 19 62.116.223.134 127.476 ms 130.852 ms 131.720 msSee that 93.176.93.105 knows how to get to your wan address, but seems not to know how to get to that network you put on your LAN.
-
Where is the info from your ISP that that 62.116.200.128/27 is routed to your 62.116.223.134 address?
As you can see from the trace - no it does not route to your wan IP… From what it looks like to me is that network should directly be connected to that last hop.. !H normally means the host is not reachable.
-
Where is the info from your ISP that that 62.116.200.128/27 is routed to your 62.116.223.134 address?
As you can see from the trace - no it does not route to your wan IP… From what it looks like to me is that network should directly be connected to that last hop.. !H normally means the host is not reachable.
My ISP gave the info, and using it on that way is also working very well - as long as I don't have pfsense in middle.
I can ex. give my host all static ip on 62.116.200.128/27 network with gateway 62.116.223.133 or .134 (with pfsense). They all works great. -
Again there is a HUGE difference between an ISP giving you a netblock to use - and routing that netblock to you.
As to your hosts working from behind pfsense.. Outbound - ok, if you give a host an IP on 62.116.200.128/27 and then set his gateway to 62.116.223.133 – that is not really a valid configuration. Your gateway needs to be on your actual network!!
Thought you said you turned off NAT? Not from the creds you sent me, I just logged in an your nat is still there..
These details your ISP gave you about that /27 -- did they give you a gateway for that network?
-
Sorry, i did delete the outbound rules, but tried to set it on (another interface). no difference.
Now deleted again.
PM on the way….
-
If that network is suppose to be routed to you - then you would turn off nat. If that netblock is just addresses you can use on your wan interface. Then you would create them as VIPs and nat to the local addresses behind pfsense to access them from the pubic.
If they were giving you that /27 to use on the wan, you should have a gateway address in that /27 which is there device. If they are going to route it to you. Then that should show up in the traceroute - which it does not.
So I would suggest you contact your ISP for details of what you can or can not do with that /27.. But in a normal setup you would not setup a gateway address on a different network segment like you suggested with this.
"I can ex. give my host all static ip on 62.116.200.128/27 network with gateway 62.116.223.133"
That is not a standard sort of setup, and many OSes will not even allow you to do that - windows for example would tell you to get bent if you tried to do that..
-
Thanks i will make some further test with .134 as gateway and other scenarios.
I will return :)
Thanks so far! ;)
-
Okay SOLVED!
I just had to bridge WAN and LAN….
Now everything works.... :)
-
NO!!! That is NOT how you would do it!!
That is NOT a routed solution.
-
Damn…. :-\
Why is this not a "proper" solution? :)
-
Because its NOT Routed like you stated from your isp.. Tell them to FIX their problem!
You stated in PM, that ISP gave you this info
"IP adresser: 62.116.200.128/27 will be routed to 62.116.223.134"
That is NOT what is happening, as I stated before - from a trace it looks like that router thinks your IP range should be directly connected. Which is not a route to your 223.134 address.
You do understand a bridge from public INTERNET to your LAN is going to just be Filled with NOISE!!
-
SO TRUE!!!
My ISP have looked into it, there was some routings issues… now fixed!
Bridge mode is OFF now - Seems like it is working correctly now. Traffic is being routed correctly. :)
Thanks a lot!!!!!
-
You sure?? I don't see your 223.134 in the trace??
17 212.73.252.6 131.313 ms 127.157 ms 131.363 ms
18 93.176.93.105 132.265 ms 132.466 ms 130.824 ms
19 62.116.200.129 140.069 ms 139.443 ms 139.987 ms
