Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Wifi and LAN on same subnet (SOLVED)

    Scheduled Pinned Locked Moved
    Wireless
    4
    45
    23.8k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DerelictD
      Derelict LAYER 8 Netgate
      last edited by

      Done what?

      You will need pass any any any rules on the bridge members and normal LAN rules on OPT2 (assigned to BRIDGE0).

      You lose the benefit of the auto lockout rule when you stray from the normal LAN so you'll need to figure out how to add the right rules.

      Create a bridge containing only WiFi as a member.  Make sure it has all the rules you need.  See if you can get at pfSense over Wi-Fi, then add LAN to the bridge and make sure it has all the right rules.

      If you have another interface make it management and plug into it to make changed to the LAN bridge.

      Something.

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      1 Reply Last reply Reply Quote 0
      • R
        Rickinfl
        last edited by

        Sorry kind of new to this.

        You will need pass any any any rules on the bridge members and normal LAN rules on BRIDGE0. > Not sure what you're asking me to setup here.

        Why are you messing with OPT2?  Do you want it to be a member of the bridge too? > Do I need to edit the bridge and add Opt2 so then LAN, WIFI, and Opt2 will be attached to the Bridge0?

        1 Reply Last reply Reply Quote 0
        • R
          Rickinfl
          last edited by

          Here are some of my settings

          ![Assign network ports.png](/public/imported_attachments/1/Assign network ports.png)
          ![Assign network ports.png_thumb](/public/imported_attachments/1/Assign network ports.png_thumb)
          Bridge.png
          Bridge.png_thumb
          DHCP1.png
          DHCP1.png_thumb
          Rules.png
          Rules.png_thumb

          1 Reply Last reply Reply Quote 0
          • R
            Rickinfl
            last edited by

            Other settings

            LAN.png
            LAN.png_thumb
            Opt2.png
            Opt2.png_thumb
            Wifi.png
            Wifi.png_thumb

            1 Reply Last reply Reply Quote 0
            • DerelictD
              Derelict LAYER 8 Netgate
              last edited by

              @Rickinfl:

              Why are you messing with OPT2?  Do you want it to be a member of the bridge too? > Do I need to edit the bridge and add Opt2 so then LAN, WIFI, and Opt2 will be attached to the Bridge0?

              If that's what you want, yes.

              In a bridge there are two sets of firewall rules that dictate what traffic can pass into the bridge.  First is on the bridge members themselves.  These are typically pass any any any.

              Second is on the bridge itself.  This is the actual bridge interface that gets assigned an IP address, runs DHCP, etc.  These rules are just like the rules on a typical LAN interface.

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                I think you want to remove OPT2 from the bridge membership.  OPT2 is a bridge interface consisting of LAN and WIFI.

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • R
                  Rickinfl
                  last edited by

                  Well I'm a little confused now since you asked me about Opt2.  I got the information from a post on here and followed it.  Question I have no is do I need Opt2?

                  Here is what this guy posted and I followed. Maybe this is wrong?

                  Finaly i got it working but it was a hard peace of trail and error.

                  1. create a new interface -> Opt2
                  2. Setup the interface IP for Opt2 (interfaces ->Opt2) and change the name if you want
                  3. Setup the DHCP Server for Opt2
                  4. Create a "Source=Bridge subnet; rest=any" Firewall rule for Opt2
                  5. create a bridge: Interfaces -> Bridges, and select LAN and Wifi
                  6. Select the Bridge as "Network port" for Opt2; Interfaces-> asign
                  7. Deactivate the DHCP server of LAN and Wifi
                  8. Set the Type of LAN and Wifi to "None"

                  Now your LAN and Wifi clients should get an IP from the DHCP server configured for Opt2 and these clients should be able to access the internet.

                  But they are currently not able to access each other WLAN <-> LAN.

                  So solve that i added two rules for the Firewall:
                  1. LAN: Source=Bridge subnet; rest = any
                  2. WLAB: Source= Bridge subnet; rest=any

                  Instead of adding these two rules you can also change the value at : System -> Advanced -> System tuneables -> net.link.bridge.pfil_member->  "0"

                  At that point my clients where able to ping each other and also wake up on lan from my tablet to a PC was working.

                  If you have any hints what i can do better on my configuration feel free to let me know.
                  « Last Edit: May 21, 2012, 04:28:12 pm by nimanic »

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    5. create a bridge: Interfaces -> Bridges, and select LAN and Wifi

                    You selected LAN, WIFI, and OPT2, not LAN and WIFI.

                    Change that and if you did everything else it should work.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • R
                      Rickinfl
                      last edited by

                      Still not working.

                      UpdatedBridge.png
                      UpdatedBridge.png_thumb

                      1 Reply Last reply Reply Quote 0
                      • R
                        Rickinfl
                        last edited by

                        This is a fresh Install of Pfsense. I've connected to it so it has internet access.

                        Maybe if someone could give me the instructions on how to do this from start.

                        Here is all I want.

                        Pfsense on 10.10.0.1
                        Wifi on 10.10.0.2

                        Pretty simple. I must have gotten something messed up.

                        1 Reply Last reply Reply Quote 0
                        • DerelictD
                          Derelict LAYER 8 Netgate
                          last edited by

                          The instructions you already posted look pretty good.

                          Typical debugging should probably be done.

                          Do you get DHCP on the WIFI port?  On the LAN port?
                          Can you ping the OPT2 address from the WIFI port?  From the LAN port?
                          Can you ping the next hop gateway from the WIFI port?  From the LAN port?
                          Can the Hosts on LAN ping the hosts on WIFI?  Vice versa?
                          What DNS is being handed out to the DHCP clients?  Is that the DNS server actually in use by the clients? Can you resolve names using that address?
                          Etc.

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • ?
                            Guest
                            last edited by

                            I am of the mind that things could be done easier in pfSense for the creation of bridges and wireless access points. I have considered requesting forum help for a wireless setup wizard -using something like what pfSense includes now at initial setup in WebConfigurator. I know everybody hates wizards but pfsense setup wizard is easy enough to click thru. I would like to see enhanced functionality with it. Is this something that seems logical to  anyone else? I hate doing the cable swap for bridge creation but it works..

                            A suggestion for help is disable firewall from Advanced Settings on the Menu. It will prevent lockout until you figure it out what is what. And  i know i hate  re-imaging my  CF card -so i do the restore last backup from console - to save time on lockouts when i was  learning. pfsense  automatically saves backups at each settings change it seems. Very convenient.

                            1 Reply Last reply Reply Quote 0
                            • R
                              Rickinfl
                              last edited by

                              Yes I'll have to do some debugging. Just keep cutting myself out.

                              Do you get DHCP on the WIFI port?  On the LAN port? WiFi yes. Not sure about LAN since I static those.

                              Can you ping the OPT2 address from the WIFI port?  From the LAN port? I can't ping anything but the wifi device I'm testing with

                              Can you ping the next hop gateway from the WIFI port?  From the LAN port? No same as above.

                              Can the Hosts on LAN ping the hosts on WIFI?  Vice versa? No. It's like the bridge blocks everything and isolates the wifi.

                              What DNS is being handed out to the DHCP clients?  Is that the DNS server actually in use by the clients? Can you resolve names using that address? Even static with DNS still doesn't work.

                              I'm going to have to do more research on this and try and break it down piece by piece and see what's going on. I've been driving myself crazy trying to figure this out. I know on paper its right and I drew it out many times then applied it.

                              Just strange.

                              Thanks for all your time and help.

                              Rick

                              1 Reply Last reply Reply Quote 0
                              • DerelictD
                                Derelict LAYER 8 Netgate
                                last edited by

                                What firewall rules are on LAN and WIFI?

                                Does anyone know for sure that the xl driver still works?

                                Do you get DHCP on the WIFI port?  On the LAN port? WiFi yes. Not sure about LAN since I static those.

                                Can you try?  If you can get DHCP (and have ARP, etc) then it's not a layer2 problem and we really need to look at rules.

                                Chattanooga, Tennessee, USA
                                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                1 Reply Last reply Reply Quote 0
                                • R
                                  Rickinfl
                                  last edited by

                                  Wow… Someone really needs to document how to do this!  Need Documentation on Normal setup of WiFi and then WiFi on the Same Subnet.

                                  I've been researching this for almost 2 weeks now and I'm really tied of trying to get this to work.

                                  I have read every post I could find on this. I've watched every Youtube Video and Even the one on Pfsense Site...  The problem is NOT 2 of any of the documentation is the same. Seems everyone does it different, but none of it works.

                                  Really wish someone could post how to do this that's done it already.  :(

                                  1 Reply Last reply Reply Quote 0
                                  • DerelictD
                                    Derelict LAYER 8 Netgate
                                    last edited by

                                    It's just not that difficult.  Bridging works fine.

                                    The instructions you have already posted cover everything you need to do.

                                    If it doesn't work you need to be able to troubleshoot it to find out what was done incorrectly or where the problem otherwise lies.

                                    Chattanooga, Tennessee, USA
                                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                    1 Reply Last reply Reply Quote 0
                                    • R
                                      Rickinfl
                                      last edited by

                                      Well I got as far as being able to ping anything on the network from wireless or static. The WiFi just can't get out.  WiFi gets an IP address from DCHP.

                                      1 Reply Last reply Reply Quote 0
                                      • DerelictD
                                        Derelict LAYER 8 Netgate
                                        last edited by

                                        What are the firewall rules on wifi?  You need rules on all bridge members and the bridge itself.

                                        Chattanooga, Tennessee, USA
                                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                        1 Reply Last reply Reply Quote 0
                                        • R
                                          Rickinfl
                                          last edited by

                                          LAN Net > Any
                                          WiFi Net > Any
                                          Bridge Net > Any

                                          1 Reply Last reply Reply Quote 0
                                          • R
                                            Rickinfl
                                            last edited by

                                            Here is all the steps I exactly took:

                                            Fresh Build Pfsense. Got it configured and connected my computer to it and have internet access and access to my LAN.

                                            1. Shut down install WiFi card (Card is on the recommended list of cards that work with Pfsense)
                                            2. Interfaces > Added WiFi card (Opt1) renamed it to WiFi. > Setup WiFi settings.
                                            3. Interfaces > Assign > Bridges > Created a Bridge > Renamed it to Bridge > Selected LAN and WiFi
                                            4. Interfaces > Added new Interface > Opt2 > Renamed to Bridge > Network Port = Bridge
                                            5. DHCP Server > Turned on DHCP for Bridge > Enabled > Set Range. (No DHCP on LAN or WiFi)
                                            6. Firewall > Rules > Added New Rule > Source = Bridge Net > Rest set to Any.
                                            7. System > Advanced > System Tuneables > net.link.bridge.pfil_member > Changed from 1 to 0
                                            8. Interfaces > LAN > IPv4 Configuration Type = None  > IPv6 Configuration Type = None
                                            9. Interfaces > WiFi > IPv4 Configuration Type = None  > IPv6 Configuration Type = None

                                            My Configuration:

                                            Old:

                                            WAN > DHCP
                                            LAN > 10.10.0.1

                                            New:

                                            WAN > DHCP
                                            LAN >
                                            WiFi >
                                            Bridge > 10.10.0.2 > DHCP

                                            I can connect my Phone and Laptop to WiFi. I can ping both from either one. No Internet Access.

                                            Now you know what steps I took to get here. I know them well I've rebuilt it about 20+ Times from scratch trying to get this to work.

                                            Thanks,
                                            Rick

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post