I have more interfaces than actual hardware ports



  • For some odd reason I have 10 interfaces including lan and wan on pfsense however I only have 8 ports (9 including the mobo chipset but I don't think it is being recognized). What's up with this? I haven't set up any vlans so I am really confused.



  • Simply delete the interfaces assigments in over from the "assing" tab.

    can you post a print screen of what you mean?

    also, what do you plan to do with 8 network interface not understanding subnet basics?

    Zikmez



  • @zikmen:

    Simply delete the interfaces assigments in over from the "assing" tab.

    can you post a print screen of what you mean?

    also, what do you plan to do with 8 network interface not understanding subnet basics?

    Zikmez

    I'll post a screenshot in a bit. Well the 8 network interfaces, I am thinking of them as 8 ports. So I plug in one computer for each port, like a regular router all on same subnet, can I not do this or is it not preferred to do this? I am beginning to think I am supposed to be brigding something…



  • You are totally wrong wanting to put all computers on differents NICs.

    interfaces of pfsense are used to subdivise or separate some dinstinct network . ex: group of computers of building A and group of computer in building B. after what you can specify what goes betwenn A and B. but for you, you only need 2 interfaces. One for the internet, and another for your LAN. connect this interface to a switch or a router with dhcp server turned off and you'r in business.

    You can connect as many devices you want to one interface using switches and it will be the job of the switch to manage communications between each host, not the job of pfsense.



  • @zikmen:

    You are totally wrong wanting to put all computers on differents NICs.

    interfaces of pfsense are used to subdivise or separate some dinstinct network . ex: group of computers of building A and group of computer in building B. after what you can specify what goes betwenn A and B. but for you, you only need 2 interfaces. One for the internet, and another for your LAN. connect this interface to a switch or a router with dhcp server turned off and you'r in business.

    You can connect as many devices you want to one interface using switches and it will be the job of the switch to manage communications between each host, not the job of pfsense.

    ohhh i see. So I still need some switches? I have a linksys router set in bridge mode which acts like a switch i think. Can I not assign one of the other interfaces as a switch or bridge to LAN?



  • of course you could, but i would have to make a practical test for that one to give you de right step by step. (i'm not sure for the bridging part under the pfsense firewall)

    but you don't need that at all.

    and for the linksis router, it is NOT set in bridge mode but in SWITCH mode as the routing services are disabled. If you want to be able to access the daskboard of the linksys from your network,

    you have to give it an unused adress and keep it under the same subnet. i mean the "router adress" wich is equivalent to "interface adress" under PfSense. give something like 192.168.0.5 and keep it under 255.255.255.0 of you have a /24 CIDR under PfSense. It's the same thing expressed a different way.

    /20 would mean 255.255.240.0 but for now, stay under the /24 or 255.255.255.0

    Subnet concept are not easy to figure out, it took me over 10 years to fall on someone who could make me really understand it loud and clear. i am thinking starting to make some tutorials videos.

    Zikmen



  • @zikmen:

    of course you could, but i would have to make a practical test for that one to give you de right step by step. (i'm not sure for the bridging part under the pfsense firewall)

    but you don't need that at all.

    and for the linksis router, it is NOT set in bridge mode but in SWITCH mode as the routing services are disabled. If you want to be able to access the daskboard of the linksys from your network,

    you have to give it an unused adress and keep it under the same subnet. i mean the "router adress" wich is equivalent to "interface adress" under PfSense. give something like 192.168.0.5 and keep it under 255.255.255.0 of you have a /24 CIDR under PfSense. It's the same thing expressed a different way.

    /20 would mean 255.255.240.0 but for now, stay under the /24 or 255.255.255.0

    Subnet concept are not easy to figure out, it took me over 10 years to fall on someone who could make me really understand it loud and clear. i am thinking starting to make some tutorials videos.

    Zikmen

    I tried bridging an interface to lan under interfaces > assign so I guess that is one step down? Next is firewall as you say however you also say that ido not need to be bridging anything? The only other alternative is using a switch yes? As for the router I can't access the dashboard as you say and I have been fine with that and I don't really know how to do what you are saying, unless I really have to do that then I'll try and learn but otherwise I won't as it is doing its job pretty well. (Right now I have the router with the option "bridge mode" or switch mode, whichever it was, connected to my modem thay has only one port. I wanted to have a router connected as well as a computer but not one after the other).
    I believe you about taking 10 years to find someone well knowledgeable about subnets and that is pretty amazing you have been able to learn from him/her. If you have the free time I'd say go for it.



  • i'm not sure to understand why did you connected a router in bridge mode directly to a modem….

    There is what you want to do

    CABLE or DSL MODEM
    connected to
    WAN Nic of PfSense
    then
    LAN nic of PfSense
    connected to
    Briddged mode router port 1-4 (you have 3 left for workstations.

    is that what you have?



  • @zikmen:

    i'm not sure to understand why did you connected a router in bridge mode directly to a modem….

    There is what you want to do

    CABLE or DSL MODEM
    connected to
    WAN Nic of PfSense
    then
    LAN nic of PfSense
    connected to
    Briddged mode router port 1-4 (you have 3 left for workstations.

    is that what you have?

    No that is not what I have. I am still in the middle of changing around the order the devices will be in and I have family in my house that are using the Internet so I can't put the pfsense box first yet as I havent gotten everything set up. My current set up  is

    MODEM
        V
    Router set up in bridge/switch mode
              V                                            V
    SonicWall Tz 210.                      pfsense box
    (So other people                               
    at home can access Internet
    for now)

    The Vs are basically connections, the router that is in bridge mode has 4 Lan ports, 2 of which are in use.

    My final setup will be

    MODEM
        V
    Pfsense box
      V.                V
    Sonicwall    Switch OR interfaces configured as bridges

    (I want to take advantage of the interfaces since I bought them, I bought themy for the wrong thing but since I have them I'd like to take advantage instead of having to use or buy another switch if possible)



  • you cannot connect two devices to a straight modem through a switch as the modem wil provide only one ip adress. there is a case where it's not perfectly true.

    what is the model of the internet modem?

    usually we do not put two devices on a modem. you'r temporary setup should be

    modem
                                        V
                          SonicWall router
                          V                          V
      Others workstations        PfSense WAN Nic
                                                                  V
                                                  Switch mode router
                                                                  V
                                                      Test workstation

    You'r beter to use a dedicated switch (included onboard on any router) to do the switching job than giving that job to PfSense. you will have better performance since the data will not pass through the cpu.

    take a look at this picture to figure out how thing are made inside a router.

    Zikmen




  • @zikmen:

    you cannot connect two devices to a straight modem through a switch as the modem wil provide only one ip adress. there is a case where it's not perfectly true.

    what is the model of the internet modem?

    usually we do not put two devices on a modem. you'r temporary setup should be

    modem
                                        V
                          SonicWall router
                          V                          V
      Others workstations        PfSense WAN Nic
                                                                  V
                                                  Switch mode router
                                                                  V
                                                      Test workstation

    You'r beter to use a dedicated switch (included onboard on any router) to do the switching job than giving that job to PfSense. you will have better performance since the data will not pass through the cpu.

    take a look at this picture to figure out how thing are made inside a router.

    Zikmen

    Well the thing here is that I have 5 static ips given by ISP, not dhcp,  so wouldn't this make it acceptable to have two devices hooked up to the modem as I can assign them an ip? I am writing this from my phone atm and am about to go to bed but I can try and find the model number for you if you are interested tomorrow morning. Hmm,  that bit about performance does intrigue me but I have so many available ports now (after learning one port is not for each device lol) i feel like buying the extra card or a 4 port card was a waste…I could return one of them.....I don't know really. The price of the card is more than a standard switch I think. Hmm, I'll have to think it over.

    The reason the SonicWall is not first is because it was giving me problems with my one of my tesr servers when transferring filea through ftp and it also disconnecting users from game servers every 10 minutes such as cs source and mine craft. I did testing and knew it was something related with the sonicwall aa I put the server directly behind the modem and all the problems disappeared.


  • LAYER 8 Netgate

    Is the modem giving you good public IPs to both the sonicwall and pfSense and not doing NAT?  If yes then you're good to go.

    As has been said, just forget about bridging on pfSense.  Get a switch.  Let your router route.  Let your switches switch.  You will be happier and your network will perform better and everytime you post people won't be saying, "What are you doing bridging?  Just get a switch!"  Classic case where "just because you can doesn't mean you should" applies.



  • @Derelict:

    Is the modem giving you good public IPs to both the sonicwall and pfSense and not doing NAT?  If yes then you're good to go.

    As has been said, just forget about bridging on pfSense.  Get a switch.  Let your router route.  Let your switches switch.  You will be happier and your network will perform better and everytime you post people won't be saying, "What are you doing bridging?  Just get a switch!"  Classic case where "just because you can doesn't mean you should" applies.

    Well we have 5 ips to choose from, really 3 as two other ips are being used by computers. On the SonicWall we assign one ip and then on pfsense we assign another. Yeah I am finally agreeing with you and getting a switch for one interface and connecting everything to the switch. Currently I do not have a switch but will try buying one today or tomorrow. Could I use the router that is set in bridge mode (currently it'a connected to the modem as in the diagram) in the mean time to replace what a switch would be doing until I buy a switch? Also, does a bridge add another "layer" to the network in any way (by layer I mean like having one router connected to another or something)?


  • Netgate Administrator

    What hardware are you running pfSense on?
    Whilst it is possible bridge your interfaces and have them behave like a switch it's usually a bad idea for the reasons already given.
    If however you end up with unused ports that you want to add to a bridge I did write some instructions a while ago:
    https://forum.pfsense.org/index.php/topic,48947.msg269592.html#msg269592

    To answer your original question, you can easily end up with more interfaces than you have ports because some interface types are 'virtual'. This includes VLAN interfaces, PPPoE interfaces and bridge interfaces.

    Steve


  • LAYER 8 Netgate

    A bridge is a layer 2 device.  It might have an IP address for management purposes but it doesn't appear as an IP "hop" in traceroutes and the like.

    I don't know if the router you have between the firewalls and the modem is necessary to what you're doing.  It really sounds like you need switches on the outside (for your modem, public IPs, and firewall WAN ports) and the inside networks (for your workstations, access points, etc.)



  • @Derelict:

    A bridge is a layer 2 device.  It might have an IP address for management purposes but it doesn't appear as an IP "hop" in traceroutes and the like.

    I don't know if the router you have between the firewalls and the modem is necessary to what you're doing.  It really sounds like you need switches on the outside (for your modem, public IPs, and firewall WAN ports) and the inside networks (for your workstations, access points, etc.)

    yes I need switches but the way I have everything set up is temporary and has been that way for a while as I've been looking for a replacement to my tz 210 as it has been giving me problems however my father wants his stuff behind the tz 210. I have the router configured in bridge mode so I could say it'd acting LIKE a switch..I'm going to try to buy one today or tomorrow. Ultimately when I buy my switch it will just be modem > pfsense box > switch in one interface and then either the SonicWall will be on its own interface with different subnet separated, or connected to the switchurch OR eliminated entirely as its just acting really crappy.



  • @stephenw10:

    What hardware are you running pfSense on?
    Whilst it is possible bridge your interfaces and have them behave like a switch it's usually a bad idea for the reasons already given.
    If however you end up with unused ports that you want to add to a bridge I did write some instructions a while ago:
    https://forum.pfsense.org/index.php/topic,48947.msg269592.html#msg269592

    To answer your original question, you can easily end up with more interfaces than you have ports because some interface types are 'virtual'. This includes VLAN interfaces, PPPoE interfaces and bridge interfaces.

    Steve

    it's running on a standard desktop PC I built. core i3 4150, 8gb ddr3 1600mhz, asus z78 pro mobo, and two HP NC364T which use the Intel 8751 chipset or something. I've seen your instructions actually a little while ago ha ha, I've read it again and I notice you say one proceduee can be done if I don't need to worry about adding ruses on the interfaces, however I need to add some ports. Then at the end you say no rules will need to be added on the interfaces as it will inherit the rules from Lan, so would I just add the rules on lan?

    I still want to go for a switch but this is interesting now and I'd like to know if you could answer that one question I have so I would know for future cases in case I ever wanted or somehow had to bridge interfaces.


  • Netgate Administrator

    Just run 'ifconfig' at the console and it will show you all the interfaces in the box whether or not they are assigned or enabled. Paste if here if you have any more questions about it.

    Steve



  • Alright so I have hooked up a router configured in bridge mode (that's all I have to act as a switch atm) to the LAN interface and now since I have dhcp enabled on the lan interface, anything plugged into that switch that is configured to automatically get an IP will in fact get one right?

    Also, will pfSense still be able to monitor what devices are connected (since everything is going from the switch and then to lan)?


  • Netgate Administrator

    Yes, as long as the router really is only switching.
    pfSense will know which devices have which IP addresses and hence what is connecting to outside addresses. It will not have any knowledge of traffic between devices on the switch.

    Steve



  • @stephenw10:

    Yes, as long as the router really is only switching.
    pfSense will know which devices have which IP addresses and hence what is connecting to outside addresses. It will not have any knowledge of traffic between devices on the switch.

    Steve

    alright sounds good. Don't know if you can give me a hand with this but I have hooked up a server/computer I have to the switch (remember switch is connected to LAN interface) and I want to establish a link with the internal ip and external IP, so I will have to do a 1:1 NAT. I did one and I also made a rule on the firewall on the wan interface to allow traffic from Port 443 (testing purpoes) on my internal IP but when I type my external IP into the address bar from another computer nothing will load. I will post screenshot in a few seconds.





  • LAYER 8 Netgate

    Why did you put a destination in your 1:1?  Did you read the text?

    ![Screen Shot 2014-12-28 at 6.30.28 PM.png](/public/imported_attachments/1/Screen Shot 2014-12-28 at 6.30.28 PM.png)
    ![Screen Shot 2014-12-28 at 6.30.28 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2014-12-28 at 6.30.28 PM.png_thumb)


  • Netgate Administrator

    Do you need all ports NAT'd to the server? You should probably use a single port forward, for testing at least, instead.
    However if you do want 1:1 NAT it should be on the WAN interface and the 'destination' should be left as 'any'.
    Since your pfSense box is behind the Sonicwall device is it's WAN address a private IP? If so you need to uncheck 'block private networks' in the WAN interface setup.
    Lastly you will need to test your port forward from a device on the WAN side of the pfSense box.

    Steve



  • @Derelict:

    Why did you put a destination in your 1:1?  Did you read the text?

    I got confused when reading this lol https://doc.pfsense.org/index.php/Why_does_enabling_NAT_Reflection_break_web_surfing

    EDIT: Actually, if I leave the destination with a * then I am unable to surf the web on that machine. I have to set an IP for the destination if I want to be able to browse the web with 1:1 NAT.



  • @stephenw10:

    Do you need all ports NAT'd to the server? You should probably use a single port forward, for testing at least, instead.
    However if you do want 1:1 NAT it should be on the WAN interface and the 'destination' should be left as 'any'.
    Since your pfSense box is behind the Sonicwall device is it's WAN address a private IP? If so you need to uncheck 'block private networks' in the WAN interface setup.
    Lastly you will need to test your port forward from a device on the WAN side of the pfSense box.

    Steve

    I selected lan instead of wan by accident lol but I don't know whether I should do Port Forward or just 1:1 NAT. I do not want all ports to be opened and the way I am doing it is 1:1 NAT which forwards/allows everything from the external IP to internal IP or something like that right? However because pfsense has a firewall, it is preventing from all ports being accessible to LAN right? So essentially either Port forward of One-to-one nat will do the same thing???



  • Ugh so I thought I got it working but I didn't. I am trying to port forward instead of just doing 1:1 NAT. I can't seem to get it working. Do I need to add a rule to the firewall and I saw in a video someone making a virtual ip alias in pfsense, do I need to one to do one? I'll try and postake a screen shot.


  • LAYER 8 Netgate

    This is a sample rule forwarding Minecraft on TCP:25565 (minecraft_server port alias set to 25565) to my os_x_server (host alias defined as 192.168.223.17).  Note that I let the NAT configuration  create the firewall rule so I don't have to using the filter rule association.

    If I wanted the incoming connections to be addressed to anything other than "WAN address" I would have to create a VIP.  In this case I don't.




  • @Derelict:

    This is a sample rule forwarding Minecraft on TCP:25565 (minecraft_server port alias set to 25565) to my os_x_server (host alias defined as 192.168.223.17).  Note that I let the NAT configuration  create the firewall rule so I don't have to using the filter rule association.

    If I wanted the incoming connections to be addressed to anything other than "WAN address" I would have to create a VIP.  In this case I don't.

    I try following your steps but it doesnt work. I noticed how you said if you wanted incoming connections to be anything other than the WAN address of pfsense you would have to create a virtual ip. So, since the WAN address of my server and pfsense box are different (I want incoming connections for a certain IP and port 80 to go to internal IP). Only thing I dont get like you do isthe NAT association rule.

    Ive blocked out my WAN IP in the images for privacy reasons…but I hope its still enough that you can have an idea on what I am doing incorrectly.





  • LAYER 8 Netgate

    Looks like it should work to me.

    Is the proper Firewall rule on Firewall > Rules > WAN??

    Everything configured right on the web server and it has its default gateway set to pfSense?

    No software firewall on the web server blocking access from foreign networks?

    Web server is actually running and listening on tcp/80?

    Not much else to it.



  • @Derelict:

    Looks like it should work to me.

    Is the proper Firewall rule on Firewall > Rules > WAN??

    Everything configured right on the web server and it has its default gateway set to pfSense?

    No software firewall on the web server blocking access from foreign networks?

    Web server is actually running and listening on tcp/80?

    Not much else to it.

    Well to go back, when I create a Virtual IP (one that will be used to assign to my server) if I type in that IP I am brought to a pfsense page, which isnt what I want. I want to be brought to my web servers page. So I guess I have to remove the virtual IP? As for proper firewall rules, the rule that gets created from  making the NAT port forwarding is in the WAN interface. Everything on the server side is correct yet I when I try to access the web server with the external IP nothing loads.


  • LAYER 8 Netgate

    try changing the type of virtual IP to proxy arp.  that will absolutely prevent any services on the firewall node from binding to it.


  • LAYER 8 Netgate

    if I type in that IP I am brought to a pfsense page

    if you type that IP from where?  inside or outside?



  • @Derelict:

    if I type in that IP I am brought to a pfsense page

    if you type that IP from where?  inside or outside?

    Inside…..am I beginning to realize something lol...
    EDIT: Wow, amazing. If I do it from internal I am brought to pfsense page. if I do it from externally then I am brought to my web server. Wow.


  • Netgate Administrator


Log in to reply