OPT1 as second LAN interface?



  • So after a few day with help from community members I finally got my firebox x700 set up with pfsense,but… How do I configure OPT1 to also act as a LAN port ?

    I have the WAN set to re0, default LAN on re1, im trying to set up OPT1 on re2 to allow internet access. I have enabled the interface and have set the rules on the firewall (i think) and its still not working.

    Im new to the software so any help will be much appreciated.

    Many thanks

    Mark



  • Check Outbound NAT rules.


  • LAYER 8 Netgate

    Post your OPT1 rules.

    If you have automatic outbound NAT set (the default) that shouldn't be a problem.  If you changed to manual outbound NAT, change it back to automatic.



  • @MarkAmations:

    …configure OPT1 to also act as a LAN port?

    What do you want to do exactly?

    With "OPT1 as LAN" you mean to have an additional port with the same subnet as LAN (aka bridged) or configure OPT1 as a different subnet?



  • Guessing that you want OPT1 as a separate subnet, give OPT1 some IP address/netmask that makes a different subnet. Automatic NAT will do its thing for you. Add rules aon OPT1 allowing traffic source OPT1net.
    I have a Firebox just like that, it has 1 WAN and 5 different LAN subnets - works easy.



  • @Derelict:

    Post your OPT1 rules.

    If you have automatic outbound NAT set (the default) that shouldn't be a problem.  If you changed to manual outbound NAT, change it back to automatic.

    My OPT1 rules are a copy of the default LAN rules, only set to the OPT1 network


  • LAYER 8 Netgate

    Can you ping the OPT1 interface from something on OPT1?

    There's really not much to it.  Pass ip from OPT1 net to any plus automatic outbound NAT.

    If you don't post screen shots we have to take your word for it that everything is perfect and come to the conclusion your firebox is broken.



  • Ok, Ill get some screenshots up  :)



  • @Derelict:

    Can you ping the OPT1 interface from something on OPT1?

    Not able to



  • OPT1 Config

    OPT1 Firewall Rules

    Outbound Nat

    OPT1 DHCP Settings



  • @jahonix:

    What do you want to do exactly?

    With "OPT1 as LAN" you mean to have an additional port with the same subnet as LAN (aka bridged) or configure OPT1 as a different subnet?

    I want to the OPT1 interface to act like another lan port, like the deafult LAN interface


  • Banned

    Kindly read the comment under the IPv4 Upstream Gateway option.



  • @doktornotor:

    Kindly read the comment under the IPv4 Upstream Gateway option.

    Sorry bout that guys ….



  • I removed the gateway from OPT1 but I still cant connect to the internet or ping websites.

    Any ideas?


  • Banned

    What's that /23? What's your LAN set up like?



  • @doktornotor:

    What's that /23? What's your LAN set up like?

    Here is the LAN setup

    (please note I have never used this software before and am fairly new to the world of computer networking)


  • Banned

    You cannot have two interfaces on a same subnet (OPT1: 192.168.100.6/23, LAN: 192.168.100.1/24).

    Go read the docs about bridging: https://doc.pfsense.org/index.php/Interface_Bridges
    Set both LAN and OPT1 IPv4/IPv6 to None
    Assign the bridge to LAN and configure the IPs there.



  • @doktornotor:

    You cannot have two interfaces on a same subnet (OPT1: 192.168.100.6/23, LAN: 192.168.100.1/24).

    Go read the docs about bridging: https://doc.pfsense.org/index.php/Interface_Bridges
    Set both LAN and OPT1 IPv4/IPv6 to None
    Assign the bridge to LAN and configure the IPs there.

    Ok, I shall do that now, thank you for your help :)


  • LAYER 8 Netgate

    And instead of bridging router interfaces, just get a switch.  Bridging does not save a port, it wastes a perfectly good router port.



  • @Derelict:

    And instead of bridging router interfaces, just get a switch.  Bridging does not save a port, it wastes a perfectly good router port.

    So I can plug the default LAN straight into the HP ProCurve switch I already have?


  • LAYER 8 Netgate

    Sure.

    Say your ethernet adapter is an em0.  Plug it into an untagged interface on whatever VLAN on the ProCurve you want.  Then plug your hosts into untagged ports on the same VLAN on the switch.  By default all ports are probably on the untagged VLAN 1 so it'll just work.


  • LAYER 8 Global Moderator

    yeah what is your lan network, it doesn't overlap with that /23 you have on opt1 does it?

    Also you have /23 on opt1 - what do devices on opt1 network have as their mask /23.. Are they pointing to 192.168.100.6 as gateway?  The pfsense opt1 IP you set.  Can they ping the opt1 IP?



  • Im going to reset the box and start over, I'll upload the configs in about an hour when I get it back to the point it was at (hopefully)



  • Hi Mark!

    Did you solve your problem?
    If yes, what did you do?
    I have the same issue here.

    Thanks in advance


  • LAYER 8 Global Moderator

    Your issue is you have overlapping networks??  What are the details of your problem?  Are you trying to bridge interfaces like the OP?

    I doubt your having the same issue as this user..  If you are having a problem setting up a OPT1 interface I would suggest you start your own thread and post the details of your setup and what exactly  your trying to do, and what is not working..

    The biggest error I see with users adding opt interfaces is they do not put firewall rules on them, since when they first setup pfsense lan gets a default any any, but when you add an opt the firewall has no rules so everything is blocked.  or when they do add the rules they don't add them correctly.

    So if you post up your config for your lan interface and config of yoru opt1 and firewall rules and what is not working in another thread - would be happy to help you.  But not much can do with a me too type post..



  • Hi John,

    Thanks for your reply. I am really newbie in pfsense. I tried something in 2010 and stoped. Now I will try to set up it again!

    Well, for now I don´t want to set up rules for my network. I have nowadays 2 networks in my company.
    One LAN1 (10.0.0.x) and one router conected to one point to that LAN1 and provide another LAN2 network (192.168.1.x).
    I installed pfsense 2.1.5 in a machine with 3 network interface.
    In the first network I connected the WAN link.
    In the other two I am trying to set up 2 independent network.
    The first one (LAN) everything is fine.
    In the second one (OPT1), DHCP is working but I can´t access the internet.

    My configurations screens below (LAN, OPT1 (1), OPT1 (2), OPT1 (3), OPT1 (4)











  • Banned

    One LAN1 (10.0.0.x) and one router conected to one point to that LAN1 and provide another LAN2 network (192.168.1.x).

    That's NOT what's on the screenshots. Which part of "You cannot have two interfaces on a same subnet" is still unclear?


  • LAYER 8 Global Moderator

    Yeah from your screenshot you have same IP on both lan and opt1

    Also your rules on opt1 are only allowing tcp.. So dns would never work this is by default udp, and uses tcp sometimes if large queries or like a zone xfer.

    If you don't want to setup any rules - you still have to put in something on opt1 when you create it to allow traffic.  I would just put in a duplicate of what the default rule is, ie any any.  Your rule you show on opt1 would work if you would change it to tcp/udp – but would just change it to any.



  • Hi John and docktor.

    The IP was not equal. The both screenshots refers to the OPT_1 (I only split the screen in 2 pictures)

    Anyway, John, the other tip that you gave me (change for TCP/UDP) solve the problem now!! :-)

    Thanks for both

    Regards


  • LAYER 8 Global Moderator

    Dude the picture you posted clearly shows opt1 having a 10.0.0.1 address, and your dhcp range for opt1 also shows it having a 10.x address..

    Not the 192.168.1 you state here "another LAN2 network (192.168.1.x)."




  • Ok, sorry about that!

    Thanks for help me

    Regards


Log in to reply