4. Outbound NAT for chillispot network by line command

Outbound NAT for chillispot network by line command

  • S

    Hello everybody,

    I have installed Chillispot on Pfsense machine, everything works fine and when I start chilli a tun0 interface is enabled to serve the 192.168.182.0 net.
    The problem is to get the connection with the external world, infact  after I logged in by chillispotlogin page I can't contact any host on the internet. I suppose and I'm quite sure the problem is related to the nat for the tun0 interface created by the chillispot process. How can I create a rule for the outbound nat for this interface? I think it's possible by line command but I don't know what is the command. Is it IPFW or IPTABLE or….. ?
    One more think: after I get the access through the chillispot login, I can ping the wan interface but I can't reach the gateway.

    Thanks in advance for your help

    Saso

    0
  • H

    Firewall>NAT, outbound. Enable manual outbound nat and add the missing items there. Also make sure your firewallrules allow traffic on the incoming interface for that subnet.

    0
  • S

    I tried with your suggestion but still not work. Always I can reach the WAN interface but not the GW.

    Just to avoid mistake I'm going to describe what is my test bench:

    GW (100.100.100.1) –--- (100.100.100.11) WAN Pfsense Machine LAN (192.168.5.1 ) + TUN0_Chilli (192.168.182.1) ------Client_Chilli (192.168.182.x)
                                                                                                  |
                                                                                                  |
                                                                                                  |
                                                                                                  |
                                                                                                Client LAN(192.168.5.5)

    By Client LAN (192.168.5.5)  I can ping WAN interface and GW too, but from Client Chilli I can ping LAN interface of Pfsense machine and WAN interface too, but I cannot reach the GW and Client LAN as well.

    In the attachment the picture about the NAT settings made after your suggestion.
    Any idea??

    Thanks


    0
  • H

    What's that in the alerter? That looks like you have some kind of error. Please paste the complete line of the error. You'll find it in the systemlogs as well. It's easier to copy/paste from there.

    0
  • S

    That is what I see in the system log

    –------------------------------------------

    Apr 5 11:59:03 check_reload_status: reloading filter
    Apr 5 11:59:04 php: : New alert found: There were error(s) loading the rules: pfctl: DIOCSETSTATUSIF The line in question reads [ DIOCSETSTATUSIF]:
    Apr 5 11:59:04 php: : There were error(s) loading the rules: pfctl: DIOCSETSTATUSIF - The line in question reads [ DIOCSETSTATUSIF]:
    Apr 5 11:59:09 check_reload_status: reloading filter
    Apr 5 11:59:10 php: : New alert found: There were error(s) loading the rules: pfctl: DIOCSETSTATUSIF The line in question reads [ DIOCSETSTATUSIF]:
    Apr 5 11:59:10 php: : There were error(s) loading the rules: pfctl: DIOCSETSTATUSIF - The line in question reads [ DIOCSETSTATUSIF]:
    Apr 5 16:00:00 check_reload_status: check_reload_status is starting
    Apr 5 16:30:01 check_reload_status: check_reload_status is starting
    Apr 5 16:35:00 check_reload_status: check_reload_status is starting
    Apr 5 17:12:57 check_reload_status: reloading filter
    Apr 5 17:13:00 php: : New alert found: There were error(s) loading the rules: pfctl: DIOCSETSTATUSIF The line in question reads [ DIOCSETSTATUSIF]:
    Apr 5 17:13:00 php: : There were error(s) loading the rules: pfctl: DIOCSETSTATUSIF - The line in question reads [ DIOCSETSTATUSIF]:
    Apr 5 17:13:55 check_reload_status: reloading filter
    Apr 5 17:13:56 php: : New alert found: There were error(s) loading the rules: pfctl: DIOCSETSTATUSIF The line in question reads [ DIOCSETSTATUSIF]:
    Apr 5 17:13:56 php: : There were error(s) loading the rules: pfctl: DIOCSETSTATUSIF - The line in question reads [ DIOCSETSTATUSIF]:
    Apr 5 17:15:53 check_reload_status: reloading filter
    Apr 5 17:15:54 php: : New alert found: There were error(s) loading the rules: pfctl: DIOCSETSTATUSIF The line in question reads [ DIOCSETSTATUSIF]:
    Apr 5 17:15:54 php: : There were error(s) loading the rules: pfctl: DIOCSETSTATUSIF - The line in question reads [ DIOCSETSTATUSIF]:
    Apr 5 17:35:00 check_reload_status: check_reload_status is starting
    Apr 5 20:06:07 sshd[48227]: error: PAM: authentication error for root from 192.168.5.5
    Apr 5 20:06:07 sshd[48227]: error: PAM: authentication error for root from 192.168.5.5
    Apr 5 20:06:07 sshlockout[48240]: sshlockout starting up
    Apr 5 20:06:07 sshlockout[48240]: sshlockout starting up
    Apr 5 20:06:13 sshd[48227]: Accepted keyboard-interactive/pam for root from 192.168.5.5 port 2484 ssh2
    Apr 5 20:06:50 chillispot[48268]: ChilliSpot 1.0. Copyright 2002-2005 Mondru AB. Licensed under GPL. See http://www.chillispot.org for credits.
    Apr 5 20:06:51 chillispot[48268]: chilli.c: 3083: New DHCP request from MAC=00-50-56-C0-00-01
    Apr 5 20:06:51 chillispot[48268]: chilli.c: 3083: New DHCP request from MAC=00-50-56-C0-00-01
    Apr 5 20:06:51 chillispot[48268]: chilli.c: 3053: Client MAC=00-50-56-C0-00-01 assigned IP 192.168.182.2
    Apr 5 20:06:51 chillispot[48268]: chilli.c: 3053: Client MAC=00-50-56-C0-00-01 assigned IP 192.168.182.2
    Apr 5 20:06:54 chillispot[48268]: chilli.c: 3083: New DHCP request from MAC=00-0C-29-00-37-83
    Apr 5 20:06:54 chillispot[48268]: chilli.c: 3083: New DHCP request from MAC=00-0C-29-00-37-83
    Apr 5 20:06:54 chillispot[48268]: chilli.c: 3053: Client MAC=00-0C-29-00-37-83 assigned IP 192.168.182.3
    Apr 5 20:06:54 chillispot[48268]: chilli.c: 3053: Client MAC=00-0C-29-00-37-83 assigned IP 192.168.182.3
    Apr 5 20:09:09 chillispot[48268]: chilli.c: 3327: Successful UAM login from username=sasso IP=192.168.182.3
    Apr 5 20:09:09 chillispot[48268]: chilli.c: 3327: Successful UAM login from username=sasso IP=192.168.182.3
    Apr 5 20:14:48 check_reload_status: reloading filter
    Apr 5 20:14:50 php: : New alert found: There were error(s) loading the rules: pfctl: DIOCSETSTATUSIF The line in question reads [ DIOCSETSTATUSIF]:
    Apr 5 20:14:50 php: : There were error(s) loading the rules: pfctl: DIOCSETSTATUSIF - The line in question reads [ DIOCSETSTATUSIF]:
    Apr 5 20:15:24 syslogd: exiting on signal 15
    Apr 5 20:15:25 syslogd: kernel boot file is /boot/kernel/kernel
    Apr 5 21:06:50 chillispot[48268]: chilli.c: 864: Rereading configuration file and doing DNS lookup
    Apr 5 22:06:50 chillispot[48268]: chilli.c: 864: Rereading configuration file and doing DNS lookup
    Apr 5 22:20:48 check_reload_status: reloading filter
    Apr 5 22:20:50 php: : New alert found: There were error(s) loading the rules: pfctl: DIOCSETSTATUSIF The line in question reads [ DIOCSETSTATUSIF]:
    Apr 5 22:20:50 php: : There were error(s) loading the rules: pfctl: DIOCSETSTATUSIF - The line in question reads [ DIOCSETSTATUSIF]:
    Apr 5 22:38:07 check_reload_status: reloading filter
    Apr 5 22:38:08 php: : New alert found: There were error(s) loading the rules: pfctl: DIOCSETSTATUSIF The line in question reads [ DIOCSETSTATUSIF]:
    Apr 5 22:38:08 php: : There were error(s) loading the rules: pfctl: DIOCSETSTATUSIF - The line in question reads [ DIOCSETSTATUSIF]:
    Apr 5 23:06:50 chillispot[48268]: chilli.c: 864: Rereading configuration file and doing DNS lookup
    Apr 6 00:06:50 chillispot[48268]: chilli.c: 864: Rereading configuration file and doing DNS lookup

    –--------------------------------------------------

    0
  • H

    As the webgui doesn't know anything about the tun interface created by chilispot the generated ruleset is somehow broken. This is not supported. Don't know how to help you here.

    0
  • S

    I supposed something like that, but can I make any opertaion manually by line command via console ?
    Is there a place (script or something else) where can I look in Pfsense?

    However, many thanx for your support

    0
  • H

    Everything you do at the console level will be replaced and regenerated sooner or later (bootup, changes in webgui, statuschange when using policybasedrouting/multiwan,…). Fwiw go to diagnostics>edit file and open /tmp/rules.debug. That is the autogenerated ruleset. For everything else (modifying the code that generates the rulesfile) check out our cvs at http://cvs.pfsense.org/cgi-bin/cvsweb.cgi/pfSense/ . If you come up with something it wold be nice if you could create a chilispot package  ;)

    0
  • S

    Ok, thanks for this tip, can I ask some more info how is generated the rules.debug? 
    What is the file which generates the rules.debug, one more: once the file is generated, what is the command to reload the new rules included in the file?
    I'm asking that because I would like to start changing the rules.debug file manually and reload the new rules just to understand what is the right setting to include in the file and after I will try to generate it automatically  :)

    0
  • H

    I'm not that familiar with that part of the code. You have to do your own investigation in our cvs-web.

    0
  • S

    ok, I found the command to reload the rules.debug file. It should be pfctl -f /tmp/rules.debug 
    However I solved the problem since I deleted the third interface, because before in my configuration I created a second LAN2 which never was used but until was there I got always an error when I tried to run pfctl command manually. After I deleted it pfctl worked fine without error and also the NAT.
    Obviously needs the outbound NAT rule set like in the picute I sent before.

    If you want I can try to create a package for chillispot, but I need some more details how to build the package under pfsense. If you can give me some indication I will be happy to try to arrange the package.  ;)

    0
  • H

    Check http://devwiki.pfsense.org/PfSenseDevHome for some developement related info. Also Try to learn from one of the other packages. You can check them out here: http://cvs.pfsense.org/cgi-bin/cvsweb.cgi/tools/packages/

    0
Locked
 

Products

Applications

Support

Services

News

Resources

Company

Our Mission

As host of the pfSense open source firewall project, Netgate believes in enhancing network connectivity that maintains both security and privacy. We also believe everyone should be able to afford it.

Subscribe to our Newsletter

Product information, software announcements, and special offers. See our newsletter archive for past announcements.

© Copyright 2002 - 2018 Rubicon Communications, LLC | Privacy Policy