Netgate SG-1000 microFirewall

Author Topic: Connect to bridged DSL modem (not PPPoE)  (Read 2695 times)

0 Members and 1 Guest are viewing this topic.

Offline new-to-netgate

  • Newbie
  • *
  • Posts: 20
  • Karma: +0/-0
    • View Profile
Connect to bridged DSL modem (not PPPoE)
« on: May 04, 2017, 09:15:01 am »
Hi,

I've been reading several threads about this, but most of them were focused on PPPoE (creating an OPT int., but I have no spare interfaces to assign).

On my pfSesnse box I only have two interfaces:

- WAN (dynamically assigned by my ISP)
- LAN (192.168.1.0/24)

pfSense management is 192.168.1.1/24

The ISP modem has an address of 192.168.1.254/24 that I'd like to keep, if possible.

I think I just need a NAT rule to be able to reach the modem, but which one?   :)

Offline chpalmer

  • Hero Member
  • *****
  • Posts: 1793
  • Karma: +93/-3
    • View Profile
    • Home of Cablenut
Re: Connect to bridged DSL modem (not PPPoE)
« Reply #1 on: May 04, 2017, 11:32:59 pm »

Can't have both interfaces on the same subnet.

If your modem is bridged then it means your WAN is getting a public IP or..   Do you mean your double natted?

P.S. statements made by me are not necessarily condoned by the management of this fine organization.  http://badmodems.com

Offline new-to-netgate

  • Newbie
  • *
  • Posts: 20
  • Karma: +0/-0
    • View Profile
Re: Connect to bridged DSL modem (not PPPoE)
« Reply #2 on: May 05, 2017, 01:44:19 pm »
Hey chpalmer,

Yes, the modem (Actiontec) is bridged, and gets a public IP on its WAN interface.  Still has an address of 192.168.1.254 on its LAN interface.
If I connect a laptop to one of the LAN ports of the modem I can connect to the modem GUI no problem.

However, I cannot do the same from my LAN (going through the router).  I think that all the traffic from the LAN (192.168.1.0/24) is routed by pfSense through the WAN IP, so that's my problem.  Would a NAT rule be able to accomplish that?

Hope that makes sense.  :)

Offline ptt

  • Hero Member
  • *****
  • Posts: 2343
  • Karma: +402/-46
    • View Profile
Re: Connect to bridged DSL modem (not PPPoE)
« Reply #3 on: May 05, 2017, 04:24:23 pm »
Please post a "screenshot" of your pfSense Dashboard

Offline new-to-netgate

  • Newbie
  • *
  • Posts: 20
  • Karma: +0/-0
    • View Profile
Re: Connect to bridged DSL modem (not PPPoE)
« Reply #4 on: May 05, 2017, 06:15:25 pm »
Please post a "screenshot" of your pfSense Dashboard


Sure.

http://imgur.com/a/DK1gf

Offline ptt

  • Hero Member
  • *****
  • Posts: 2343
  • Karma: +402/-46
    • View Profile
Re: Connect to bridged DSL modem (not PPPoE)
« Reply #5 on: May 05, 2017, 06:25:40 pm »
As noted/pointed before, if you have the "modem" on 192.168.1.0/24 and your pfSense LAN on 192.168.1.0/24 (Same Network segment), it won't going to work..., you need to change one of them (Modem or pfSense LAN) to "other" Network Segment...

Offline new-to-netgate

  • Newbie
  • *
  • Posts: 20
  • Karma: +0/-0
    • View Profile
Re: Connect to bridged DSL modem (not PPPoE)
« Reply #6 on: May 06, 2017, 01:02:13 pm »
I changed the modem LAN to 192.168.2.0/24, the modem management IP is now 192.168.2.254.

To clarify, I'm not using double NAT.  My ISP allows you to bridge one of the LAN interfaces (port 1), which is connected to my pfSense box.

I'm not sure what NAT rule I need to create in order to get devices in my LAN to reach the modem mgt, if that's at all possible.

I read the guide...

https://doc.pfsense.org/index.php/Accessing_modem_from_inside_firewall

...but the guide assumes a PPPoE setup.  My provider does not use PPPoE, so there is that.   :D


Offline JKnott

  • Hero Member
  • *****
  • Posts: 1198
  • Karma: +53/-11
    • View Profile
Re: Connect to bridged DSL modem (not PPPoE)
« Reply #7 on: May 06, 2017, 09:29:13 pm »
Quote
To clarify, I'm not using double NAT.

If your modem is providing a NAT address and you're using NAT with pfSense, then yes you are double NAT.

Offline new-to-netgate

  • Newbie
  • *
  • Posts: 20
  • Karma: +0/-0
    • View Profile
Re: Connect to bridged DSL modem (not PPPoE)
« Reply #8 on: May 07, 2017, 12:16:56 am »
Quote
To clarify, I'm not using double NAT.

If your modem is providing a NAT address and you're using NAT with pfSense, then yes you are double NAT.


No, it's not double NAT.   ::)  Perhaps you should read the information I posted earlier.
The modem is setup in bridge from the WAN interface to port 1 of its LAN interface.  I get the same public IP on both the WAN interface on the modem AND the WAN interface on the pfSense box. 

Offline kpa

  • Hero Member
  • *****
  • Posts: 1232
  • Karma: +138/-6
    • View Profile
Re: Connect to bridged DSL modem (not PPPoE)
« Reply #9 on: May 07, 2017, 02:36:43 am »
You need to add an alias address to the WAN interface in the WAN interface setup page DHCP client section. Add an address from the 192.168.2.0/24 subnet, for example 192.168.2.200/24, renew the WAN DHCP lease to let the setting be applied.

Then you need to add an outbound NAT rule at Firewall->NAT->Outbound. Switch to manual mode first if you haven't and save settings. Then add a new outbound NAT rule with interface "WAN", source network "192.168.1.0/24" (your LAN), destination "192.168.2.254/32" (the modem), translation address "other network" and other subnet "192.168.2.200" (the alias address you entered above). This rule should be the first rule in the outbound NAT rule list.


If you ask me I would have renumbered the LAN and let the modem have its default management address, if you ever need to reset settings on the modem to factory defaults you'll have to go trough the IP address change again.

HTH

Edit: This will not work if the management IP is not set on the bridge interface on the modem but is instead only on the NAT'ed LAN ports of the modem.
« Last Edit: May 07, 2017, 04:24:31 am by kpa »

Offline chpalmer

  • Hero Member
  • *****
  • Posts: 1793
  • Karma: +93/-3
    • View Profile
    • Home of Cablenut
Re: Connect to bridged DSL modem (not PPPoE)
« Reply #10 on: May 07, 2017, 02:47:36 am »
I get the same public IP on both the WAN interface on the modem AND the WAN interface on the pfSense box.


The public IP will no longer be active on your modem while it is bridge mode.

Now that you have this set up can you reach it? 
P.S. statements made by me are not necessarily condoned by the management of this fine organization.  http://badmodems.com

Offline kpa

  • Hero Member
  • *****
  • Posts: 1232
  • Karma: +138/-6
    • View Profile
Re: Connect to bridged DSL modem (not PPPoE)
« Reply #11 on: May 07, 2017, 02:50:23 am »
I get the same public IP on both the WAN interface on the modem AND the WAN interface on the pfSense box.


The public IP will no longer be active on your modem while it is bridge mode.

Now that you have this set up can you reach it?

I'm pretty sure he means that he has the same subnet on the WAN side of the modem and the WAN side of pfSense (the LAN side of the modem).

Offline new-to-netgate

  • Newbie
  • *
  • Posts: 20
  • Karma: +0/-0
    • View Profile
Re: Connect to bridged DSL modem (not PPPoE)
« Reply #12 on: May 07, 2017, 11:30:03 am »
I get the same public IP on both the WAN interface on the modem AND the WAN interface on the pfSense box.


The public IP will no longer be active on your modem while it is bridge mode.

Now that you have this set up can you reach it?

I must have explained my setup poorly, sorry.   :)   I'll try again:


ISP (DSL provider, not PPPoE) > Actiontec T2200H modem / router > pfSense firewall router > LAN

- ISP (telus):        provides a dynamically assigned public IP addresses (say it's 1.2.3.4, gateway 1.1.1.1)

- T2200H (modem/router):  the T2200H gets an IP (say the IP is 1.2.3.4 for simplicity) on the WAN interface: this connection is bridged to port 1 on the LAN side of the T2200H (*); the remaining 3 ports on the T2200H still do NAT, but there is nothing connected to them - The LAN subnet on the T2200H is now 192.168.2.0/24, and the mgr IP is 192.168.2.254.  I connected port 1 (the bridged interface) of the T2200H to the WAN int. of my pfSense box

- pfSense (firewall, NAT):  the same 1.2.3.4 external address and 1.1.1.1 gateway are assigned to the WAN interface.  The LAN subnet is 192.168.1.0/24, mgt at 192.168.1.1


(*) this is an option the ISP (telus) finally introduced after people complained that they wanted to use their own router, but didn't want to double NAT.  It's sort of explained on this page:

https://forum.telus.com/t5/Home/Bridge-Mode-Using-Your-Own-Router/ta-p/52181




Offline new-to-netgate

  • Newbie
  • *
  • Posts: 20
  • Karma: +0/-0
    • View Profile
Re: Connect to bridged DSL modem (not PPPoE)
« Reply #13 on: May 07, 2017, 11:56:57 am »
You need to add an alias address to the WAN interface in the WAN interface setup page DHCP client section. Add an address from the 192.168.2.0/24 subnet, for example 192.168.2.200/24, renew the WAN DHCP lease to let the setting be applied.

Then you need to add an outbound NAT rule at Firewall->NAT->Outbound. Switch to manual mode first if you haven't and save settings. Then add a new outbound NAT rule with interface "WAN", source network "192.168.1.0/24" (your LAN), destination "192.168.2.254/32" (the modem), translation address "other network" and other subnet "192.168.2.200" (the alias address you entered above). This rule should be the first rule in the outbound NAT rule list.


If you ask me I would have renumbered the LAN and let the modem have its default management address, if you ever need to reset settings on the modem to factory defaults you'll have to go trough the IP address change again.

HTH

Edit: This will not work if the management IP is not set on the bridge interface on the modem but is instead only on the NAT'ed LAN ports of the modem.

I did try what you suggest, but it's still not working.  Cannot ping 192.168.2.254, or see the GUI.
I admit I don't understand the concept of DHCP alias.  I changed the modem IP because it was easier, I have several static IP  and reservations on the LAN side.


Offline chpalmer

  • Hero Member
  • *****
  • Posts: 1793
  • Karma: +93/-3
    • View Profile
    • Home of Cablenut
Re: Connect to bridged DSL modem (not PPPoE)
« Reply #14 on: May 07, 2017, 04:29:13 pm »

Because your not using any PPP tunnel, the modems (new) subnet is outside your local LAN. So any requests to that new subnet (192.168.2.x) will pass through your pfSense router from your LAN and through/to the modem by default.   Since there is no tunnel the modem interface will see the attempt without any extra configuration on your part on the pfSense box.

The only issue that there could be is that the modem itself does not have a path back to your LAN. Many DSL modems (unlike most cable modems/bridges) do not have a specified (gateway) on their maintenance interface and therefore do not send any traffic outside their own subnet.

Easy way- (Probably a huge security hole) would be to connect your LAN switch to a second port on the modem and put the modem back on 192.168.1.x. Then make a firewall rule on your LAN interface that blocks the modem IP from anything.   Requests from anything on your LAN would pass back and forth on your local LAN without any traffic transversing the pfSense box.   You could try this as a test and then unplug it when not in use.   (how often do you need to see your modem stats anyways..)

Otherwise- you need to provide a path from 192.168.2.254 on your wan to 192.168.1.0/24 on your LAN. The modem likely does not know on it's own.



P.S. statements made by me are not necessarily condoned by the management of this fine organization.  http://badmodems.com