58 replies to this topic

[Captain_Rainbowbeard]

Yes, hosts on the .0 network are wireless clients using the ISP router, these machines do not belong to me, they belong to other housemates, 2 of which I would like to share my media with over the network. It would be totally feasible to add a wireless access point to my .1 network and allow these users to directly access these resources though it would cause problems disabling the wireless on .0 as other people in the building that I do not know would then be unable to access the internet, besides, I would prefer to have these users outside of .1 and safely on .0, my mum always told me not to let strangers into my private place...!

I'm assuming that it will cause no issues allowing the others to stay wirelessly connected to .0 and allowing the 2 people I do want to access my resources a wireless connection to my .1 network?

[+BudMan]

Sure you could add another wireless AP to your .1 network - and then the wireless on .0 would be guests and hostile.

But if your really wanted you could allow specific IPs into your .1 from .0 for file shares.. They could just use IP vs name because your going to have issues with resolving name for pfsense wan IP.. They could always setup lmhost or host file on their boxes. I doubt your isp router allows you to manipulate dns for your own records?

If you wanted you connect your wireless AP on your private side of pfsense to different interface on the pfsense box and then bridge the interfaces to your wired interface and have some firewall controls and still allow for broadcast resolution, etc..

Other than that if you want to allow from 0 network you would have to forward the ports your using smb/cifs can be done over 445 you could allow 139 as well and you should be good. This would be a port forward to your box hosting the share..

So for example your pfsense sense wan is 192.168.0.20, and your private box hosting the share is 192.168.1.110, create a port forward for 139 tcp and 445 tcp to 192.168.1.110, then from your box on the 0 access \\192.168.0.20\ and you should see the shares.. Keep in mind they would have to auth to the box hosting the shares unless your allow guest type access, etc.

You might want to lock down these rules to only allow access from specific IPs on the 0, say 192.168.0.42 or something.. Hard part might be knowing which IPs on the 0 to allow? I would assume you wouldn't want to allow ALL, and don't do such a thing if you forward all traffic into pfsense wan port from isp router without a source IP restriction. I would assume other boxes on the 0 use dhcp and could change IPs, etc.. This will be the hard part about setting secure rules to only allow the 0 IPs you want to allow.

It would be better to setup your own wireless on .1 and secure that via PSK to people you want to access stuff on your network, you let them use your wireless network. Then they would use pfsense as their internet gateway as well in this setup. Or you could block them from using internet when on your wireless and only be able to access your shares and services on your .1 vs internet access, etc.

[Captain_Rainbowbeard]

I've just been doing some testing further to the suggestions you made and have discovered that my pfSense box WAN interface is not visible in 'Network' from Windows clients on .0, I assumed that this should be visible? Could this be part of the reason why (or at least some explanation for), despite creating apparently correct forwarding rules, I am still unable to access my file sharing resources regarding that I am using IP vs hostname? I also tried created a hostname for my pfSense WAN interface for DHCP resolution on the .0 network and still no show...? I assume these are the issues you were referring to regarding name resolution for my WAN IP...?

I've also been having thoughts about creating a network mountable filing system of sorts instead of an SMB share as a possible workaround, I am assuming that this sort of service would prove to be somewhat less problematic than my current line of thought? What are your thoughts on this and could you possibly suggest any preferable protocols to use for this type of setup, bearing in mind the host for the present SMB share is running Server 2008 R2. (This will also eventually be my FTP/IIS7 etc. server...)

[Captain_Rainbowbeard]

BudMan, on 03 February 2013 - 16:06, said:

Other than that if you want to allow from 0 network you would have to forward the ports your using smb/cifs can be done over 445 you could allow 139 as well and you should be good. This would be a port forward to your box hosting the share..

So for example your pfsense sense wan is 192.168.0.20, and your private box hosting the share is 192.168.1.110, create a port forward for 139 tcp and 445 tcp to 192.168.1.110, then from your box on the 0 access \\192.168.0.20\ and you should see the shares.. Keep in mind they would have to auth to the box hosting the shares unless your allow guest type access, etc.

Just for clarification, I hope I am correct in assuming that this forward requires to be set as a rule on pfSense and not on the ADSL router otherwise I can see where I am going wrong with this suggestion...

[+BudMan]

Your not going to see pfsense wan in any browselist no.

If you forwarded 139 and 445 tcp to your 2k8r2 server and its sharing and allowing guest then you should be able to access via \\ipaddressofpfsensewan from 0 network. Use the run box and go directly there your never going to be able to use a browselist for this sort of access.

But no I would not think smb or cifs is a good protocol to use - I would use ftp or sftp, where sftp is much easier since its only 1 port. But 2k8r2 does not natively support ssh, so you would have to install that. So sure ftp would work.

[Captain_Rainbowbeard]

BudMan, on 04 February 2013 - 12:41, said:

If you forwarded 139 and 445 tcp to your 2k8r2 server and its sharing and allowing guest then you should be able to access via \\ipaddressofpfsensewan from 0 network. Use the run box and go directly there your never going to be able to use a browselist for this sort of access.

I tried this but an error message popped up saying that the IP I was trying to access was unavailable. Anyways this is no biggie any more, I have added wireless access to the .1 subnet (PSK encrypted with access control enabled, WPS disabled, nice and secure), this is working fine now for the purposes I require.

For now it appears that my network configuration is just as I would like it though I have a little problem regarding pfSense...

It appears that if the ISP supplied router is restarted (which occasionally needs to be done as periodically the web-based setup stops working and wont display the logon screen again until the router is restarted) pfSense doesn't automatically reconnect, despite having a statically assigned IP leading me to believe it's not a DHCP lease issue, leaving all machines in .1 without internet. Is there any way to automate reconnection on pfSense after a router restart/connection drop?

[+BudMan]

If pfsense has a static IP on its wan --- Which I somehow doubt to be honest, do you mean you setup a dhcp reservation for it on the isp router?

What I would assume is happening is on reboot of isp router your pfsense is getting a different wan IP, say 192.168.100.x

Because if pfsense is static IP assigned on its wan, as long as the network is on - then you would be connected..

Lets see this static assigned pfsense wan setting



And when its not working - lets see the wan status

[Captain_Rainbowbeard]

BudMan, on 04 February 2013 - 13:17, said:

If pfsense has a static IP on its wan --- Which I somehow doubt to be honest, do you mean you setup a dhcp reservation for it on the isp router?

Yes, I do mean there is a DHCP reservation for it on the ISP router, not a statically assigned IP on the WAN interface, my mistake...

Here is the WAN status:



As you can see here the WAN interface is using DHCP, should I change this setting to assign a static IP to resolve this issue?

[+BudMan]

I don't see the reason for the dhcp on the wan and you want it to be static.

What is the lease time? it should work the way you have it set, even if the isp router reboots - there could be some down time until the isp router finishes reboot, etc.

But you could have a problem with the interface going offline when the router reboots and then coming up again as the ports go active but not getting an IP right away if router has not finished booting, etc.

Couldn't hurt to make it static - so if your isp routers dhcp is say 192.168.0.100 to 150 or something then make your static on the pfsense for something outside that range say 192.168.0.99 or less or .151 or more. That would not conflict with any other devices on the 0 network.

And this should remove any issues with dhcp taking a bit to come back, etc.

When you have the issue - what does pfsense show for its wan IP? Can you ping the isp routers IP? You can do that from the diag tab or from the shell of the pfsense router.

[.fahim]

Why double NAT?
the virgin router can be run in modem mode.

http://help.virginme...OMER_TYPE=Cable

[Captain_Rainbowbeard]

.fahim, on 04 February 2013 - 23:08, said:

Why double NAT?

In short, security is the key factor; not only from web based attacks but also from unknown network users in my shared property, not necessarily from attack by them personally but there is no guarantee that their own workstation security hasn't been compromised somehow and I'm not prepared to take the risk that their machines may be used as a potential launchpad for an attack on my server or personal workstations, for all I know their machines may potentially be riddled with any manner of nasty malware picked up from less than reputable software sources or dodgy websites.

Also the steep learning curve has been a particularly encouraging factor, can't learn if I don't try...


@ BudMan

DHCP lease time on the ISP router is 1 hour, last time it was restarted it was 3 hours before I returned home to discover a lack of internet. WAN IP remained the same after, presumably due to the fact that the WAN interface most likely remained up during this time instead of coming down and then back up.

I have assigned a static IP now to WAN, hopefully next time ISP router requires reboot I shan't run into the same issue.

Thanks again BudMan, you've been a wonderful help through all of this, for now it seems that my network is running rather smoothly and has a setup that more that satisfies my needs and desires, for now all is good, can't thank you enough. Perhaps though you will be seeing further posts from me in the future seeking aid with further networking issues, after all, I do like to tinker and am keen to learn...

[+BudMan]

Glad to hear - I would prob remove the double nat as well if possible. Then isolate them from your network via pfsense and another lan segment.. This would ease the access you wanted to do earlier via just a firewall rule vs nat in the way as well. Since everyone would be using pfsense it would ease name resolution for hosts on your lan.

Its another option - and gives you more control You would then either need another wireless AP or push your wireless to a 3 segment and isolate it as well and then give it access into either of your 2 lan segments. You would have your own segment, there would be another hostile segment where other wired house guests are connected and then a 3rd wireless segment.

Been here quite some time, don't plan on going anywhere - so feel free to ask away any questions you might run into.

[Captain_Rainbowbeard]

To be fair I am actually the only wired user in the whole building, I have an ethernet cable running out of my window and into the room where the ISP router resides, which is connected to pfSense at the other end. I only know 2 out of the other 7 people in my building and these are the guys I have connected to my segment and using my SMB share, it would be somewhat problematic trying to get everyone else to connect to a separate segment within my network as it would either require going and speaking to all of these people and either running a cable from their rooms to mine or convincing them to wirelessly connect to another AP and to be quite honest I really don't have the enthusiasm to do this.

As far as I'm concerned I'm happy for the 'unknowns' to continue using the ISP router directly and only allowing particular individuals access to my subnet, besides, I still look forward to the challenge of making FTP work through double NAT, it's been an interesting learning curve already and as such I have deepened my understanding of routing and NAT which essentially was part of the purpose of this experiment.

It's a nice idea nonetheless and I will at some point build another segment for my cisco lab to experiment with this sort of setup as again I would like to keep this separate from my .1 subnet due to the fact I will be experimenting with switching and routing on a more complex level. Does this seem like a reasonable idea to you?

[+BudMan]

Well if others are all wireless they are all competing for shared bandwidth - while you being wired more than likely get the lion share

You can do whatever you want with your network behind pfsense, create as many segments as your box will allow interfaces or if vlan capable switches then you could just use vlan tagging to create your multiple segments all using 1 interface on pfsense, etc.