• Sign in to Neowin Faster!

    Create an account on Neowin to contribute and support the site.

  • 0
Sign in to follow this  

Linux gateway/router issues, please help!

Question

Captain_Rainbowbeard    0

Hi all, I posted this issue on another forum and was directed here to seek help, hope I can get some good advice.

I should start by explaining my home network setup... I live in a shared building split into individual flats/rooms with shared internet across the whole building. The ADSL router supplied by our ISP is located in another room which I do not often get access to, this is the access point that all other computers in the house are connected to. I have an ethernet cable running from this room into mine to provide me with network and internet access. It is from this point that I am having trouble...

The cable is connected in my room to a Debian (squeeze) linux box which I am attempting to configure as a gateway/router/firewall. From my linux box a second cable is then connected to my network switch which then distributes the connection to my personal machines in my room, one of which is a Windows server (2008 R2) which I am presently running as a web server with the intention of creating a secure FTP server. The Windows server is also running an SMB share and VNC server.

The problem I am having regards access between my internal machines (in my room) and the external machines (rest of the network). The Debian gateway is successfully supplying internet as all of my internal machines are able to access the web, however when attempting to access the ADSL router configuration page from here my browser tells me 'This web page is not available'. I am also able to use my SMB share and VNC server from my internal machines yet externally the server (or any of my other machines for that matter) are not visible across the network, neither can I see anyone else's (external) computers from here.

I am reasonably certain that I wish to keep the setup as is as I am fairly paranoid about network security and would feel more comfortable if I was separated from the rest of the network and the internet via a secure firewall, though I still require my web server to be able to be accessed from the net (and would also like to be able to remote into it via the web using VNC), I would also like other people in the house to be able to take advantage of my SMB share.

I assume that this is a port forwarding issue? (though can't be certain as this sort of setup is quite new to me). Also as the Debian gateway is providing DHCP to my internal machines I am considering the possibility that this may also be an issue?

I am hoping that someone here has enough knowledge to talk me through preparing the correct configuration to make this work or could offer, if necessary, another practical solution that will provide me with the security I desire.

Thanks all for taking the time to consider my problem, any help is greatly appreciated...

Share this post


Link to post
Share on other sites

Recommended Posts

  • 0
+BudMan    3,150

If pfsense has a static IP on its wan --- Which I somehow doubt to be honest, do you mean you setup a dhcp reservation for it on the isp router?

What I would assume is happening is on reboot of isp router your pfsense is getting a different wan IP, say 192.168.100.x

Because if pfsense is static IP assigned on its wan, as long as the network is on - then you would be connected..

Lets see this static assigned pfsense wan setting

post-14624-0-81071700-1359983841.png

And when its not working - lets see the wan status

post-14624-0-41270400-1359983846.png

Share this post


Link to post
Share on other sites
  • 0
Captain_Rainbowbeard    0

If pfsense has a static IP on its wan --- Which I somehow doubt to be honest, do you mean you setup a dhcp reservation for it on the isp router?

Yes, I do mean there is a DHCP reservation for it on the ISP router, not a statically assigned IP on the WAN interface, my mistake...

Here is the WAN status:

post-476658-0-43316000-1359990407.jpg

As you can see here the WAN interface is using DHCP, should I change this setting to assign a static IP to resolve this issue?

post-476658-0-16079500-1359990432.jpg

Share this post


Link to post
Share on other sites
  • 0
+BudMan    3,150

I don't see the reason for the dhcp on the wan and you want it to be static.

What is the lease time? it should work the way you have it set, even if the isp router reboots - there could be some down time until the isp router finishes reboot, etc.

But you could have a problem with the interface going offline when the router reboots and then coming up again as the ports go active but not getting an IP right away if router has not finished booting, etc.

Couldn't hurt to make it static - so if your isp routers dhcp is say 192.168.0.100 to 150 or something then make your static on the pfsense for something outside that range say 192.168.0.99 or less or .151 or more. That would not conflict with any other devices on the 0 network.

And this should remove any issues with dhcp taking a bit to come back, etc.

When you have the issue - what does pfsense show for its wan IP? Can you ping the isp routers IP? You can do that from the diag tab or from the shell of the pfsense router.

Share this post


Link to post
Share on other sites
  • 0
+Fahim S.    1,032
  • 0
Captain_Rainbowbeard    0

Why double NAT?

In short, security is the key factor; not only from web based attacks but also from unknown network users in my shared property, not necessarily from attack by them personally but there is no guarantee that their own workstation security hasn't been compromised somehow and I'm not prepared to take the risk that their machines may be used as a potential launchpad for an attack on my server or personal workstations, for all I know their machines may potentially be riddled with any manner of nasty malware picked up from less than reputable software sources or dodgy websites.

Also the steep learning curve has been a particularly encouraging factor, can't learn if I don't try...

@ BudMan

DHCP lease time on the ISP router is 1 hour, last time it was restarted it was 3 hours before I returned home to discover a lack of internet. WAN IP remained the same after, presumably due to the fact that the WAN interface most likely remained up during this time instead of coming down and then back up.

I have assigned a static IP now to WAN, hopefully next time ISP router requires reboot I shan't run into the same issue.

Thanks again BudMan, you've been a wonderful help through all of this, for now it seems that my network is running rather smoothly and has a setup that more that satisfies my needs and desires, for now all is good, can't thank you enough. Perhaps though you will be seeing further posts from me in the future seeking aid with further networking issues, after all, I do like to tinker and am keen to learn... :D

Share this post


Link to post
Share on other sites
  • 0
+BudMan    3,150

Glad to hear - I would prob remove the double nat as well if possible. Then isolate them from your network via pfsense and another lan segment.. This would ease the access you wanted to do earlier via just a firewall rule vs nat in the way as well. Since everyone would be using pfsense it would ease name resolution for hosts on your lan.

Its another option - and gives you more control ;) You would then either need another wireless AP or push your wireless to a 3 segment and isolate it as well and then give it access into either of your 2 lan segments. You would have your own segment, there would be another hostile segment where other wired house guests are connected and then a 3rd wireless segment.

Been here quite some time, don't plan on going anywhere - so feel free to ask away any questions you might run into.

Share this post


Link to post
Share on other sites
  • 0
Captain_Rainbowbeard    0

To be fair I am actually the only wired user in the whole building, I have an ethernet cable running out of my window and into the room where the ISP router resides, which is connected to pfSense at the other end. I only know 2 out of the other 7 people in my building and these are the guys I have connected to my segment and using my SMB share, it would be somewhat problematic trying to get everyone else to connect to a separate segment within my network as it would either require going and speaking to all of these people and either running a cable from their rooms to mine or convincing them to wirelessly connect to another AP and to be quite honest I really don't have the enthusiasm to do this.

As far as I'm concerned I'm happy for the 'unknowns' to continue using the ISP router directly and only allowing particular individuals access to my subnet, besides, I still look forward to the challenge of making FTP work through double NAT, it's been an interesting learning curve already and as such I have deepened my understanding of routing and NAT which essentially was part of the purpose of this experiment.

It's a nice idea nonetheless and I will at some point build another segment for my cisco lab to experiment with this sort of setup as again I would like to keep this separate from my .1 subnet due to the fact I will be experimenting with switching and routing on a more complex level. Does this seem like a reasonable idea to you?

Share this post


Link to post
Share on other sites
  • 0
+BudMan    3,150

Well if others are all wireless they are all competing for shared bandwidth - while you being wired more than likely get the lion share ;)

You can do whatever you want with your network behind pfsense, create as many segments as your box will allow interfaces or if vlan capable switches then you could just use vlan tagging to create your multiple segments all using 1 interface on pfsense, etc.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

  • Recently Browsing   0 members

    No registered users viewing this page.