Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Expert version

i want to create a route in pfSense that will send traffic out the physical WAN port, not the PPPoE WAN port. i want to talk to the web-server on my DSL modem; letting me see the current sync rate and SnR margins. The modem doesn't see packets destined for it, because they're being sent through the PPPoE tunnel.


Long version

My pfSense router is responsible for setting up the PPPoE connection over DSL to my ISP. When a machine on the LAN wants to sent packets to the internet, the default route sends packets out over the PPPoE connection. Those packets, wrapped in a PPPoE header, are sent on the ethernet cable to my DSL modem. From there they are sent the ISP, and the internet at large.

i want a way to send a packet out the WAN port itself - not the PPPoE WAN port.

My modem is sitting out there, with a http interface where i can monitor

  • connection speed
  • signal-to-noise ratio
  • bandwidth
  • connection time

Whenever i try to set a route for destination of 192.168.2.1 (the IP that the modem will listen to for HTTP requests) to go out the WAN port, they instead end up going out the PPPoE port.

The difference being that they're wrapped in a PPPoE protocol packet, and the modem isn't being sent the packet, it's being delivered to the ISP.

Given that pfSense has no ability to direct traffic out the physical WAN port: how can i direct traffic out the physical WAN port on pfSense?


Here's the exact same question i asked 3 years ago on the pfSense forum:

My modem has a web interface. It's handy because i can see if it's actually connected or not, line noise, error rates, etc.

If i connect the modem to my destop PC (rather than to the pfSense PC), i can ping and browse the modem's web interface fine. The modem's IP is 192.168.0.254, and listens on port 8080. i also can packet trace the activity from my PC:

Pinging modem

ARP REQ    Phalanx => Broadcast     192.168.0.98  -?- 192.168.0.254
ARP RESP   Phalanx <= Ovislink_LAN  192.168.0.254 -!- 192.168.0.98
IP/ICMP    Phalanx => Ovislink_LAN  192.168.0.98  =>  192.168.0.254 ECHO
IP/ICMP    Phalanx <= Ovislink_LAN  192.168.0.98  <=  192.168.0.254 ECHOREPLY

You can see my machine doing an ARP broadcast, asking for the MAC address of the modem (the Ovislink). The modem responds with its IP, the echo goes out, and i get a reply. Similar detail can be seen when i connect to the web port of the modem:

Connecting to web port 8080

ARP REQ     Phalanx => Broadcast    192.168.0.98       -?- 192.168.0.254
ARP RESP    Phalanx <= Ovislink_LAN 192.168.0.254      -!- 192.168.0.98
IP/TCP      Phalanx => Ovislink_LAN 192.168.0.98:50001 =>  192.168.0.254:8080 SYN
IP/TCP      Plalanx <= Ovislink_LAN 192.168.0.98:50001 <=  192.168.0.254:8080 SYNACK
IP/TCP      Phalanx => Ovislink_LAN 192.168.0.98:50001 =>  192.168.0.254:8080 ACK

After the ARP request, a TCP connection is established with the normal SYN, SYN ACK, ACK process. And all is well.

Now, rather than connecting the modem to my desktop PC, i connect it to the PC that is running pfSense.

Note: Previously, i had changed pfSense's LAN IP Address to be 192.168.1.1/16, rather than 192.168.1.1/24. This is because my network was already 192.168.0.0/16.

First thing i do is disable the "Block private networks" feature under Interfaces->WAN, since my modem's LAN interface is running as 192.168.0.254. This removes the first firewall entry under Firewall->Rules that was blocking all RFC1918 traffic. Next i added a firewall rule:

Action: Pass
Interface: WAN
Protocol: TCP
Source: Single host or alias, 192.168.0.254
Destination: LAN subnet
Destination Port Range: any
Log Packets: Yes
Description: ADSL Modem

After saving and applying my changes i tried using the Diagnostics->Ping feature to ping 192.168.0.254 on the WAN side. It, of course, didn't work.

i thought about it, and it seems to me that i can't just allow TCP packets in on the WAN from 192.168.0.254, i also need to allow ARP response packets (how else could pfSense find the MAC address of the hardware it's trying to send an IP packet to?). It also occurred to me that i can't say LAN as the destination, because it's actually the WAN interface that's pinging. So i updated the firewall rule to:

Action: Pass
Interface: WAN
Protocol: any
Source: Single host or alias, 192.168.0.254
Destination: any
Destination Port Range: any
Log Packets: Yes
Description: ADSL Modem

Now when i ping it...doesn't work. No real surprise there. So i decided to run a packet trace:

Interface: WAN
Host Address: 192.168.0.254
Count: 1
Level of Detail: Full

i started the trace, did a ping from Diagnostics->Ping, and get...nothing. No ping reply, and no packets in the trace.

So now it occurs to me that just because:

  • pfSense is on the 192.168.1.1/16 subet
  • my desktop is on the 192.168.0.98/16 subnet
  • my server is on the 192.168.0.10/16 subnet

maybe the modem is not on the /16 subnet. i plug the modem back into my desktop, connect to the web interface and see that it's set for 192.168.0.254/24. So i reconfigure the modem for 192.168.1.254/24. i then reconfigure

  • my desktop to be 192.168.1.98,
  • the server to be 192.168.1.10,
  • and now the modem is 192.168.1.254
  • in addition to pfSense being 192.168.1.1.

i reconnect the modem to the pfSense box, try to ping it and i get...no reponse. i do a packet trace for packets from 192.168.1.254 and i see...none.

So now i'm stumped, and am asking for help.

share|improve this question

3 Answers 3

up vote 2 down vote accepted

Not sure it's possible with DSL... Can you create a firewall rule with only WAN parameters? In other words, go to Firewall > Rules > WAN and create the rule there. Be sure to restrict traffic to not include PPPoE, i.e., LAN > WAN.

share|improve this answer
    
No, the only choices for interfaces are LAN or WAN. –  Ian Boyd Jun 6 '10 at 14:19
    
i'm going to accept the "not possible" answer. It seems to be the correct answer. –  Ian Boyd Feb 14 '11 at 23:29

Sounds to me like your modem router is in bridge mode, and that the pfSense router is setup with the PPPoE Client ID to receive your public IP from the ISP directly. Make sure the router is not in bridge mode, and that its set up as a dhcp server. Then tell pfSense to get its WAN IP by DHCP.

That's really just a guess...

share|improve this answer

To set this up you would need a switch to plug the modem into. The PFSense firewall will plug into that switch with two ports. One port will show up initially as an OPT port, but you can rename it. The firewall will use the PPPoE connection as the WAN interface but you can route to the modem over the opt interface.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.