Multiple OPNSenses on one modem

[freddykromer]

We added four public IPs to our connection. Before that we just had one.
We wanted to build a separated network on one of the new public IPs with it's own opnsense. So we connected an other OPNSense to the modem. Now we have 2 OPNSense on the same modem, each with its own public IP.
Everything works fine but we can't reach the OPNsenses from each other, as well as we can't reach any of the OPNSenses from any other device, directly connected to the modem.
In both firewall logs you can see that the request is received and allowed, but websites and pings are not reachable. We tried to solve this for days now and we don´t have any idea what could be the problem...
Can someone please help us with this?

[chemlud]

VPN connection from one sense to the other?

[haljimmy]

Access from WAN is disabled by default,
Have you added needed firewall rules? Routes? Did you try to disable the "block bogon and private networks" on the interfaces?
When trying to access them from the modem are you using a separate public ip on the computer or a private ip?

We need some more information what you have tried so far

[freddykromer]

@chemlud Maybe I didn´t explain the issue well enough... I can`t even reach the other router by ping, so how could I establish a VPN-connection?

[freddykromer]

@haljimmy Yes of course we added the rules. We can access the to routers from every destination, except from devices on the same modem.

We already tried to disable the block rules you mentioned, even though that wouldn`t make sense either, cause if that would be the problem, then the firewall would log the blocked packages.

When trying to access the opnsenses from each other, we use a public IP, cause they both have public IPs. Any other device we connected has also a public IP.

[chemlud]

if your router would reply to ping on WAN without further measures, I would consider it to be unsafe. I havn't tried different public IPs over one modem, but in principle two senses connected to the internet with public IPs should be able to reach each other for a VPN tunnel...

[freddykromer]

Maybe it makes sense to do an other explanation of the problem.

I can connect to the webservers on the networks from any destination.

When I go out from a Network to the other one on the same modem then the request is like that:

Network 1 (example1.com) tries to reach Network 2 (example2.com) --> So from the router the IP from Network 2 is send to the Gateway on the modem, and that should route it to Network 1. And it seems like it does, cause the traffic is visible on both firewall logs. But actually you cant reach the websites, or ping the other router.

[freddykromer]

@chemlud we added the ping-rules on both OPNsenses. So we can ping the OPNsenses from an other network, but not from networks on the same modem

[chemlud]

What kind of modem is that? maybe there is a private IP for the communication of modem and sense and that's the problem, as traffic between senses is never leaving the modem (or only to the next router upstream at your provider)

[freddykromer]

The modem is a Hitron CGNV4. I don´t think the modem is the problem here, cause we have an other router (Lancom) on one of the public IPs which we can ping from both of the opnsenses.

[freddykromer]

Solved it by adding a static route on the wan gateway to the modem-gateway. I don`t understand it completely, but anyways...

[muchacha_grande]

Hi @freddykromer, can you explain in more detail how did you solved it?

Thank you

[freddykromer]

I added a static route:
Network-Address: the public IP from the other opnsense
Gateway: Wan Gateway (The Gateway from the modem)