Routing 2 networks (create Guest WAN access only network)

[Perceval]

Hi !
I'm asking for some help because I can't find out my error(s) there, even after reading the handbook and several threads. I'm running a Raspberry Pi 3 Model B with FreeBSD 14.3-RELEASE and I want to create a WiFi Hotspot which redirects users to WAN only (a guest wifi network in its own subnet 192.168.0.0/24).

The setup is the following :
RPi (AP, DHCP server and router) :
wlan0 (rtwn0 / A Realtek USB Wifi dongle - The Broadcom embedded chip is not supported), static 192.168.100.1/24 --> DHCP server using 192.168.100.1 as gateway --> RPi Ethernet (ue0) static 192.168.200.64 ---> ||| 192.168.200.1 (my ISP router gateway, which manages the 200.0 network. |||

To simplify, the .100.0 Wifi users should go directly to the ISP gateway 192.168.200.1 to go outside, nothing else.

From Ethernet, it works as expected regarding LAN and WAN network. The Wifi AP part looks fine too : the access point is enabled, so does the DHCP server which works great on the guest network (Gateway 192.168.100.1 ; DNS servers are public ones) ; however I can't get out of it, as (from a Wifi device) I can ping 192.168.100.1, 192.168.200.64 but I can't go on the next hop (should be 192.168.200.1 if I'm not wrong). I've been trying some static routes but no hint. It looks I can't use my public IP adress for DHCP server or as defaultrouter value.

In /etc/rc.conf, defaultrouter is set to the ISP (192.168.200.1) ; both wlan0 and ue0 have their respective ifconfig values set.

Here is the feedback of netstat -r :

Internet:
Destination        Gateway            Flags         Netif Expire
default            192.168.200.1        UGS             ue0
localhost          link#1             UH              lo0
192.168.100.0/24     link#3             U             wlan0
192.168.100.1        link#1             UHS             lo0
192.168.200.0/24     link#2             U               ue0
192.168.200.64       link#1             UHS             lo0

I haven't done anything yet with PF NATing.

I'm very noobish on this one, as I never tried yet advanced networking on FreeBSD.

Thanks for any help !!

 

[Perceval]

Solved it !
Thanks to this thread, here is the magic in pf.conf :
nat on ue0 from {192.168.100.0/24} to any -> (ue0)

No static route set in rc.conf, only pf that does its NATing. The guest network does now have access to Internet... and the whole .200.0 network. So I need to restrict access from .100.0 users with pf rules. I'll feedback once it works (or I'll ask for help).

Thanks !