Please help me oh mighty gods of pfsense and nat reflection
-
@fagoti said in Please help me oh mighty gods of pfsense and nat reflection:
but it seems like a lot of changes for my already huge network.
Creating a transit is not a lot of work.. But running downstream routers that don't nat are going to cause you all kinds of grief without a transit network.. Or doing host routing on ever host..
Transit network is the correct solution..
-
im trying to reply but i keep receiving akismet spam message :/
-
im gonna try breaking my reply in parts
-
It seems you know what you are talking about.
I will give it a shot on a smaller scale here. -
I have just finished doing the "B PLAN" kindly suggested by @viragomann , and its working,
its not pretty, and has lots of places to check when it goes bad,.. but works.
i will be planning how to change all those links for everyone...
but even if i later manage to use your refined transit idea, i can still use those new links i build for split dns, so.. i guess its a good idea to go all the way with it.
-
thanks john
and by the way @viragomann thanks again, because of your quick tip i ended up improving my understanding of my win.dns features.
-
@viragomann i managed to implement a working split dns here. im quite satisfyied.
i still want to test @johnpoz advices. (but its crazy here, i have like 50 routers.. i think it would be a mess to go with it)
-
@fagoti
The transit network is needed if devices in the main network 172.16.0.0/16 should be able to communicate with devices in 192.16.0.0/24 behind routers. I didn't consider that this would be desired before.However, if you need this you can simply do that with a VLAN on the same wire. Create a VLAN on pfSense and on the routers, ensure that it doesn't overlap with other subnets, and point a static routes on both routers for the network behind them to the VLAN IP of each other.
-
@fagoti said in Please help me oh mighty gods of pfsense and nat reflection:
have like 50 routers..
Why and the F would you have so many routers.. But ok if you had like 2000 of them you could still put them on a transit network..
What are these routers.. Why would you need so many? What are they?
-
@johnpoz its a huge network... spread among a number of buildings and neighborhoods.. some of them with 20 or something rooms...
and on top of that, lots of different models of routers, more than one ptp optic fiber provider, some vlans, its pretty messy...
but its working.
and with the split dns i managed to make a little more time on that masterplanning of a better topology :P
-
@fagoti are you running in a mesh topology setup? You could also test out changes I learned with GNS3 it's a virtual network system. Just set up a virtual test with virtual versions all the routers and items all airgapped for your test. A virtual research test version of your network. GNS3 also lets you load OS onto VMs even add in servers and have it function if needed while testing it. Just double click on the host and it opens. Our cybersecurity Professor showed it off on our last days of class. It's cool. Wicked cool. That reminds I want to play with it tomorrow.
(GNS3)Ref:
https://gns3.com/I would also start testing out whitebox routers up so I could push down changes to all the routers at once from the control system. also know as SDN (Software Defined Networking).
-
-
@JonathanLee we are.
i didnt know that GNS3 system. seems like a great tool. ill be looking into it.
thanks for that great tip -
@JonathanLee hahahahhahahha lol
