Expanding address space on LAN - What concerns do I have to watch for?
-
@JKnott said in Expanding address space on LAN - What concerns do I have to watch for?:
Same here. The only devices that have a static config are my main desktop computer and pfSense. Everything else has has static mapped DHCP.
My static IP addresses are all mapped through the DHCP server. I wouldn't even do that, but I've used a few programs here and there that, for some stupid reason, require me using the IP address of the other machine on my LAN to connect. They're not high security apps and, on my LAN (and I suspect most LANs), a hacker with a bit of experience could ghost a MAC address and get the same IP address just like stealing the name. So I really don't see any reason for a program to use an IP address instead of the hostname.
-
I use static mapping for convenience. The host name is just part of the config.
-
Just verifying that I did this as discussed and it worked. All my systems on the LAN use DHCP and any assigned addresses are handled by the DHCP server in pfSense. All I did was go to the General Configuration page and change the mask to 23 bits instead of 24 and saved and applied that. Now I have a 512 address range instead of 256.
-
@TangoOversway said in Expanding address space on LAN - What concerns do I have to watch for?:
Now I have a 512 address range instead of 256.
Wait till you go to IPv6 and have an 18.4 billion, billion (2⁶⁴) address range.
-
Okay - found more trouble with this.
I put one Raspberry Pi in the new address space and it can't reach the internet. When I changed the IP address back to within the old subnet I was using, the Pi could reach the internet. There was no problem, under either setting, with communication on my LAN.
I checked firewall rules and don't see anything that I think would limit traffic to the original address space.
What's going on and what do I need to do so a device in the new address space can reach the internet?
-
@TangoOversway Usually, that means a subnet mask is wrong on the Pi or pfSense, and it can’t talk to the “other” part of the subnet.
-
@SteveITS said in Expanding address space on LAN - What concerns do I have to watch for?:
Usually, that means a subnet mask is wrong on the Pi or pfSense, and it can’t talk to the “other” part of the subnet.
If that were the case on the Pi (which is using DHCP, so it's getting the info from pfSense), then I would think it wouldn't be able to communicate with the rest of my LAN.
So would that narrow it down to a firewall rule on the LAN in pfSense?
-
@TangoOversway well for instance a wrong mask might let a device talk to .1-.255 but not .256-.511.
Firewall rules would apply to Internet traffic but not internal traffic. So yes that could block internet.
-
I checked my firewall rules. I don't remember making these, but there was a time when I was experimenting with various VPNs and it's possible I added some rules at the time, but I don't remember leaving any behind. Here's my firewall LAN rules - are these default rules?
-
@TangoOversway those are just default ones - make sure you check in floating tab for any rules.
-
Okay, looked at NAT, I see some that specify a specific address range:
(Note: I originally was talking about a 172.16.1 subnet, but I'm using 172.16.7 as the original and 172.16.6 as the new one.)
Those last two NAT rules that specify the 172.16.7 subnet - are they default rules? (I'm thinking I may have made those when experimenting with VPNs and may have forgotten to delete them.)
-
Are your outbound NAT rules set to manual? If so you would need to update them.
-
@TangoOversway yeah if you messed with some vpn, most of their shit guides tell you to move to manual nat, when all that is needed is hybrid.
-
Yes, set to manual. So by "update," I take it you mean to specify my new address range in the rule, as opposed to some kind of system update or anything like that, right?
If I'm not running any VPNs or anything fancy, do I need those rules? Are they normal or default pfSense rules?
-
@TangoOversway even if you were running vpn, there is no need to be set to manual for your outbound, you can just use hybrid and create the rule you want to nat to your vpn connection.
I would switch it back to auto, and delete any of those manual nats..
-
So, assuming I'm not running anything extra, can I just delete those two rules last in the list? And if so, any others I should delete while I'm at it? Or would it be better to extend the address range for those two?
-
@TangoOversway I edited, I would go back to auto.. if you want to play with vpn later than use switch to hybrid and create your rules..
Her are my current outbound nats
-
@johnpoz Thanks. Did that and got this:
I take it the mappings are all ghosted because they're inactive at this point?
I tested it out by changing the Pi back to the additional address space and it's working okay now.
-
Yes they are greyed out because they don't apply in auto mode If you switch to Hybrid or Manual again they would come into play again.
-
@stephenw10
Thanks! It's working and I suspect I did that when I was trying to setup and test different VPNs. (Ended up with Tailscale - had issues with OpenVPN, PureVPN, and multiple others - either they couldn't do something or it was a feature trade that didn't work for me.)
