Expanding address space on LAN - What concerns do I have to watch for?
-
@SteveITS said in Expanding address space on LAN - What concerns do I have to watch for?:
Usually, that means a subnet mask is wrong on the Pi or pfSense, and it can’t talk to the “other” part of the subnet.
If that were the case on the Pi (which is using DHCP, so it's getting the info from pfSense), then I would think it wouldn't be able to communicate with the rest of my LAN.
So would that narrow it down to a firewall rule on the LAN in pfSense?
-
@TangoOversway well for instance a wrong mask might let a device talk to .1-.255 but not .256-.511.
Firewall rules would apply to Internet traffic but not internal traffic. So yes that could block internet.
-
I checked my firewall rules. I don't remember making these, but there was a time when I was experimenting with various VPNs and it's possible I added some rules at the time, but I don't remember leaving any behind. Here's my firewall LAN rules - are these default rules?
-
@TangoOversway those are just default ones - make sure you check in floating tab for any rules.
-
Okay, looked at NAT, I see some that specify a specific address range:
(Note: I originally was talking about a 172.16.1 subnet, but I'm using 172.16.7 as the original and 172.16.6 as the new one.)
Those last two NAT rules that specify the 172.16.7 subnet - are they default rules? (I'm thinking I may have made those when experimenting with VPNs and may have forgotten to delete them.)
-
Are your outbound NAT rules set to manual? If so you would need to update them.
-
@TangoOversway yeah if you messed with some vpn, most of their shit guides tell you to move to manual nat, when all that is needed is hybrid.
-
Yes, set to manual. So by "update," I take it you mean to specify my new address range in the rule, as opposed to some kind of system update or anything like that, right?
If I'm not running any VPNs or anything fancy, do I need those rules? Are they normal or default pfSense rules?
-
@TangoOversway even if you were running vpn, there is no need to be set to manual for your outbound, you can just use hybrid and create the rule you want to nat to your vpn connection.
I would switch it back to auto, and delete any of those manual nats..
-
So, assuming I'm not running anything extra, can I just delete those two rules last in the list? And if so, any others I should delete while I'm at it? Or would it be better to extend the address range for those two?
-
@TangoOversway I edited, I would go back to auto.. if you want to play with vpn later than use switch to hybrid and create your rules..
Her are my current outbound nats
-
@johnpoz Thanks. Did that and got this:
I take it the mappings are all ghosted because they're inactive at this point?
I tested it out by changing the Pi back to the additional address space and it's working okay now.
-
Yes they are greyed out because they don't apply in auto mode If you switch to Hybrid or Manual again they would come into play again.
-
@stephenw10
Thanks! It's working and I suspect I did that when I was trying to setup and test different VPNs. (Ended up with Tailscale - had issues with OpenVPN, PureVPN, and multiple others - either they couldn't do something or it was a feature trade that didn't work for me.)
