Two subnets
-
Please explain!
Lets say pfsense have LAN1 and LAN2. This two subnets will see each other from creating or need some firewall rules. If need a firewall rules , what kind of should done? -
@Antibiotic well by default your first lan would be able to talk to anything in lan2 - because of the default any any rules. But yes when you bring up a new network you would need to create rules. They can be anything you want - what that is would be up to what you want to allow or deny..
You could make them any just like the default lan rules - or you could be very restrictive..
-
@johnpoz This two LAN's have the same default rules, LAN of pfSense connected to WAN of second router. LAN1 192.168.10.1/LAN2 192.168.11.1 But second router don't show any connected devices on LAN1? What want to do, that this second router working as VPN gateway for some of my home devices on LAN1 and LAN2. Second router have opened access from WAN. But can not access to web gui via any PC from LAN1?
pfSense plus 25.07.1 on Topton mini PC
CPU: Intel N100
NIC: Intel i-226v 4 pcs
RAM : 16 GB DDR5
Disk: 128 GB NVMe
Brgds, Archi -
@johnpoz Could be a better way to connect this router to switch port connected to pfSense LAN1?
-
@Antibiotic said in Two subnets:
LAN of pfSense connected to WAN of second route
that is not 2 networks... That is some nat router on your lan... Not sure what you expect to do with that sort of setup?
-
@johnpoz I want to use this second router as vpn gateway for some my home devices on LAN, will not connect any new devices to second router LAN.
-
@Antibiotic so setup a 2nd network on pfsense and use this wireless router as AP/switch.
-
@johnpoz Misunderstanding I think, want to use this mini router as VPN. I don't want to use main pfSense as VPN and pass some traffic via this mini router VPN. When put this mini router to bridge mode as switch VPN function disappear.
-
@johnpoz Please also assist me with 2 subnets:
pfSense LAN1 192.168.10.1 - Desktop
pfSense LAN2 192.168.11.1 - AP/WiFi router - Laptop, Phone
How to make Desktop to communicate with Laptop , because they are don't see each other? Both have the same rules and have internet access. -
@Antibiotic for stuff to talk to stuff behind your nat router you would have to use port forwarding on that nat router and access it via the wan IP of the nat router.
-
@johnpoz So like understood, have to do on mini router port forwarding to pfSense. Is it correct? or on pfSense router port forwarding to mini router? in doubt
-
@Antibiotic said in Two subnets:
mini router port forwarding to pfSense.
No... You have this..
If you want to get to 12.100 say on port 666 from 10.100 you would have to port forward on your nat router traffic hitting its 11.2 address to 12.100
Your client on on 10.100 would have to hit the 11.2 address
The cleaner solution is to just use this router as AP/switch and put it on the 11 network, and then create your vpn on pfsense and policy route traffic out your vpn on pfsense. With a bypass of your policy route so if devices on the 11 network want to talk to the 10 network the rule is above your policy route on the 11 interface.
If your rules on 11 allow to talk to 10 then anything on the 12 network would be able to do that, as long as the nat router doesn't force their traffic out the vpn. Because to the 10 device it would just be 11.2 talking to it. because your natting.
-
@johnpoz Aha , will try to do now and test))))
-
@Antibiotic If you want to get to 12.100 say on port 666 from 10.100 you would have to port forward on your nat router traffic hitting its 11.2 address to 12.100
But port number could be any , how you write 666 or should be 80:443 -
@Antibiotic the 666 was just an example port.. You would setup the port forwards you want to use on that nat router.
-
@johnpoz Second question, how to define the same IP for all time. Add static mapping in DHCP lease page?
-
@Antibiotic for what device? Yes for your 2nd nat router you could either set reservation on pfsense dhcp server for that 11 network, or you could just set it static on the router.
For stuff on your 12 network that would be done on that nat router dhcp server, or on the devices themselves behind that router.
Why not just setup the vpn on pfsense and use policy routing to route the stuff you want out this vpn, this could be specific IPs or the whole network.. I just don't see a good reason to complex up the setup like this.
-
@johnpoz But have to put port forward rule for each device, impossible to make one rule for all clients for example behind 192.168.12 to 192.168.10 behind
-
@Antibiotic Yeah you would need to create port forwards for anything you want to access behind this nat router.. Again going to stress that this solution is not very good.. Especially if you want to talk to stuff behind this router.
And no you can not port forward say port 80 to all devices behind, without having a different IP on its wan.
You could turn off its nat, and just use it as a downstream router where your 11 network is the transit, this would be a better solution.. Then you wouldn't need to do any port forwards. And you could access everything behind on the 12 network via its actual IP.
-
@johnpoz But if will switch off NAT on Wireless router working in router mode connected to LAN of pfSense , how clients behind this Wireless router will have internet access or me don't understand something? Like understanding NAT to make 1 IP on WAN for all clients in this network but in this case how will all this work?
