Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Adding route for different subnet on same physical interface

    Scheduled Pinned Locked Moved Routing and Multi WAN
    13 Posts 2 Posters 54.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      akbar
      last edited by

      How can I add a route in the pfSense that will allow it to access 2 different subnets on the same physical interface. I am connected to an ONT which has the IP address 192.168.50.13. The ONT is doing Layer 3 tunneling to connect me to the network 202.143.42.193. So I have assigned the address 202.143.42.193 to the WAN interface with gateway 192.168.50.13. But it complaints of no route to the destination network.

      I have explored the route command but nowhere it allows me to specify the route that does not have a nexthop on reachable subnet. e.g. I simply wanted to add the route

      route add -host 195.168.50.13 re0

      but the route command for FreeBSD tried to manipulate re0 as symbolic host name for the nexthop host. My problem is that I do not have a next hop host. If I issue the command:

      route add -net 192.168.50.13/30 202.143.42.193

      ping fails with TTL expiry.

      I have tried giving alias IP to the WAN interface from 192.168.50.x address, but does not work. The setup for ONT is such that all packets going to 192.168.50.13 will be tunneled to the far end, so the source address for these packets must be 202.143.42.193, otherwise the far end rejects these packets.

      I did try putting in the static ARP entry for 192.168.50.13 in the table from another address in the 202.143.42.193, but all in vain :(.

      I will appreciate any help in this regard.

      Thanks,
      Akbar.

      1 Reply Last reply Reply Quote 0
      • GruensFroeschliG
        GruensFroeschli
        last edited by

        How can I add a route in the pfSense that will allow it to access 2 different subnets on the same physical interface. I am connected to an ONT which has the IP address 192.168.50.13. The ONT is doing Layer 3 tunneling to connect me to the network 202.143.42.193. So I have assigned the address 202.143.42.193 to the WAN interface with gateway 192.168.50.13. But it complaints of no route to the destination network.

        This doesnt make much sense.

        After your description:

        internet
            |
            |
            |
        [WAN] (202.143.42.193/??)
        pfSense
          [LAN] (192.168.50.1/24)
            |
            |
            |
            |–----ONT(192.168.50.13/24)-------------[other_side_of_tunnel] (202.143.42.193/??)
            |
        clients (192.168.50.x/24)

        Could you fill in the correct IP's of what you have where since this can obviously never work.

        Basically you go in the webinterface to "System" –> "static routes"
        And add a static route.

        http://forum.pfsense.org/index.php/topic,7001.0.html

        Static Routes:
        The dropdown for the interface defines on which interface the gateway for the remote subnet is reachable.
        NOT that on the selected interface is the static route applied on inbound traffic.

        So the rule you would need looks like:
        Interface: LAN
        Network: 202.143.42.x/??  (or whatever subnet you have on the other side of the tunnel)
        Gateway: 192.168.50.13  (IP of the ONT)

        We do what we must, because we can.

        Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

        1 Reply Last reply Reply Quote 0
        • A
          akbar
          last edited by

          My apologies for missing out the network diagram in the first post. Below is a detailed one to explain the scenario that I have:

          
Internet
 |
 |
[Remote ONT]
 |
 |
[Local ONT]
192.168.50.101/30
 |
 |
[pfSense]
WAN = 202.143.42.193/29
LAN = 192.168.0.1/24
 |
 |
[LAN]

          The WAN connection is actually a Layer 3 tunnel through ONT. On the WAN interface of pfSense, the default gateway is 192.168.50.101, because all the traffic which comes to WAN interface must be forwarded to the local ONT, which will tunnel it, send it to the remote ONT where it gets unwrapped and is sent over the intranet of the ISP and eventually to the internet. This is the setup that my ISP has given me.

          I have used this setup successfully over Windows, by giving the interface connected to the Local ONT following configuration:

          
IP : 202.143.42.193
Netmask : 255.255.255.248
Gateway : 192.168.50.101

          Though Windows complaints of having the gateway on the different subnet, but probably it automatically adds route for it in the background, because this configuration works perfectly fine. Though I have not tried, but I think the following command on Linux should also have worked:

          route add -net 192.168.50.101/30 re0

          which effectively means that the 192.168.50.101/30 network is also reachable on the re0 interface, so the gateway 192.168.50.101 is accessible. However, in pfSense, either using the Static Route tab or using Shell, the command route does not work in this syntax. It requires that after the host or network, the default gateway for the next hop MUST be provided. In my case, there is no next hop, in fact same network is accessible on the physical interface on which the WAN network is available.

          I am using pfSense 1.2 on Xeon server.

          1 Reply Last reply Reply Quote 0
          • GruensFroeschliG
            GruensFroeschli
            last edited by

            I'm not sure if i undestood how exactly this ONT works, But what i would try:

            1: Set the WAN IP to 192.168.50.102/30, default gateway 192.168.50.101/30
            2: Add a VIP of 202.143.42.193 to the WAN.

            We do what we must, because we can.

            Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

            1 Reply Last reply Reply Quote 0
            • A
              akbar
              last edited by

              I tried this configuration but it did not work. Sniffing on the network showed that the outgoing requests from the WAN interface are going with source IP set to 192.168.50.101, which is the incorrect source IP.

              The packets must be sent with source IP set to 202.143.42.193, otherwise these get rejected after getting unwrapped at the far end ONT. The sequence is below:

              1. LAN packet IP = 192.168.0.234
              2. WAN packet IP (using NAT) = 202.143.42.193
              3. Local ONT Tunnel packet IP (after wrapping) = 192.168.50.101
              3. Remote ONT Tunnel packet IP (before unwrapping) = 192.168.50.101
              3. Remote Network Packet IP (after unwrapping) = 202.143.42.193

              So 192.168.50.101 is being used only for tunneling. The actual IPs are 202.143.42.193. The 2 solutions that I have in mind are:

              1. Use another machine with dual NIC which can route from 202.143.42.193/29 network to 192.168.50.101/30 network.

              2. Use 192.168.50.101/30 network on the 3rd NIC on pfSense machine.

              Right now I hope I can avoid both of these solutions  by using either Virtual IP, Static Route, VLAN or combination of all and more.

              1 Reply Last reply Reply Quote 0
              • GruensFroeschliG
                GruensFroeschli
                last edited by

                If you want that the traffic additionally appears to come from the VIP you have to enable "Advanced Outbound NAT" (firewall–>NAT-->outbound).

                Basically leave the existing rule
                interface: WAN,
                source: your_lan_subnet
                souce-port, destination, destination-port: any
                -->Set your VIP as NAT-Address
                NAT-port: any
                static-port: yes (or no, doesnt matter)

                We do what we must, because we can.

                Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                1 Reply Last reply Reply Quote 0
                • A
                  akbar
                  last edited by

                  Works like a charm :). Thanks a lot for your help.

                  I also want to setup a failover using dual-wan. Since my other internet connection is a PPPoE, so I am using a router after pfSense, which actually makes the internet connection using PPPoE whereas the pfSense sees it as normal internet.

                  I have made the settings according to MultiWAN guide v1.2. Have also added Outbound NAT rule for the OPT1 interface too, since I need to use Advanced Outbound NAT. However, when I unplug the WAN cable, I assume that the internet traffic would automatically be shifted to the OPT1 interface, but it does not appear to be doing so. The Load Balancer status shows correctly that the WAN is down but OPT1 is up. But still the traffic from LAN does not get routed.

                  At this time, however if I plug in the WAN cable again, the traffic starts to get routed properly through WAN, as the Load Balance detects that WAN is now up again.

                  Any hints to what may be wrong, as it appears from the forum that many people have been able to use failover with dual -WAN successfully using the guide. Can this be because of the advanced outbound NAT?

                  Regards,
                  Akbar.

                  1 Reply Last reply Reply Quote 0
                  • GruensFroeschliG
                    GruensFroeschli
                    last edited by

                    Did you create static routes for the DNS to the second WAN?

                    We do what we must, because we can.

                    Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                    1 Reply Last reply Reply Quote 0
                    • A
                      akbar
                      last edited by

                      I will try that out today. I am actually using same DNS servers for both the connections, but gateways for both ISPs are different. If I add a route to the DNS server for WAN2, wouldn't it disturb the original route to WAN1?

                      Actually when I take WAN1 cable out, I can not even ping DNS server through pfSense, which in my opinion should have automatically shifted WAN2.

                      1 Reply Last reply Reply Quote 0
                      • GruensFroeschliG
                        GruensFroeschli
                        last edited by

                        http://forum.pfsense.org/index.php/topic,7001.0.html

                        pfSense itself only uses the routing table definitions.
                        Since the DNS forwarder runs on pfSense, pfSense can not loadbalance the DNS.

                        –> You need to create a static route for at least one DNS-server to the gateway of the second WAN.

                        We do what we must, because we can.

                        Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                        1 Reply Last reply Reply Quote 0
                        • A
                          akbar
                          last edited by

                          Thanks, the settings that you have mentioned do work. But I am now having another problem with my setup.

                          The VIP (ProxARP) that I have defined can not be pinged on the WAN interface. This is the real IP which hosts services, or forwards the ports to LAN machines. I have even lowered the firewall on the WAN but to no success.

                          Another requirement is that the WAN VIP should can also be pinged on the switch to which the WAN is connected. I have a few VoIP gateways connected to the same subnet as that of VIP and use VIP as the default gateway address. But none of the VoIP gateways can ping the VIP of the WAN.

                          Browsing through the forums, I found out that both ProxyARP and Other VIP can not be pinged from the WAN. The CARP VIP can be pinged, but the problem is that CARP VIP can only be defined on the interface which has the same subnet. In my case, the subnet for the virtual IP and the interface IP are different.

                          Is there some other configuration that can be tried which would allow me to have my VIP globally accessible?

                          Thanks,
                          Akbar.

                          1 Reply Last reply Reply Quote 0
                          • GruensFroeschliG
                            GruensFroeschli
                            last edited by

                            Just because you cannot ping it doesnt mean it doesnt work.
                            Why do you need to ping it?

                            The port-forwards from the VIP should still work.

                            We do what we must, because we can.

                            Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                            1 Reply Last reply Reply Quote 0
                            • A
                              akbar
                              last edited by

                              Because the VoIP gateways are using the VIP of the WAN interface as their default gateways. The VoIP gateways are connected to the same switch as that of WAN interface. When I sniff the traffic, I only find broadcast ARP requests from VoIP gateways for the MAC address of the VIP interface, but the VIP interface does not reply back.

                              Unfortunately there is no option of setting a static ARP entry in the VoIP gateway, otherwise I could have tried that.

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.