• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Adding a new block of IPs

Scheduled Pinned Locked Moved HA/CARP/VIPs
7 Posts 3 Posters 2.4k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • D
    dzeanah
    last edited by Apr 6, 2013, 10:44 PM

    Currently my DMZ net is a 10. network, and I use CARP/VIPs to associate the private network addresses with routable IPs.

    I'm running out of IP addresses though, and will need more.  What I'd like to do is keep the current configuration the same, have my bandwidth provider assign me a new block of IPs (probably a completely new netblock with no association with my current IP range), tell pfSense about it by setting up new CARP assignments, and keep on going without any real changes to my network layout.

    Is this possible?

    What's the best way forward?  Worst case I can get an additional network uplink and install a firewall with another port so I can do dual-wan, but I'd rather just have the current WAN handle new netblocks without blinking.

    Thanks.

    1 Reply Last reply Reply Quote 0
    • P
      podilarius
      last edited by Apr 7, 2013, 2:37 AM

      Are you running 2 firewalls in fail over with CARP? If not, you could use proxy arp.

      1 Reply Last reply Reply Quote 0
      • D
        dzeanah
        last edited by Apr 7, 2013, 1:25 PM

        Yep - failover is set up and runs pretty well every time I've used it.

        1 Reply Last reply Reply Quote 0
        • P
          podilarius
          last edited by Apr 7, 2013, 11:21 PM

          adding a second IP block is difficult or not possible. We tried it early on at our DC and eventually had to have the ISP give us a big block and suffer through an IP change. Which was not all that bad. CARP addresses must be all be in the same subnet.

          1 Reply Last reply Reply Quote 0
          • R
            Reiner030
            last edited by Apr 8, 2013, 1:01 PM

            @podilarius:

            adding a second IP block is difficult or not possible. We tried it early on at our DC and eventually had to have the ISP give us a big block and suffer through an IP change. Which was not all that bad. CARP addresses must be all be in the same subnet.

            there is a little trick to get it work  (we make it last year - works good)…

            => set on both firewalls each an IP Alias to the origin network card from

            e.g.

            old IPs:
            10.0.1.1  carp gw
            10.0.1.2  fw1
            10.0.1.3  fw2

            new IPs:
            10.2.0.2  IP ALIAS on fw1
            10.2.0.3  IP ALIAS on fw2
            10.2.0.1  carp gw2 with same network as IP Alias ;)

            Perhaps a problem:
            You can only handle up to 255 CARP IPs on you firewalls in sum. (because of VHID 1..255)

            1 Reply Last reply Reply Quote 0
            • P
              podilarius
              last edited by Apr 8, 2013, 3:07 PM

              Dude .that is an awesome trick. I will keep that in mind and use it. Thanks. Will test it in the lab once I recover from vacation.

              1 Reply Last reply Reply Quote 0
              • D
                dzeanah
                last edited by Apr 8, 2013, 3:11 PM

                Well, shucks.  Now I need to read up on IP Aliasing because I know nothing about it.

                Is it fair to assume that I can use that trick to add a separate block of IP addresses to my firewall as described in the first post?

                If so, then this is awesome – I don't need to either migrate to a big block of IPs I can't currently justify or add new ports to the primary firewall (and replace the secondary) for a second network drop – now I just need to find the time to reread my pfSense manual.  Well, I'll check to see if there's a current manual available...

                1 Reply Last reply Reply Quote 0
                7 out of 7
                • First post
                  7/7
                  Last post
                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                  This community forum collects and processes your personal information.
                  consent.not_received