How can I achieve this with my current setup?
-
Hello all ;D
Here is my setup: http://i.imgur.com/IMJ2gM6.png
I have the purple part done, I have the first public IP address (ISP gave me 32 public IPs) assigned to WAN interface, but Windows in the server has no internet connection and I can't ping anything in Pfsense.
WAN: xxx.xxx.xxx.98
Subnet: /27LAN: 192.168.2.1
WLAN: DHCP
You don't need to explain me everything with detail, give me a quick summary and I'll look for documentation.
-
You need to use Virtual IPs to take advantage of the extra IPs you have available. From there you can do 1:1 NAT to assign local private IP systems to a specific public IP. Assuming you want private IPs on the local servers instead of trying to assign public IPs to a machine.
-
I want to use the public ip's and assign them to my computers (20 computers) or am I asking the impossible?
-
No, it's not impossible but they would then basically be "parallel" to pfsense and not "behind" pfsense. In other words, you would lose any protection applied by pfsense and they would really need to be connected to the same switch/VLAN as the WAN side of pfsense. The only way I can see being able to utilize public IPs behind pfsense (or any firewall/router for that matter) is if you had routed IPs and you could assign your /27 to the LAN side (or were doing some form of RIP or BGP or something).
-
wow, you lost me there, where can I read more about "routed ip's", I wasn't really looking for the protection in pfsense, I wanted the traffic shaping in it :P
-
Normally when you get a block of IP addresses from an ISP, the WAN side has a random IP address assigned to it out of their pool. The LAN side gets a routed block of IPs via RIP usually. The difference with conventional ISPs is that the Cable/DSL modem or even T1 router has the WAN address and it's ethernet port is the start of your routed IP addresses (usually taking up one of those IP addresses in the process). I'm not exactly sure what kind of service you have or what provider you have but the fact you've gotten a /27 means you probably aren't on a typical Cable/DSL circuit. To really make it work, you would need a direct Ethernet hand-off from the ISP so that the WAN side of pfsense really was the WAN and not a modem/router in front of pfsense.
-
How do I get direct Ethernet hand-off from the modem? I can access it and change it ;D
-
Post a picture of your line coming in to your house where it goes into the modem and so that people can see the model number of the modem and tell people who your internet company is so maybe someone who knows how they do business can help you. Black out your MAC address.
-
Model is TP-Link TD-8840T. ISP is somewhere at Central America, so i doubt that would help.
Also, if I assign a VLAN to every public IP, do every sites see the public IP for each computer?
-
http://www.tp-link.com/Resources/document/TD-8840T_V4_User_Guide.pdf
Section 4.4.1.6 Bridge
I bet you have to bridge to your ISP's network, but first you would have to bridge the modem to your pfsense WAN.
Then do something like this for each IP assigned.
http://www.youtube.com/watch?v=zrBr0N0WrTY
I'd want pfsense doing all the heavy lifting, not that modem. Just use the modem as modem only.
Thats assuming your ISP isn't doing something goofy.
When you get a /27 handed over, you really should make sure they tell you EXACTLY what method will be used to allocate that.
You need to know at least your IP range, you gateway etc. You will burn up a couple of IPs for the pfsense and the gateway and have 30 left to hand out.(P.S. I see no reason why it can't be done, but how fast can each separate IP get if all 30 of them are being delivered over 1 DSL line?)
rhetorical question…
Downstream: Up to 24Mbps total
Upstream: Up to 3.5Mbps total -
Sadly no, downstream: 8mbps and upstream: 1mbps. Which is why it's important to me the traffic shaping part.
I only have about 20 clients requiring public ips so I can spare 5 ips max.
-
If you bridge it to pfsense WAN so that ONLY pfsense touches the Modem and no other computers then assign your IPs like the video shows and use VLANs and a Nice big VLAN switch, you can do it. I had something very similar when I had to install one for a friend. He had a /30 I think with Verizon FIOS. He lived in an apartment so they wouldn't bring fiber to his door. Instead they brought fiber to the building in a electrical room and then routed DSL from the fiber modem to each room. It would actually have been ALOT better for you had they given you a modem only, and not the combo device.
Then I had to do basically whats in that video. Worked fine on FIOS wanna-be DSL.
-
Sorry, I'm out right now and can't watch the video clearly in mobile. I'll watch once I get back home.
I have an unmanaged gigabit switch, can I use that instead of buying a VLAN switch?
Also by combo device, do you mean a simple router instead of ADSL2+ modem router?
-
No - you will either need 30 LAN ports or a 30 port VLAN switch to deliver 30 separate public IPs to 30 Devices. This is one of those times where I would use a VLAN switch. Its more cost effective than 30 NIC cards… Someone else might have a better answer than that for you.
-
Hmm, this is outside my usual experience but you can traffic shape on a per IP basis rather than per interface. I would think you could achieve this without needing to use VLANs to separate each client. Also you can disable NAT entirely and have your /27 routed to the clients. How that is done is entirely dependent on how your ISP is providing it though. In that situation you still have the ability to control traffic with firewall rules.
Steve
-
So even with NAT disabled, traffic shaping should still be able to function?
-
Yes. The traffic is still routed through the box so shaping can be applied. As can firewall rules.
There's a good example of this in the existing pfSense book if you have it, Section 8.2.Steve
-
Here's what I just did:
Disabled NAT, plug a laptop to the LAN interface (192.168.2.1), the laptop got assigned 192.168.2.103. Did the virtual ip and 1:1 NAT like here: http://www.youtube.com/watch?v=zrBr0N0WrTY
I can access WebGui from laptop to 192.168.2.1. I can ping any IP from Pfsense, but laptop cannot connect to any external sites yet.
-
Can you ping your gateway? Do you have DNS servers assigned in pfsense?
stephenw10 will know more than me about traffic shaping. I don't use it.
I have set it up a few times to test and its straight forward.
Bandwidth flows like water here for my needs.However, I think you will want to make sure you can ping the gateway and get DNS assigned if you have not.
A good place to start is 8.8.8.8 and 8.8.4.4 but you can research DNS options later.system > general setings
-
I can ping xxx.xxx.xxx.98 (pfSense Wan) and 192.168.2.1 (pfSense Lan)
But cannot ping xxx.xxx.xxx.97 (ISP gateway)DNS is set to Google's in Pfsense, also set it to the laptop.
pfSense can ping any external IP.
