How can I achieve this with my current setup?
-
Hmm, this is outside my usual experience but you can traffic shape on a per IP basis rather than per interface. I would think you could achieve this without needing to use VLANs to separate each client. Also you can disable NAT entirely and have your /27 routed to the clients. How that is done is entirely dependent on how your ISP is providing it though. In that situation you still have the ability to control traffic with firewall rules.
Steve
-
So even with NAT disabled, traffic shaping should still be able to function?
-
Yes. The traffic is still routed through the box so shaping can be applied. As can firewall rules.
There's a good example of this in the existing pfSense book if you have it, Section 8.2.Steve
-
Here's what I just did:
Disabled NAT, plug a laptop to the LAN interface (192.168.2.1), the laptop got assigned 192.168.2.103. Did the virtual ip and 1:1 NAT like here: http://www.youtube.com/watch?v=zrBr0N0WrTY
I can access WebGui from laptop to 192.168.2.1. I can ping any IP from Pfsense, but laptop cannot connect to any external sites yet.
-
Can you ping your gateway? Do you have DNS servers assigned in pfsense?
stephenw10 will know more than me about traffic shaping. I don't use it.
I have set it up a few times to test and its straight forward.
Bandwidth flows like water here for my needs.However, I think you will want to make sure you can ping the gateway and get DNS assigned if you have not.
A good place to start is 8.8.8.8 and 8.8.4.4 but you can research DNS options later.system > general setings
-
I can ping xxx.xxx.xxx.98 (pfSense Wan) and 192.168.2.1 (pfSense Lan)
But cannot ping xxx.xxx.xxx.97 (ISP gateway)DNS is set to Google's in Pfsense, also set it to the laptop.
pfSense can ping any external IP.
-
haha - Well you can ping your internal network. Thats a plus. Could be worse I guess.
Can you post screen shots of the setting you have entered? -
I think I got confused.
stephenw10 said I could do it without VLAN, but I did what the guy in the video did, which I think you told me it requires a managed switch.
-
Well - Perhaps me and stephen10 have differing ideas of what you define as a "client"
I'm defining a client as a bunch of separate IP cameras and local computers in your immediate vacinity.
In which case I'm thinking, perhaps wrongly so, that I'll need a vlan switch to get public IPs to all those devices.Perhaps he is thinking of client as clients…. As in people you are supplying IPs to for $$$
Or he could know something I don't. A better way. -
You should be able to do this either way. I have to confess I have only done this experimentally so I'm a little unsure on the detail.
Using virtual IPs and 1:1 NAT will probably be easier to setup. You have to leave NAT enabled for that to work though, that's probably why you can't ping the gateway (or aren't seeing the ping responses from the gateway).Steve
-
I think this is a "Too many cooks in the kitchen thing" like you said before stephen10.
I'll shut up a while so directions for 2 differing recipes don't get mixed into one. -
I just enabled NAT back, but laptop can't ping any external sites.
Here's album:
http://imgur.com/a/PJCsF
External IP(/27) and Virtual IP are the same.
-
Ok.
In the first page you said you wanted the public IPs actually assigned to the internal machines but here you are trying to 1:1 NAT to private IPs. You should be able to either but decide which way you need to go. 1:1 NAT is going to be easier to setup, a bit tedious but with only 20 clients do-able. However some software insists on having a public IP and won't run behind 1:1 NAT.Steve
-
Ok, sorry!
With NAT, internet connection works, but the laptop is using xxx.xxx.xxx.98 as public IP (pfSense WAN IP).
Well, I can go either way, as long the outbound connection uses a different IP for every computer. My current setup with my clients are using a public IP for each, but different ISP (different IP's), so I guess maybe we should try this way?
-
wow ok, whatismyip.org just reported my IP as xxx.xxx.xxx.99 ??? I'm going to try now with a simple 5 port switch with another computer. Let me report back, thanks.
-
Your virtual IP should be /32 (a single IP) since you have 1:1 NATed it to a single internal IP. Setup 20 VIPs, one for each internal device.
It may be possible to do the entire /27 range, though I've never done that and there would be a conflict with the WAN address.Steve
-
;D http://i.imgur.com/pV1T3wv.jpg
Now to the other issue, I don't have internet connection nor I can access WebGUI in host machine (where VM is running), but LAN interface is getting an IP from DHCP from pfSense VM.
-
Hmm, I think we'll need some more details there. What is the host OS? What virtualisation software are you using? How many NICS?
Steve
-
"I don't have internet connection nor I can access WebGUI in host machine (where VM is running)" :o :'( :D
'Thats the first time "VM" has come up… -
haha, sorry for abusing you :D
I'll read it into it more and see if I can figure it out. For now pfSense in the VM is working properly. Will report anyway. Thanks.
