Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Routing /24 public subnet to smaller subnets

    Scheduled Pinned Locked Moved Routing and Multi WAN
    19 Posts 3 Posters 3.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DerelictD
      Derelict LAYER 8 Netgate
      last edited by

      A /29 is 6 usable - 1 taken by the pfSense interface.

      100.100.100.150/29 is not on a subnet boundary for a /29.  100.100.100.144 is

      Assign an interface to VLAN tag 2

      Edit the interface, set the IP address of the interface to 100.100.100.145/29

      Customer will use 100.100.100.145 as their default gateway.

      They will have 100.100.100.146 - 100.100.100.150 available

      100.100.100.151 is the broadcast address for the subnet.

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      1 Reply Last reply Reply Quote 0
      • S
        Shiftenterprises
        last edited by

        You have been such a great help!

        I am sorry to ask another question…

        But... how do you know what the boundary  would be?
        is there some type of scale or something? I am pretty new to this type of networking.

        what if i had 100.100.100.3-10 being usable this is real case here special customer needs 3-10.

        1 Reply Last reply Reply Quote 0
        • DerelictD
          Derelict LAYER 8 Netgate
          last edited by

          google subnetting.  You'll need to know this.

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 0
          • H
            heper
            last edited by

            http://www.subnet-calculator.com/cidr.php

            1 Reply Last reply Reply Quote 0
            • S
              Shiftenterprises
              last edited by

              I have, but when i try to use a subnet calculator

              for example http://www.subnet-calculator.com/subnet.php?net_class=C this site

              I just dont understand how i keep going after the first one

              100.100.100.0/24 is assigned to me
              i need to make the first subnet of
              100.100.100.1/29

              IP Address: 100.100.100.1
              Netmask: 255.255.255.240
              CIDR Notation: /28
              Network Address: 100.100.100.0
              Usable Host Range: 100.100.100.1 - 100.100.100.14
              Broadcast Address: 100.100.100.15
              Total number of hosts: 16
              Number of usable hosts: 14

              when i create the next interface i just use .16 next correct? and then make a cidr from that IP?

              1 Reply Last reply Reply Quote 0
              • H
                heper
                last edited by

                doesn't matter what you pick, you don't have to think about it …. that calculator will correct it anyways.

                btw you say you need a /29 yet your calculator is set to a /28 (thats double the address')

                1 Reply Last reply Reply Quote 0
                • H
                  heper
                  last edited by

                  subnetID-100.100.100.0/29 = iprange: 100.100.100.1-100.100.100.6

                  subnetID-100.100.100.8/29 = iprange: 100.100.100.9-100.100.100.14

                  subnetID-100.100.100.16/29 = iprange: 100.100.100.17-100.100.100.22

                  …...

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    Yes.  You are going to need to understand subnetting to do this job.

                    It's not complicated but it's also easy to screw it up.

                    Network address
                    Some number of host addresses
                    Broadcast address
                    Network address
                    Some number of host addresses
                    Broadcast address

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • S
                      Shiftenterprises
                      last edited by

                      Okay so i am trying to create a lab test before i put this into production.

                      Here is what i have done so far.
                      I have 1 pfsense router with 2 NIC's ( same setup as my production )
                      1wan 1lan
                      wan has static address 10.0.0.49/24 ( was the next ip i had open on my lab router )
                      lan has default pfsense 192.168.1.1

                      i have disabled packet filtering
                      enabled bypass firewall rules for traffic on the same interface.
                      –---------
                      i have a VM on the local "lan"
                      host needs to have a 10.0.0.x address with 1 usable IP.
                      so going off of how to subnet
                      i would need 10.0.0.52/30
                      Network Address: 10.0.0.52
                      Usable Host Range: 10.0.0.53 - 10.0.0.54
                      Broadcast Address: 10.0.0.55
                      Netmask: 255.255.255.252

                      from what everyone is saying i would need the 10.0.0.53 to be the interface IP and the .54 would be for the host.

                      I understand this part, now what steps do i need to take to make this work in my lab?

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        @Shiftenterprises:

                        Okay so i am trying to create a lab test before i put this into production.

                        Here is what i have done so far.
                        I have 1 pfsense router with 2 NIC's ( same setup as my production )
                        1wan 1lan
                        wan has static address 10.0.0.49/24 ( was the next ip i had open on my lab router )
                        lan has default pfsense 192.168.1.1

                        i have disabled packet filtering

                        Why?

                        enabled bypass firewall rules for traffic on the same interface.

                        Why?

                        –---------
                        i have a VM on the local "lan"
                        host needs to have a 10.0.0.x address with 1 usable IP.
                        so going off of how to subnet
                        i would need 10.0.0.52/30
                        Network Address: 10.0.0.52
                        Usable Host Range: 10.0.0.53 - 10.0.0.54
                        Broadcast Address: 10.0.0.55
                        Netmask: 255.255.255.252

                        from what everyone is saying i would need the 10.0.0.53 to be the interface IP and the .54 would be for the host.

                        I understand this part, now what steps do i need to take to make this work in my lab?

                        No.  The routed subnet needs to be OUTSIDE of the interface subnet.

                        What part of "you will need to understand subnetting to do this job" is unclear?

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • S
                          Shiftenterprises
                          last edited by

                          I dont PF sense to do any firewall or SPI/DPI is it only for routing the subnets and creating vlans for privacy.

                          What settings do i need to enable/disable for that to work?

                          1 Reply Last reply Reply Quote 0
                          • H
                            heper
                            last edited by

                            What settings do i need to enable/disable for that to work?

                            nothing.
                            you need a /30 on your WAN
                            and you can then just add your routed subnet spread out over your other vlans, trunked on your LAN interface

                            1 Reply Last reply Reply Quote 0
                            • S
                              Shiftenterprises
                              last edited by

                              Okay. I understand.

                              I just wish i could get this to work in the lab before i just pull my uplink and start doing this 100% ( not that i think you are wrong )

                              Do you know of a way to do this in a lab?

                              i have a lab router on a 100/20 connection dhcp is enabled and the router ip is 10.0.0.1 2-254 is dhcp.

                              1 Reply Last reply Reply Quote 0
                              • DerelictD
                                Derelict LAYER 8 Netgate
                                last edited by

                                Yes.  Assign a /30 to the WAN, route a /24 to it, and dole out smaller subnets from a /24 on your various LAN interfaces/VLANs/whatever.

                                Chattanooga, Tennessee, USA
                                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.