LAN with multiple subnets
-
If you don't want to have a bunch of routes in pfSense it is up to you to route a supernet to the layer 3 switch and subnet that network to each segment.
Make a small transit network between pfSense and the switch on its own VLAN.
pfSense 172.24.56.1/24
Switch 172.24.56.2/24
Set the default gateway on the switch to 172.24.56.1Supernet: 10.2.0.0/16
Make a gateway (ie SWITCH_GW) for the switch in System > Routing fat 172.24.56.2
Make a static route for 10.1.0.0/16 with a destination of SWITCH_GW
You can then create layer 3 interfaces on each VLAN in the switch for:
10.1.1.0/24
10.1.2.0/24
10.1.3.0/24
10.1.4.0/24
…Automatic NAT is pretty smart but you want to make sure there are outbound NAT rules for the entire 10.1.0.0/16. You will also need to DHCP for your segments in the switch or with helpers to something other than pfSense (Like your DC). It doesn't have the hooks for multi-scope DHCP on one interface.
-
Thanks Derelict,
I forgot to add. All of this is currently working, i have multi-scope DHCP from my AD controllers, the switch has an interface on each VLAN (that is how it routes after all), all of what you are saying is basically how i've got it set up right now. It's just the part where you say "Make a gateway (ie SWITCH_GW)…." that breaks my config. I've had cases where for some reason pfSense tries to use THAT GW as the default gw and breaks all outbound connections. I mean, it's working perfectly right now, but in the last month i had 3 separate occurences of pfSense trying to route back thru the switch, IF there was some way to have the routes loaded WITHOUT defining a gateway the multiwan module wouldn't try to do that, that's what i'm trying to find out.
-
pfSense doesn't do that. You have something wrong. If it's not marked as the default gateway it will not use it as the default gateway.
Post your config. Gateways, Routes, interface configurations.
Post a drawing.
Don't tell us what you think you have done. Show us exactly what you HAVE done.
If you had configured it like that it would be working. Always.
-
It might have something to do with the finicky-ness of the internet links down here, at least one of the times this ocurred i had reconfigured the main switch therefore causing pfSense to mark all gateways as down.
Attached are the VM config, where each WAN has a vlan and it's interface, the interface tab and the route tab.
Network config is:
VMCluster -> bladecenter stacked switch - > main switch (in trunk mode, ESXi deals with untagging the vlans)
WAN1-4 -> main switch (with the ports correctly set as general, untagged and the corresponding vlan id)Like i said, it works. it just so happens that for some reason it suddenly wants to route thru the LANGW. nothing in the logs saying why or how it does that (at least not after a reboot)
-
What is the interface address and subnet mask configured on pfSense LAN?
-
10.222.254.251 /16, in the old non-subnetted range.
-
What else do you have anywhere that starts with 10.222 ?? besides the switch at 10.222.255.254
No idea why you have that on a /16 but it's your network.
-
It's a /16 because i was young and stupid at the time (might be stupid still…) and didn't know anything about networking, vlans, subnets and didn't have hardware that supported it. The separate ranges are for each lab and it's people to be able to configure PXE, BOOTP, DHCP, and all the other multicast stuff they might want without crashing the rest of the network.
The stuff still on the 10.222.0.0/16 are some of the labs that i haven't been able to move to VLANs yet and one of the DCs that is awaiting new licenses for a migration.
-
So everything's working now and the issue is why, as you say, pfSense uses LANGW as the default gateway right?
Did you do something silly like make a failover gateway group with WAN and LANGW as members?
-
No, only the real WAN GWs are included in the gateway groups. i have 3 with different tiers for different needs (adsl for the visitors, cablemodem for users, best one for the servers, etc)
-
Well, pfSense doesn't just arbitrarily route out LAN so I guess I don't know what to tell you.
-
Damm, i hoped i had something misconfigured. Well, i'll try to delve deeper and see if it happens again.
Thanks! -
You might but I have no idea where to tell you to look next. Grep WANGW in /tmp/rules.debug and see if it's somewhere it shouldn't be. Take a good, long look at what's really happening next time it blows up. At least get a copy of Diagnostics > Routes.
