Is this setup possible?
-
Thanks Phil, appreciated!
I want to push the thank you button on your post, but it's not there.
So via this way: thanks! :) -
+1.
Don't make your ranges decimal like 100-150 and 151-200. Make them subnets like 33-62 (/27) and 129-190 (/26).
Maybe a "dumb" question…?
But why use different subnets? -
So you can easily make rules covering each application.
They are not different subnets, just ranges of IP addresses easily-covered using one firewall rule.
-
Ahhh oke.
I must have misunderstood your reply.You just mean (for instance):
192.168.1.1 /26
192.168.1.65 /26
192.168.1.129 /26
192.168.1.193 /26Am I right?
-
Right.
-
You can work around the same upstream gateway problem by leaving 1 or both ADSL modems in routing mode. Give the ADSL modem LAN side some IP/subnet(s):
10.42.1.1/24
10.42.2.1/24
and the pfSense WANs
WAN1 10.42.1.2/24 with gateway 10.42.1.1
WAN2 10.42.2.2/24 with gateway 10.42.2.1Use 2 different monitor IPs out on the real internet, e.g. 8.8.8.8 8.8.4.4, for pfSense to monitor if the series of hops up to the real internet are functional on each WAN.
Then the ADSL modems can make the upstream connection to the ISP.
Downsides:
- Double NAT - pfSense is doing NAT and the ADSL modem does it again.
- If you want to provide externally accessible services (road warrior VPN, web server…) then you have to set up the ADSL modems to port forward all incoming through to the pfSense WAN - but that does work for me where I have had to do it.
- pfSense is not going to know when the front-end ISP-supplied IP address changes. If you need dynamic DNS then you need to install the Cron package and use it to modify the cron job that checks the public IP address so it runs as regularly as you want to respond to a front-end public IP change.
for the bold part.
for most adsl modems if you put the lan ip in dmz settings then the adsl modem forwards all traffic to that lan ip..you can verify it by removing all virtual server / port forwarding entries and then assignging static ip to your system and then assignign it in dmz and then check from itnernet some ports that you can open on your ssytemm.. remember on consumer grade connection certain ports (like 80,25 etc ) are blocked. so try some other ports
-
for most adsl modems if you put the lan ip in dmz settings then the adsl modem forwards all traffic to that lan ip.
Correct - many consumer-grade devices use the term "DMZ" when they are not making a separate protected network at all, the "DMZ" they make is just a port-forward-all to the specified inside IP address.
-
Thanks guys!
-
I have checked with the provider, both use the same (external) gateway address.
Putting the modem IP in the exposed host list (DMZ) is not possible, the Fritzbox won't accept that.If I make the following setup, would that work too?? 8)
Give modem 1 –> 10.42.1.1
Give Modem 2 --> 10.42.2.1Give pfSense WAN port 1 --> 10.42.1.2
Give pfSense WAN port 2 --> 10.42.2.2Put IP 10.42.1.2 (for modem 1) on the exposed host list (DMZ).
Put IP 10.42.2.2 (for modem 2) on the exposed host list (DMZ). -
I have checked with the provider, both use the same (external) gateway address.
Putting the modem IP in the exposed host list (DMZ) is not possible, the Fritzbox won't accept that.If I make the following setup, would that work too?? 8)
Give modem 1 –> 10.42.1.1
Give Modem 2 --> 10.42.2.1Give pfSense WAN port 1 --> 10.42.1.2
Give pfSense WAN port 2 --> 10.42.2.2Put IP 10.42.1.2 (for modem 1) on the exposed host list (DMZ).
Put IP 10.42.2.2 (for modem 2) on the exposed host list (DMZ).yes this sounds good..
you can connect some pc (test machine) to lan of pfsene an open ports from wan to lan (inbound nat on pfsense ) and scan live ip of each modem to see if it is working… -
Ok, thanks. I'll give it a go.
