DHCP and Subnet
-
I am new to pfSense and this forum, so please forgive me for my mistakes.
I have a LAN setup within the 10.1.0.0/16 subnet.
I need to setup my OpenVPN Server so that my clients become an IP in the 10.1.250.0/24 subnet.
But the clients should be able to access the whole 10.1.0.0/16 subnet.Please tell me the correct way wto how to set something like this up.
Sorry for my bad english.
-
10.1.250.0/24 is part of 10.1.0.0/16. So correct routing will be impossible.
Choose a tunnel subnet outside of the LAN. -
use of a /16 pretty much anywhere other than a summary route not good design. You going to have 65k some clients on this network? ;) Use a network that is more size appropriate.. More than likely a /24 is more than enough and easy to spot different network this way.
So if you used 10.1.0/24 then 10.1.250/24 would be a different network and your problem would go away.
-
Okay, I have changed my subnet
Now I have a 172.20.0.0/20 subnet and the VPN Clients get Addresses from 172.20.16.0/24.
The VPN Clients can also access the 172.20.0.0/20 subnet.Can i setup the VPN, so that only the 172.20.0.0/20 and the 172.20.16.0/24 get routes throughthe VPN?
All the other stuff should pass by through the normal internet connection. -
yeah you can setup whatever you want.. If you don't want everything routing down the vpn tunnel then don't set default gateway on your vpn setup and it will only route to networks you setup as local on the vpn server or that you add with specific route commands, etc.
/20 is still pretty freaking large? So you have 4k some nodes on the same layer 2??
-
/20 is still pretty freaking large? So you have 4k some nodes on the same layer 2??
No i have not 4k nodes but i want this:
- Networking Stuff in 172.20.1.0/24
- Hyper-V Hosts in 172.20.2.0/24
- Hyper-V VMs in 172.20.3.0/24
- Other Stuff in etc.
I know i could have chosen a smaller subnet instead of /20, but i like nice round numbers :)
My real problem now:
But VPN Server provides DNS Server with the connection.
Even tho the option in the Server in disabled.
-
- Networking Stuff in 172.20.1.0/24
- Hyper-V Hosts in 172.20.2.0/24
Well that is all in the /20 so you just want large network space to have IPs that look to be in different blocks so you can create rules via /cidr or something and they are not actually in their own network? If you want those networks why would you not put them in their own actual networks so you could firewall between them? Vs just using IP ranges all in the same network?
To test your dns issue I tried to duplicate.. So from my phone connected to my vpn, you can see it hands out my dns server.. I then told it not too and made sure the openvpn service restarted. I then connected in again from phone and you can clearly see dns is not handed out.
