Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Wan and Lan on same IP range for test lab

    Scheduled Pinned Locked Moved NAT
    25 Posts 8 Posters 2.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M Offline
      mattie01
      last edited by

      Would it be something I could do, if I could setup an additional range of ip addresses on my normal network to be something like 172.16.240.x  as well as 172.16.0.x and then have the 172.16.240.x address assigned as the outside gateway of the virtual pfsense, then use the 172.16.0.1 as the inside interface of the pfsense?

      1 Reply Last reply Reply Quote 0
      • JKnottJ Offline
        JKnott
        last edited by

        @mattie01:

        Would it be something I could do, if I could setup an additional range of ip addresses on my normal network to be something like 172.16.240.x  as well as 172.16.0.x and then have the 172.16.240.x address assigned as the outside gateway of the virtual pfsense, then use the 172.16.0.1 as the inside interface of the pfsense?

        You cannot have 176.16.240.x on both interfaces.  They must be different.  You could have 172.16.240.x on the WAN and 172.16.0.x on the LAN.

        Once again, you cannot have the same address range on both sides of a router.

        PfSense running on Qotom mini PC
        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
        UniFi AC-Lite access point

        I haven't lost my mind. It's around here...somewhere...

        1 Reply Last reply Reply Quote 0
        • johnpozJ Offline
          johnpoz LAYER 8 Global Moderator
          last edited by

          /16 Why??  That would be the first thing I would freaking fix on some network I took over..

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 25.07.1 | Lab VMs 2.8, 25.07.1

          1 Reply Last reply Reply Quote 0
          • ? This user is from outside of this forum
            Guest
            last edited by

            So I have just taken over a bit of network infrastructure (a couple of servers and such) that needs a bit of TLC

            I would start off by studying how networks operate first. Trying to put both LAN and WAN on the same address range shows a basic lack of understanding.

            Frightening…

            1 Reply Last reply Reply Quote 0
            • johnpozJ Offline
              johnpoz LAYER 8 Global Moderator
              last edited by

              heheh marjohn56… I wanted to say the same thing.. But trying to be nicer and less blunt.. But that did get you a applaud from me.. And made me smile. thanks!

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 25.07.1 | Lab VMs 2.8, 25.07.1

              1 Reply Last reply Reply Quote 0
              • ? This user is from outside of this forum
                Guest
                last edited by

                Yes, I miss the Doc…. Occasionally it needs to be said the way it is.

                1 Reply Last reply Reply Quote 0
                • jahonixJ Offline
                  jahonix
                  last edited by

                  Only very few don't and I'm not one of them.

                  1 Reply Last reply Reply Quote 0
                  • jahonixJ Offline
                    jahonix
                    last edited by

                    @JKnott:

                    You could have 172.16.240.x on the WAN and 172.16.0.x on the LAN.

                    No, he cannot!
                    His network is defined as 172.16.0.0 /16. They would still be on the same broadcast domain unless he'd change the network size to something smaller and not overlapping.

                    1 Reply Last reply Reply Quote 0
                    • JKnottJ Offline
                      JKnott
                      last edited by

                      @jahonix:

                      @JKnott:

                      You could have 172.16.240.x on the WAN and 172.16.0.x on the LAN.

                      No, he cannot!
                      His network is defined as 172.16.0.0 /16. They would still be on the same broadcast domain unless he'd change the network size to something smaller and not overlapping.

                      I believe that /16 came from the part where he was talking about 172.16.x.x, implying a /16.  I referred to 172.16.0.x and 172.16.240.x, both of which imply /24 and would work fine.

                      PfSense running on Qotom mini PC
                      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                      UniFi AC-Lite access point

                      I haven't lost my mind. It's around here...somewhere...

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ Offline
                        johnpoz LAYER 8 Global Moderator
                        last edited by

                        yeah are on the same /16 he stated he was running 172.16 rfc1918 is not a /16 its a /12..

                        This one post wonder prob won't be back, or if he is it will be months later… etc..  So we may never know what he what he has as a mess..

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 25.07.1 | Lab VMs 2.8, 25.07.1

                        1 Reply Last reply Reply Quote 0
                        • JKnottJ Offline
                          JKnott
                          last edited by

                          ^^^^
                          Maybe he discovered he has a thing or two to learn about networking.  ;)

                          PfSense running on Qotom mini PC
                          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                          UniFi AC-Lite access point

                          I haven't lost my mind. It's around here...somewhere...

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ Offline
                            johnpoz LAYER 8 Global Moderator
                            last edited by

                            3 or 4 or more like 10k things ;) hehehe

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 25.07.1 | Lab VMs 2.8, 25.07.1

                            1 Reply Last reply Reply Quote 0
                            • ? This user is from outside of this forum
                              Guest
                              last edited by

                              What concerned me was the initial comment about 'taking over a bit of network infrastructure'. Surely to be in that position it is assumed that you know the basic principles at least.

                              In saying that, I think there are few working for IT departments I come into contact with who could well do with a refresher course.

                              1 Reply Last reply Reply Quote 0
                              • KOMK Offline
                                KOM
                                last edited by

                                Perhaps you guys could help him out without the non-stop mockery and asshatism?  It's crap like this that gets a forum and product a bad name.  It really isn't that hard to help people without the goal of making them look stupid and making sure they realize it.  I normally wouldn't have said anything but you appear to be wallowing in this guy's lack of knowledge.

                                As for dok, he was a perfect example of weaponized autism.  He was very good at networking, and a total failure at relating to and interacting with people.  I won't miss him for a nanosecond, no matter how smart he was.

                                1 Reply Last reply Reply Quote 0
                                • DerelictD Offline
                                  Derelict LAYER 8 Netgate
                                  last edited by

                                  @marjohn56:

                                  What concerned me was the initial comment about 'taking over a bit of network infrastructure'. Surely to be in that position it is assumed that you know the basic principles at least.

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • KOMK Offline
                                    KOM
                                    last edited by

                                    Instead of silently smiting me like a coward, perhaps you could use your big-boy voice and explain why I'm wrong?

                                    1 Reply Last reply Reply Quote 0
                                    • ivorI Offline
                                      ivor
                                      last edited by

                                      @KOM:

                                      As for dok, he was a perfect example of weaponized autism.  He was very good at networking, and a total failure at relating to and interacting with people.  I won't miss him for a nanosecond, no matter how smart he was.

                                      Funny and true.

                                      @KOM:

                                      Instead of silently smiting me like a coward, perhaps you could use your big-boy voice and explain why I'm wrong?

                                      Everyone should chill. Let's all be nice to each other.

                                      Need help fast? Our support is available 24/7 https://www.netgate.com/support/

                                      1 Reply Last reply Reply Quote 0
                                      • JKnottJ Offline
                                        JKnott
                                        last edited by

                                        @KOM:

                                        Instead of silently smiting me like a coward, perhaps you could use your big-boy voice and explain why I'm wrong?

                                        Well let's start with:

                                        So I have just taken over a bit of network infrastructure (a couple of servers and such) that needs a bit of TLC and I want to setup a test lab that is an exact replica of a production environment on vsphere, using pfsense as a virtual router to block all network traffic between the two but allowing access to http and https so I can pull in  windows and linux server updates for testing before deploying to production.

                                        When I see something like that, I would expect the person to have at least some understanding of networks.  I then mention a couple of times that you can't have the same addresses on the LAN and WAN sides of a router.  Others said similar.  However the reason for that is the way routers work.  They maintain a list of which was to connect to a given address range.  For home or small office networks, it normally only has to deal with the local network and the default gateway.  Regardless, it still has to know which direction, based on the network address.  So, if he has 172.16.0.0/16 on the WAN side and again on the LAN side, how does the router know which is the proper direction?  The only exception would be where the masks are a different length, because routers rely on longest match.  So, in this case, it might be possible to have 172.16.0.0 /16 on one side and 172.16.x.0 /24 on the other.  In this situation, it says everything 172.16.0.0 /16 on one port, except 172.16.x.0 /24 which is on the other.  This works only because the net mask allows the router to make the distinction.  This also means that any address in the /24 network cannot be on the /16 side.

                                        Bottom line, he can't have the same address ranges on both sides of the router.

                                        PfSense running on Qotom mini PC
                                        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                        UniFi AC-Lite access point

                                        I haven't lost my mind. It's around here...somewhere...

                                        1 Reply Last reply Reply Quote 0
                                        • DerelictD Offline
                                          Derelict LAYER 8 Netgate
                                          last edited by

                                          The only exception would be where the masks are a different length, because routers rely on longest match.  So, in this case, it might be possible to have 172.16.0.0 /16 on one side and 172.16.x.0 /24 on the other.  In this situation, it says everything 172.16.0.0 /16 on one port, except 172.16.x.0 /24 which is on the other.  This works only because the net mask allows the router to make the distinction.  This also means that any address in the /24 network cannot be on the /16 side.

                                          And the subnets would not be able to talk to each other without specific host routes because anything on 172.16.0.0/16 would think 172.16.x.0/24 was same-subnet traffic and would not send it to the router.

                                          Chattanooga, Tennessee, USA
                                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                          1 Reply Last reply Reply Quote 0
                                          • KOMK Offline
                                            KOM
                                            last edited by

                                            Bottom line, he can't have the same address ranges on both sides of the router.

                                            So he deserves endless mockery & grief because he's new at networking and got something basic wrong?  That's what I'm talking about here.  The need to rub someone's face in their mistake and taking pleasure in shaming them by pointing out what a noob they are and how little they know.  What is the point of that behaviour?  I see it on tech forums all the time.  It's petty and counter-productive to growing a community.

                                            And if anyone was about to roll out the Snowflake label, I can roll with the punches myself.  This guy was brand-new and was asking his first question, and he gets jumped on.  I'm not the least bit surprised that he hasn't responded back.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.