How to configure pfSense as a router for two internal LAN subnets?
-
Floating rules are above, none configured. Sorry yeah should have mentioned Hyper-V but it really shouldn't factor.
On machine 10.0.1.1 I can ping pfSense interface 10.0.0.4 fine.
On machine 10.0.1.1 I cannot ping physical machine (my desktop) 10.0.0.3 (Request timed out).
On machine 10.0.0.3 I cannot ping pfSense interface 10.0.1.4 (Request timed out).Odd.
Here's my Hyper-V switches in case it's relevant:
-
Getting strange.
I have a VM on the Hyper-V host called neon.localdomain with IP 10.0.0.10.
I can ping that from machine 10.0.1.1, but machine 10.0.1.1 cannot ping the Hyper-V host interface 10.0.0.9 or my desktop 10.0.0.3.
-
On machine 10.0.0.3 I cannot ping pfSense interface 10.0.1.4 (Request timed out).
Well that is going to be a problem.. What is the config of this machine, what is its gateway what is its mask.. Does it have any routes on it, vpn client? Do a simple traceroute from it to the 10.1.1.4 IP..
Hyper-V should not be a problem no - but there are some gotcha's with such a setup..
-
Here are the settings for machine 10.0.0.3. I do have Private Internet Access VPN client installed but it's not running. I also have the Hyper-V service on this machine but not currently using it. It is joined to domain duck.loc where machine 10.0.1.1 is the domain controller so quite important it can connect to it! :)
The default gateway is my Netgate device to go to the internet (10.0.0.1)
Here's the tracert
-
And look at the gateway… its 10.0.0.1 not 10.0.0.4 which is what you have pfsense lan IP set to..
How do you expect to get to the 10.0.1 network on pfsense if you point it towards your internet router?
Let me refer back to my first post ;) "did you set gateway on the machines correctly"
If your going to want to use a different gateway to get to the 10.0.1 network then you will need to put a host route on that machine that says hey you want to get to 10.0.1.0/24 use 10.0.0.4
-
A-ha!! :)
I added the second gateway into my machine and I can now ping 10.0.1.4 from 10.0.0.3. Feel like we're making some progress!
However, I can't ping 10.0.1.1 from 10.0.0.3…
What is odd is that I can ping the 10.0.1.1 machine from the LAN interface on pfSense:
-
You converted your WAN to LAB interface?
You have to disable all outbound NAT.
-
NO that is NOT the correct way to do it!!! Create a route to use not a default gateway - arrrgghhh..
-
You converted your WAN to LAB interface?
You have to disable all outbound NAT.
No I converted LAN to LAB interface and converted WAN to LAN interface. Here are my NAT outbound rules:
-
NO that is NOT the correct way to do it!!! Create a route to use not a default gateway - arrrgghhh..
OK, ok! :)
I've done this now and all good from 10.0.0.3 to 10.0.1.1!
I can also now ping from 10.0.1.1 to 10.0.0.3!!
I do however, have one small issue. I can't ping the netgate router (10.0.0.1) from my LAB network. Any ideas on why?
-
Hi everyone, thanks for reading, I still have an issue where no servers on the LAB domain can access the internet. I can't ping the LAN interface of my Netgate WAN router from the LAB network, but I can ping it from the LAN network. Any ideas?
-
Draw a picture of how you have this set up and talk about your ultimate goals.
-
Draw a picture of how you have this set up and talk about your ultimate goals.
OK. :)
Here's the network diagram.
I want pfSense on beryllium to allow traffic both ways between LAN and LAB networks unhindered. It seems that machines in LAB network can't reach some machines in LAN, but machines in LAN can reach all machines in LAB. Here are the results from a machine on each network.
On cowslip.duck.loc
Cannot ping 10.0.0.1, 10.0.0.8 (timed out)
Can ping 10.0.0.10, 10.0.0.4, 10.0.0.3, 10.0.0.9, 10.0.1.1, 10.0.1.4On lithium.duck.loc
Can ping everywhere fineHere are the firewall rules on beryllium.localdomain
-
All working now, I needed a static route to the LAB network on the SG-1000 router. Thanks for looking everyone!!
-
"I needed a static route to the LAB network on the SG-1000 router."
If your network is how you drew it you have asymmetrical setup.. If you want to use use your sg1000 router to get to the internet it should be on a transit network to your downstream router.. You shouldn't be using 10.0.0 as your transit or your going to have to put host routes on all boxes on that network..
-
Hmmm…
My SG-1000 only has two interfaces, so how would this work in practise? Would I have to create a VLAN for the transit network?
-
Using VLANs for that is fine but you must have a VLAN capable switch that can demux the tagged trunk traffic to selected switch ports.
-
@mewsense said in How to configure pfSense as a router for two internal LAN subnets?:
All working now, I needed a static route to the LAB network on the SG-1000 router. Thanks for looking everyone!!
May you please do elaborate on this solution?
Thank you
-
If you have a downstream (internal) router with other subnets behind it pfSense needs static route to those so it knows where to route traffic.
https://docs.netgate.com/pfsense/en/latest/routing/static.html#example-static-route
