Multi physical interface with same subnet

JKnott

where did he say he was using same address on both sides?

In the first post.

I have a configuration with 2 lan on 2 physical interfaces because my 2 lan have the same subnet and machines on LAN 1 and LAN 2 can have the same IP address.

johnpoz

Agreed he can not do that with 1 pfsense. But he can do it with two - the picture he posted..

As long as the common wan network is different than 192.168.10 then he can attach multiple 192.168.10 devices to this common network via different nat boxes.. See attached example

2samenetworks.png_thumb

jaf

So it seems I have my answer of my question asked on the first post.
It's impossible with 1 pfsense, I need 2.
Thanks.

johnpoz

I said you could do it back n post #3
https://forum.pfsense.org/index.php?topic=144526.msg786761#msg786761

But you would need multiple nat boxes to do it.

JKnott

@johnpoz:

Agreed he can not do that with 1 pfsense. But he can do it with two - the picture he posted..

As long as the common wan network is different than 192.168.10 then he can attach multiple 192.168.10 devices to this common network via different nat boxes.. See attached example

Will the computer on the left ever have to communicate with the one on the right? Depending on what else is on the network, there could be some real FUN with port forwarding. Regardless, it seems like a lot of trouble to avoid changing an IP address.

jaf

@JKnott:

Will the computer on the left ever have to communicate with the one on the right?

No I say that on this post : https://forum.pfsense.org/index.php?topic=144526.msg786831#msg786831
@johnpoz:

I said you could do it back n post #3
https://forum.pfsense.org/index.php?topic=144526.msg786761#msg786761

But you would need multiple nat boxes to do it.

My initial question was to know if it's possible with only 1 pfsense.
I didn't know if this "strange case" can be solve by 1 pfsense, it seems it's too strange to be implemented. :-\

johnpoz

You can not use 1 pfsense and have interfaces on the same network, and also have devices on this network having the same IP..

Now if the IPs were different and you just needed to leverage connections to pfsense that could be done via bridge the ports..

So if your machines/devices had IPs say 192.168.10.1 and 192.168.10.2 then you could bridge 2 interfaces on pfsense and that would work. But in such a case its easier to just use a switch if you need multiple connections, etc. ;)

kpa

It's all down to routing. Imagine if you had the same subnet, for example 192.168.1.0/24, on two different interfaces. The routing table would have two entries for the same subnet like:


Destination     Gateway
192.168.1.0/24	link#1 ....
192.168.1.0/24	link#2 ....

If the system would be now asked to forward a packet to host 192.168.1.100 that is on the first (link#1) network, would it be able to decide which link (interface) to use? The answer is an absolute no because both entries in the routing table are equally wide (/24) so there is no way to decide which link to use.

johnpoz

In such a scenario it "could" (in theory) be possible if the routing device also looked in its arp table and said own 192.168.1.100 is connected to link2.. But where you for sure have a problem is in his scenario both devices have the same IP… So there are 2 192.168.1.100..

His proposed setup is borked for sure.. The correct solution would be to change 1 of the segments to a different L3 scheme. Or if you want single L2 to make sure devices all have different IPs in the L3 addressing your using on that L2

JKnott

@kpa:

It's all down to routing. Imagine if you had the same subnet, for example 192.168.1.0/24, on two different interfaces. The routing table would have two entries for the same subnet like:
Destination     Gateway
192.168.1.0/24	link#1 ....
192.168.1.0/24	link#2 ....
If the system would be now asked to forward a packet to host 192.168.1.100 that is on the first (link#1) network, would it be able to decide which link (interface) to use? The answer is an absolute no because both entries in the routing table are equally wide (/24) so there is no way to decide which link to use.

The only possible solution would still require at least a different IP address. Then there could be a specific route to the device and then the routing longest path match would work. The device would also need to be configured with a suitable subnet mask, so that it knew other devices in the same network were elsewhere. Even then it's still a messy solution to a problem that could be avoided entirely by changing the address to a different subnet.

Derelict

or a metric, etc.

jahonix

@jaf:

if it's possible with only 1 pfsense.

Definitely no.

@jaf:

…it seems it's too strange to be implemented.

It's technically not possible to do something like that with one device.

Imagine putting two green apples on one table. Now tell your customer to "grab the green apple".
He just doesn't know which one.
Same for an IP packet. It just doesn't know if it should take the left or the right route to one of two devices with the exact same address. Routing doesn't work this way.

jaf

@jahonix:

@jaf:

if it's possible with only 1 pfsense.

Definitely no.

@jaf:

…it seems it's too strange to be implemented.

It's technically not possible to do something like that with one device.

Imagine putting two green apples on one table. Now tell your customer to "grab the green apple".
He just doesn't know which one.
Same for an IP packet. It just doesn't know if it should take the left or the right route to one of two devices with the exact same address. Routing doesn't work this way.

Well, if it's possible to do it on 2 devices, maybe it's possible to virtualize it on 1, no?
But I agree you must have at least 2 IP address on the wan (like you have with 2 devices) to make the difference for the 2 green apples.
But anyway, it's to uncommon to implement something like that all in once, so I can use 2 (in reality for my project more than 2).

Derelict

Of course you could virtualize two pfSenses on one physical to do the same job as two physicals.

jaf

@Derelict:

Of course you could virtualize two pfSenses on one physical to do the same job as two physicals.

I wanted to say, making one VM that you call "pfsenseMulti", containing an implementation of pfsense containing all that in once, with a smart HMI like pfsense :)

jahonix

@jahonix:

It's technically not possible to do something like that with one device.

@jaf:

… it's to uncommon to implement something like that all in once...

@jaf:

…implementation of pfsense containing all that in once...

Just out of sheer curiosity: you cannot understand or you don't want to believe that technically this is not possible?

jaf

I think the problem is that my English is not so good, and my explanation not clear. :(
Or maybe I'm an idiot? I hope not.

And yes, I don't understand how it can be technically impossible to develop a VM integrating the 2 devices solution, and developing a special HMI to control all that. After, you call this VM "pfsenseMulti".

johnpoz

Huh?
You can for sure have a VM host box and put as many Pfsense VMS on it as you your host can support from memory and horse power..

The point is you can not have the same IP on the same network and expect it to work.. How you put them on different networks is up to you.. Be it virtual routers or physical ones.

jaf

@johnpoz:

The point is you can not have the same IP on the same network and expect it to work..

Where did I say this can works???
Sorry again if my explanations was not clear…

johnpoz

You didn't - just pointing out this fact so everyone is clear ;) How you create the different networks is up to you.