Subnet 192.168.0.0/20(DHCP 192.168.0.x has internet but Static 192.168.1.x dont)
-
I got it. 192.168.0.0 is a CLASS C IP address, by default allowing no more than 256 hosts. If more hosts are desired you should use class B of 172.16.0.0, or class A of 10.0.0.0.
Myself I have always used 10.0.0.0 because my old employer did that and ten-zero-zero-zero is so much easier to remember. I remember the time I ran out of IP at /24 and all I did was to tell the users to shut down their PCs before going home, that evening all I did was to change the DHCP from /24 to /23, next day when user turned on their machines BAM. Easy-peasy.
Sorry, but you didn't quite get it. I am already using the range 192.168.0.0/20 for all the devices in home and home office. However for the separation for my concerns, I have set the pfsense DHCP server to give out IPs between 192.168.0.100-192.168.0.200
The rest of the range I want to be able to use myself by setting static IPs. Especially for VMs, etc.
I am using single router, single interface and single subnet for this LAN. So all these devices in home and home office are able to connect to each other without a problem. However, the issue is that any of the IP range other than 192.168.0.X is not able to ping pfsense or connect to the internet.
I am already using the range 192.168.0.0/20 for all the devices in home and home office. However for the separation for my concerns, I have set the pfsense DHCP server to give out IPs between 192.168.0.100-192.168.0.200
The rest of the range I want to be able to use myself by setting static IPs. Especially for VMs, etc.
I am using single router, single interface and single subnet for this LAN. So all these devices in home and home office are able to connect to each other without a problem. However, the issue is that any of the IP range other than 192.168.0.X is not able to ping pfsense or connect to the internet.
-
To separate concerns and enable easy setup I started using range 192.168.0.1/20 on LAN of pfsense (netmask 255.255.240.0 - 4000+ devices)
?? what concerns ?whats more easy? using a /24 you should have more then enough ip's available if you only have 50 devices + 20 VM's …
it appears absolutely pointless to use a /20.so basically you can ping devices in the same subnet, but you can't ping pfsense ?
have you rebooted after changing the cidr range ? (perhaps an alias didn't update )
try checking the lan-firewall rules. (try setting src to any instead of lan_subnet) -
192.168.0.1/20 (pfsense) | Single LAN<=> 10G Switch <=>Gig Switch<=>Home (192.168.0.100-192.168.0.100/20) (can access lan/192.168.1.x/pfsense/internet)
||
===>>Home Office (I use a range of 192.168.1.100-192.168.1.200/20) (able to access lan/ 192.168.0.x) No Pfsense/internetI am not using /24 anywhere. All my devices are on /20 subnet. That is why I am confused as to why devices from 192.168.0.x/20 are able to access pfsense/internet But, as soon as I change the IP to any other range such as 192.168.1.x/20, pfsense and internet don't work, yet I have access to the other local devices 192.168.0.0/20
HOME DEVICES + HOME OFFICE share the same SWITCH. THE Switch is connected to a SINGLE NIC (LAN port of pfSense)
I AM NOT ASSIGNING TWO SEPARATE SUBNETS. I WANT TO BE ABLE TO USE 192.168.0.0/20 for managing all the devices in my home through single LAN interface.
I JUST WANT THE DHCP TO ASSIGN 192.168.0.100-192.168.0.100 for DHCP devices
ALL THE OTHER RANGES I WANT TO BE ABLE TO SET MYSELF. -
It should work as you have it configured.
Since it isn't working something is probably not configured as you think it is. A bad subnet mask somewhere maybe. Or a firewall rule set to /24.
Run a packet capture on LAN when you are trying to ping it from something that's failing; are the pings arriving? Check the firewall logs.
Steve
-
Your subnets are overlapping. 192.168.0.0 /20 runs from 192.168.0.0 to 192.168.15.255, which completely overlaps 192.168.1.0 /24. Also, if you are in fact using 192.168.1.0 /20 at home, that is the exact same address space as 192.168.0.0 /20, as the least significant 4 bits of the 3rd octet are masked out to the same value for both ranges. Since you can't have overlapping networks, it will fail, as you're experiencing.
I am a little confused about the overlap. There are no other DHCP servers or routers I am using.
192.168.0.1/20 (pfsense) <<–>>Home (192.168.0.100-192.168.0.100/20) (able to access lan/ 192.168.1.x/ pfsense / internet)
|
--->>Home Office (I use a range of 192.168.1.100-192.168.1.200/20) (able to access lan/ 192.168.0.x) No Pfsense/internetI am not using /24 anywhere. All my devices are on /20 subnet. That is why I am confused as to why devices from 192.168.0.x/20 are able to access pfsense/internet But, as soon as I change the IP to any other range such as 192.168.1.x/20, pfsense and internet don't work, yet I have access to the other local devices on 192.168.0.0/20
Sorry, I was thinking you had 2 networks.
Regardless, the normal practice is to create a subnet large enough for all your devices. I would think a /24 would suffice though.
Based on your description, it sounds as though you don't have pfSense configured correctly for the larger network. On the LAN page, check the prefix selected on the IPv4 address and make sure it's /20
-
I got it. 192.168.0.0 is a CLASS C IP address, by default allowing no more than 256 hosts. If more hosts are desired you should use class B of 172.16.0.0, or class A of 10.0.0.0.
Address classes have been obsolete for many years. These days we use classless addresses with variable length subnet masks.
-
It should work as you have it configured.
Since it isn't working something is probably not configured as you think it is. A bad subnet mask somewhere maybe. Or a firewall rule set to /24.
Run a packet capture on LAN when you are trying to ping it from something that's failing; are the pings arriving? Check the firewall logs.
Steve
I know, I have enabled the firewall rule in System -> Advanced "Bypass firewall rules for traffic on the same interface"
Additionally, none of the firewall rules use /20 or /24 in them. They just use IP addresses.I am assuming that the ping is arriving at pfsense, as the IP randmoly shows in ARP table.
-
Your subnets are overlapping. 192.168.0.0 /20 runs from 192.168.0.0 to 192.168.15.255, which completely overlaps 192.168.1.0 /24. Also, if you are in fact using 192.168.1.0 /20 at home, that is the exact same address space as 192.168.0.0 /20, as the least significant 4 bits of the 3rd octet are masked out to the same value for both ranges. Since you can't have overlapping networks, it will fail, as you're experiencing.
I am a little confused about the overlap. There are no other DHCP servers or routers I am using.
192.168.0.1/20 (pfsense) <<–>>Home (192.168.0.100-192.168.0.100/20) (able to access lan/ 192.168.1.x/ pfsense / internet)
|
--->>Home Office (I use a range of 192.168.1.100-192.168.1.200/20) (able to access lan/ 192.168.0.x) No Pfsense/internetI am not using /24 anywhere. All my devices are on /20 subnet. That is why I am confused as to why devices from 192.168.0.x/20 are able to access pfsense/internet But, as soon as I change the IP to any other range such as 192.168.1.x/20, pfsense and internet don't work, yet I have access to the other local devices on 192.168.0.0/20
Sorry, I was thinking you had 2 networks.
Regardless, the normal practice is to create a subnet large enough for all your devices. I would think a /24 would suffice though.
Based on your description, it sounds as though you don't have pfSense configured correctly for the larger network. On the LAN page, check the prefix selected on the IPv4 address and make sure it's /20
I know, I have enabled the firewall rule in System -> Advanced "Bypass firewall rules for traffic on the same interface"
Additionally, none of the firewall rules use /20 or /24 in them. They just use IP addresses.I am assuming that the ping is arriving at pfsense, as the IP randmoly shows in ARP table.
-
Your subnets are overlapping. 192.168.0.0 /20 runs from 192.168.0.0 to 192.168.15.255, which completely overlaps 192.168.1.0 /24. Also, if you are in fact using 192.168.1.0 /20 at home, that is the exact same address space as 192.168.0.0 /20, as the least significant 4 bits of the 3rd octet are masked out to the same value for both ranges. Since you can't have overlapping networks, it will fail, as you're experiencing.
I am a little confused about the overlap. There are no other DHCP servers or routers I am using.
192.168.0.1/20 (pfsense) <<–>>Home (192.168.0.100-192.168.0.100/20) (able to access lan/ 192.168.1.x/ pfsense / internet)
|
--->>Home Office (I use a range of 192.168.1.100-192.168.1.200/20) (able to access lan/ 192.168.0.x) No Pfsense/internetI am not using /24 anywhere. All my devices are on /20 subnet. That is why I am confused as to why devices from 192.168.0.x/20 are able to access pfsense/internet But, as soon as I change the IP to any other range such as 192.168.1.x/20, pfsense and internet don't work, yet I have access to the other local devices on 192.168.0.0/20
Sorry, I was thinking you had 2 networks.
Regardless, the normal practice is to create a subnet large enough for all your devices. I would think a /24 would suffice though.
Based on your description, it sounds as though you don't have pfSense configured correctly for the larger network. On the LAN page, check the prefix selected on the IPv4 address and make sure it's /20
On LAN page, the subnet is set to /20
-
"I know, I have enabled the firewall rule in System -> Advanced "Bypass firewall rules for traffic on the same interface""
What what possible reason would you do that?
"I am not using /24 anywhere. All my devices are on /20 subnet"
WHY??? You clearly do not have 4,000 some devices do you??
As to devices in your /20 not getting internet access that you set as static. Can they ping pfsense IP 192.168.0.1? What are you lan rules? What is your outbound nat? Did you mess with them from automatic? And maybe you set them to manual or something then changed your mask? So its only outbound natting portion of your /20
Just at a loss to the point of using a /20 for a network with a handful of devices on it? Using a network that is way bigger than required is just pointless.. While sure it will work, it makes no sense to do such a thing. Shoot even a /24 is way to big for most home networks. But it makes for easy human understanding of what the network actually is from address space range. And gives you plenty of space to work with if you want to put some devices in different ranges of the address space. Using an odd mask leads to mistakes as well.
You have mentioned using 192.168.0 and 192.168.1 then why would you not just use a /23?
-
"I know, I have enabled the firewall rule in System -> Advanced "Bypass firewall rules for traffic on the same interface""
What what possible reason would you do that?
"I am not using /24 anywhere. All my devices are on /20 subnet"
WHY??? You clearly do not have 4,000 some devices do you??
As to devices in your /20 not getting internet access that you set as static. Can they ping pfsense IP 192.168.0.1? What are you lan rules? What is your outbound nat? Did you mess with them from automatic? And maybe you set them to manual or something then changed your mask? So its only outbound natting portion of your /20
Just at a loss to the point of using a /20 for a network with a handful of devices on it? Using a network that is way bigger than required is just pointless.. While sure it will work, it makes no sense to do such a thing. Shoot even a /24 is way to big for most home networks. But it makes for easy human understanding of what the network actually is from address space range. And gives you plenty of space to work with if you want to put some devices in different ranges of the address space. Using an odd mask leads to mistakes as well.
You have mentioned using 192.168.0 and 192.168.1 then why would you not just use a /23?
If its a static IP in 192.168.0.1-192.168.0.255 then able to ping pfsense/internet works.
All other ranges cant ping pfsense/no internet. They do show in ARP table randomly. If I change their IP to the 192.168.0.1 range they suddenly work fine.
-
If you cannot ping the pfSense LAN then either there is a firewall rule blocking it (check the logs, try adding an allow all rule as a test) or a bad route/subnet somewhere.
Is it possible you're using 192.168.1.0/24 on the WAN side?
Is your 10GbE switch layer 2 only?
Can we see some screenshots?
A packet capture on LAN whilst trying to ping from something in 192.168.1.X would show if pings are arriving and if pfSense is able to respond.
Steve
-
VKAD, u are making yourself crazy doing something unusual, do u REALLY need 4096 hosts?
