Subnet 192.168.0.0/20(DHCP 192.168.0.x has internet but Static 192.168.1.x dont)
-
It should work as you have it configured.
Since it isn't working something is probably not configured as you think it is. A bad subnet mask somewhere maybe. Or a firewall rule set to /24.
Run a packet capture on LAN when you are trying to ping it from something that's failing; are the pings arriving? Check the firewall logs.
Steve
-
Your subnets are overlapping. 192.168.0.0 /20 runs from 192.168.0.0 to 192.168.15.255, which completely overlaps 192.168.1.0 /24. Also, if you are in fact using 192.168.1.0 /20 at home, that is the exact same address space as 192.168.0.0 /20, as the least significant 4 bits of the 3rd octet are masked out to the same value for both ranges. Since you can't have overlapping networks, it will fail, as you're experiencing.
I am a little confused about the overlap. There are no other DHCP servers or routers I am using.
192.168.0.1/20 (pfsense) <<–>>Home (192.168.0.100-192.168.0.100/20) (able to access lan/ 192.168.1.x/ pfsense / internet)
|
--->>Home Office (I use a range of 192.168.1.100-192.168.1.200/20) (able to access lan/ 192.168.0.x) No Pfsense/internetI am not using /24 anywhere. All my devices are on /20 subnet. That is why I am confused as to why devices from 192.168.0.x/20 are able to access pfsense/internet But, as soon as I change the IP to any other range such as 192.168.1.x/20, pfsense and internet don't work, yet I have access to the other local devices on 192.168.0.0/20
Sorry, I was thinking you had 2 networks.
Regardless, the normal practice is to create a subnet large enough for all your devices. I would think a /24 would suffice though.
Based on your description, it sounds as though you don't have pfSense configured correctly for the larger network. On the LAN page, check the prefix selected on the IPv4 address and make sure it's /20
-
I got it. 192.168.0.0 is a CLASS C IP address, by default allowing no more than 256 hosts. If more hosts are desired you should use class B of 172.16.0.0, or class A of 10.0.0.0.
Address classes have been obsolete for many years. These days we use classless addresses with variable length subnet masks.
-
It should work as you have it configured.
Since it isn't working something is probably not configured as you think it is. A bad subnet mask somewhere maybe. Or a firewall rule set to /24.
Run a packet capture on LAN when you are trying to ping it from something that's failing; are the pings arriving? Check the firewall logs.
Steve
I know, I have enabled the firewall rule in System -> Advanced "Bypass firewall rules for traffic on the same interface"
Additionally, none of the firewall rules use /20 or /24 in them. They just use IP addresses.I am assuming that the ping is arriving at pfsense, as the IP randmoly shows in ARP table.
-
Your subnets are overlapping. 192.168.0.0 /20 runs from 192.168.0.0 to 192.168.15.255, which completely overlaps 192.168.1.0 /24. Also, if you are in fact using 192.168.1.0 /20 at home, that is the exact same address space as 192.168.0.0 /20, as the least significant 4 bits of the 3rd octet are masked out to the same value for both ranges. Since you can't have overlapping networks, it will fail, as you're experiencing.
I am a little confused about the overlap. There are no other DHCP servers or routers I am using.
192.168.0.1/20 (pfsense) <<–>>Home (192.168.0.100-192.168.0.100/20) (able to access lan/ 192.168.1.x/ pfsense / internet)
|
--->>Home Office (I use a range of 192.168.1.100-192.168.1.200/20) (able to access lan/ 192.168.0.x) No Pfsense/internetI am not using /24 anywhere. All my devices are on /20 subnet. That is why I am confused as to why devices from 192.168.0.x/20 are able to access pfsense/internet But, as soon as I change the IP to any other range such as 192.168.1.x/20, pfsense and internet don't work, yet I have access to the other local devices on 192.168.0.0/20
Sorry, I was thinking you had 2 networks.
Regardless, the normal practice is to create a subnet large enough for all your devices. I would think a /24 would suffice though.
Based on your description, it sounds as though you don't have pfSense configured correctly for the larger network. On the LAN page, check the prefix selected on the IPv4 address and make sure it's /20
I know, I have enabled the firewall rule in System -> Advanced "Bypass firewall rules for traffic on the same interface"
Additionally, none of the firewall rules use /20 or /24 in them. They just use IP addresses.I am assuming that the ping is arriving at pfsense, as the IP randmoly shows in ARP table.
-
Your subnets are overlapping. 192.168.0.0 /20 runs from 192.168.0.0 to 192.168.15.255, which completely overlaps 192.168.1.0 /24. Also, if you are in fact using 192.168.1.0 /20 at home, that is the exact same address space as 192.168.0.0 /20, as the least significant 4 bits of the 3rd octet are masked out to the same value for both ranges. Since you can't have overlapping networks, it will fail, as you're experiencing.
I am a little confused about the overlap. There are no other DHCP servers or routers I am using.
192.168.0.1/20 (pfsense) <<–>>Home (192.168.0.100-192.168.0.100/20) (able to access lan/ 192.168.1.x/ pfsense / internet)
|
--->>Home Office (I use a range of 192.168.1.100-192.168.1.200/20) (able to access lan/ 192.168.0.x) No Pfsense/internetI am not using /24 anywhere. All my devices are on /20 subnet. That is why I am confused as to why devices from 192.168.0.x/20 are able to access pfsense/internet But, as soon as I change the IP to any other range such as 192.168.1.x/20, pfsense and internet don't work, yet I have access to the other local devices on 192.168.0.0/20
Sorry, I was thinking you had 2 networks.
Regardless, the normal practice is to create a subnet large enough for all your devices. I would think a /24 would suffice though.
Based on your description, it sounds as though you don't have pfSense configured correctly for the larger network. On the LAN page, check the prefix selected on the IPv4 address and make sure it's /20
On LAN page, the subnet is set to /20
-
"I know, I have enabled the firewall rule in System -> Advanced "Bypass firewall rules for traffic on the same interface""
What what possible reason would you do that?
"I am not using /24 anywhere. All my devices are on /20 subnet"
WHY??? You clearly do not have 4,000 some devices do you??
As to devices in your /20 not getting internet access that you set as static. Can they ping pfsense IP 192.168.0.1? What are you lan rules? What is your outbound nat? Did you mess with them from automatic? And maybe you set them to manual or something then changed your mask? So its only outbound natting portion of your /20
Just at a loss to the point of using a /20 for a network with a handful of devices on it? Using a network that is way bigger than required is just pointless.. While sure it will work, it makes no sense to do such a thing. Shoot even a /24 is way to big for most home networks. But it makes for easy human understanding of what the network actually is from address space range. And gives you plenty of space to work with if you want to put some devices in different ranges of the address space. Using an odd mask leads to mistakes as well.
You have mentioned using 192.168.0 and 192.168.1 then why would you not just use a /23?
-
"I know, I have enabled the firewall rule in System -> Advanced "Bypass firewall rules for traffic on the same interface""
What what possible reason would you do that?
"I am not using /24 anywhere. All my devices are on /20 subnet"
WHY??? You clearly do not have 4,000 some devices do you??
As to devices in your /20 not getting internet access that you set as static. Can they ping pfsense IP 192.168.0.1? What are you lan rules? What is your outbound nat? Did you mess with them from automatic? And maybe you set them to manual or something then changed your mask? So its only outbound natting portion of your /20
Just at a loss to the point of using a /20 for a network with a handful of devices on it? Using a network that is way bigger than required is just pointless.. While sure it will work, it makes no sense to do such a thing. Shoot even a /24 is way to big for most home networks. But it makes for easy human understanding of what the network actually is from address space range. And gives you plenty of space to work with if you want to put some devices in different ranges of the address space. Using an odd mask leads to mistakes as well.
You have mentioned using 192.168.0 and 192.168.1 then why would you not just use a /23?
If its a static IP in 192.168.0.1-192.168.0.255 then able to ping pfsense/internet works.
All other ranges cant ping pfsense/no internet. They do show in ARP table randomly. If I change their IP to the 192.168.0.1 range they suddenly work fine.
-
If you cannot ping the pfSense LAN then either there is a firewall rule blocking it (check the logs, try adding an allow all rule as a test) or a bad route/subnet somewhere.
Is it possible you're using 192.168.1.0/24 on the WAN side?
Is your 10GbE switch layer 2 only?
Can we see some screenshots?
A packet capture on LAN whilst trying to ping from something in 192.168.1.X would show if pings are arriving and if pfSense is able to respond.
Steve
-
VKAD, u are making yourself crazy doing something unusual, do u REALLY need 4096 hosts?
