Issue with a block of 16 IPv4 addresses

landman16

I have file servers behind the pfsense box

NogBadTheBad

Is 217.13.XX.207 your WAN interface IP ?

If it is you'll need to do a 1:1 nat.

landman16

The way the servers were configured was the public ip, subnet mask and the public gateway address were directly assigned to the nic card on the servers

landman16

@nogbadthebad I have tried that server still now resolving

JKnott

It looks to me like they're just giving you a block of addresses and expect you to use them as is. This means you need a pass through firewall that does not do routing and especially not NAT. If you were to connect all those servers, through a switch, to the ISP, I bet they'd work. You could certainly do that, but you'd want to make sure the firewall on each server is configured correctly. Perhaps you could set up pfSense as a bridge between the WAN and LAN interfaces and set up the appropriate rules.

johnpoz

@landman16 said in Issue with a block of 16 IPv4 addresses:

217.13.XX.207 (router/firewall)

Im with jknott, If they told you that was the router - then that block is not "routed" to you.. But they just attached them to your connection.

They would not tell you what the router is if they actually routed that .192/28 to you.. Since it would just be routed to your current IP. And then yeah you could put the /28 behind pfsense without any nat.

landman16

Zen are not even able to tell me how they are routing the IPs to me. This is half the battle if they could I wouldn’t be where I am now

NogBadTheBad

@nogbadthebad said in Issue with a block of 16 IPv4 addresses:

Is 217.13.XX.207 your WAN interface IP ?

We'd know exactly how to help if you answered the question I posted.

Is 217.13.XX.207 your WAN interface IP ?

"I have tried that server still now resolving" doesn't really mean a thing.

NogBadTheBad

@landman16 said in Issue with a block of 16 IPv4 addresses:

Zen are not even able to tell me how they are routing the IPs to me. This is half the battle if they could I wouldn’t be where I am now

Sorry but I find that very hard to believe, they are one of the better ISPs in the UK.

landman16

@nogbadthebad yes that is the WAN address

NogBadTheBad

OK then you need to nat those addresses, but not 217.13.XX.207

217.13.XX.192/28 can't exist on your WAN and LAN interface.

johnpoz

If .207 is your WAN, then that /28 is not "routed" to you... Your just attached to that network, yeah your going to have to NAT to use them as vips.

Have them ROUTE the /28 to you if you want to put it behind pfsense.

landman16

How would I go about doing that ?

johnpoz

Doing what? Routed call your ISP and tell them to route that /28 you via transit network..

1:1 nat just create those IPs as vips and do 1:1 nat..
https://www.netgate.com/docs/pfsense/book/nat/1-1-nat.html

NogBadTheBad

https://www.netgate.com/resources/videos/nat-on-pfsense-23.html

JKnott

@landman16 said in Issue with a block of 16 IPv4 addresses:

Zen are not even able to tell me how they are routing the IPs to me. This is half the battle if they could I wouldn’t be where I am now

If they're just giving you a block of addresses, then use them that way. No need to route them. As I mentioned above, you just need a bridge/firewall, to pass the addresses to the servers. Take a computer, configure it with a static address from that list. If it works, that's all you need to do for each server. Also, if those servers run Linux, they will already have a good firewall built in. Just configure and you wouldn't even need pfSense, though an extra layer of protection is better.

JKnott

@nogbadthebad said in Issue with a block of 16 IPv4 addresses:

OK then you need to nat those addresses, but not 217.13.XX.207

NO! NO! NO! NAT. He has a block of public addresses. If he has an address for a router, then set up pfSense as a router/firewall. If he doesn't then set up pfSense as a bridge/firewall. Which config he uses depends on what the ISP provides. My own ISP provides 2 IPv4 addresses, so I could directly connect 2 devices to my cable modem, if I choose. However, as I have more than 2 devices, I am forced to use NAT for IPv4.

I wish people would get out of the habit of thinking NAT is the way things are done. NAT is a hack, created to get around the IPv4 address shortage and, due to problems it causes, shouldn't be used when not needed. The OP has a block of 16 addresses, so NAT most definitely should not be used.

Derelict

Call your ISP.

Tell them to give you a /29 on the WAN interface.

Tell them to route 217.13.XX.192/28 to your address on that.

If they want justification for the /29 tell them you need to run VRRP. (Even though it's not really possible on PPPoE. You might have to settle for something else there, like a static address. Try for the /29 anyway)

Put 217.13.XX.193/28 on an inside interface.

Make a NO NAT Hybrid outbound NAT rule for 217.13.XX.192/28

Put your servers on that inside interface. Give them addresses 217.13.XX.194 - 217.13.XX.207.

And you're done - and it's done correctly.

Derelict

@jknott said in Issue with a block of 16 IPv4 addresses:

The OP has a block of 16 addresses, so NAT most definitely should not be used.

Neither should any silly bridging.

landman16

@derelict I will give them a call in a bit and ask them to give me a /29 and see where I go from there. If they will issue a /29 Will that allow me to assign the servers behind pfsense the public IPs directly to the NIC cards on the physical servers?