Issue with a block of 16 IPv4 addresses
-
@derelict said in Issue with a block of 16 IPv4 addresses:
Not for any love of NAT, but that would be my preferred way of dealing with this ISP crap
Why not just use bridge mode and filter that way. Unless I'm mistaken, pfSense can do that, though I have never tried it.
-
I consider bridging to be a last resort.
-
@derelict said in Issue with a block of 16 IPv4 addresses:
I consider bridging to be a last resort.
What's the issue? I'd consider NAT to be a last resort.
-
Mostly because people don't understand what they are doing. Even worse than usual.
I said bridging was an option. I said I would NAT. You have your preference. I have mine. I also said it depends on the application. If it's web servers I really don't care if it's NAT to get around a stupid ISP.
I would actually insist my ISP did it right or get a different one. But I'm pretty far to the edge of the bell curve there.
-
@jknott said in Issue with a block of 16 IPv4 addresses:
@nogbadthebad said in Issue with a block of 16 IPv4 addresses:
You’ll need to NAT the addresses then as suggested.
What's this obsession with NAT?
What is with your hating of NAT?
It is a fact that same that subnet can't exist both sides of the firewall.
I can't even see how this previously worked when the OP said the subnets were like this:-
217.13.XX.193 (router/firewall)
217.13.XX.194
217.13.XX.195
217.13.XX.196
217.13.XX.197
217.13.XX.198
217.13.XX.199
217.13.XX.200
217.13.XX.201
217.13.XX.202
217.13.XX.203
217.13.XX.204
217.13.XX.205
217.13.XX.206
217.13.XX.207
217.13.XX.208 (broadcast address)The only difference is the router address has moved from 217.13.XX.193 to 217.13.XX.207
If the above worked previously with another ISP then 217.13.XX.193 was the LAN address and he had a routed subnet.
-
@nogbadthebad said in Issue with a block of 16 IPv4 addresses:
What is with your hating of NAT?
It's a hack that was created to get around the address shortage. The OP apparently has sufficient addresses.
me that subnet can't exist both sides of the firewall.
Never said it could. However, that proves that the router address provided is on the LAN side, not WAN.
I can't even see how this previously worked when the OP said the subnets were like this:
It will work, if the ISPs expect the computers to use those addresses directly, without a router in between. This is why I said configure pfSense as a bridge. This will allow filtering, without creating a router.
I can't even see how this previously worked when the OP said the subnets were like this
We don't know enough about the original ISP. However, those could be the LAN side, with an appropriate WAN address on the other side. That detail was not mentioned. When I see a list of addresses like that, I see LAN side, not WAN, if an router is to be used. If he had a proper WAN configuration for a router, there would be an address outside of the /28 block. I have not seen that mentioned at all.
How was pfSense configured before? What changes did the OP make? We don't know.
-
@JKnott The only difference is the router is at the ISP's and not his location. This is why I suggested configuring a computer with one of those addresses and seeing if it works. If it does, then the ISP does not want a router at his site and pfSense has to be configured as a bridge. It would be really nice if the OP would confirm what arrangements the ISP wants, so we're not speculating. Either way, forget NAT. It's not needed, as he apparently has all the addresses he needs for his servers.
Im not sure why I should need to change my entire setup just to get it working (sort of). For example the issue with NAT is that I have two mirrored servers with identical software packages on each server node. Each node has two separate licence codes that are assigned to two separate public IPs. The issue with NAT is that the servers behind pfsense are issued with local IPs when 1:1 Nat is being used, and when they send the call-backs out to the licensing servers of the software vendors, it sees 2 servers on 1 IP (The WAN IP) and as soon as the licencing servers detect this, automation takes over and they think its some kind of licence abuse, and suspends my licence and both servers stop working correctly. This is just one example why NAT wouldn't work with my setup
The only difference is the router is at the ISP's and not his location.
Yes, I think basically my network as it stands at the moment is an extension of their network. They have already told me that they are sending the public ip block to me via some kind of DHCP server setup, or at least this is as far as the tech guy could tell me it works. Where my previous supplier (Spitfire Internet Services) routed them to me directly, I would assume via a /29 transit network setup as I was able to put the range into the router and then just assign the public ip, subnet and gateway directly to the servers NIC card. The reason I moved from them, is over a 2 and a half year period I started to see the connection get worse and worse as time went on (hence the move), towards the end couldnt even stream internet services such as youtube for example.
This is why I suggested configuring a computer with one of those addresses and seeing if it works. If it does, then the ISP does not want a router at his site and pfSense has to be configured as a bridge.
They have kind of already told me this in a round about way. I did state at the point of inception/order that being able to route my IP's the way I have it setup is a requirement. The sales guy said "yes our network can support your request. However conveniently when service goes live and I start having IP range chasing error messages coming out of pfsense they suddenly turn around and tell me their network is not capable of routing the way I had requested from the start of the order process."
It would be really nice if the OP would confirm what arrangements the ISP wants, so we're not speculating. Either way, forget NAT. It's not needed, as he apparently has all the addresses he needs for his servers.
Im not sure what it is you want me to ask the ISP? @NogBadTheBad suggested I should go to them and request the public ip range to be sent to me via /29 transit network. But as stated further up this reply they are not able to do this. The number public IP's assigned to me is perfectly fine. If you could state what it is you want me to ask them and I will drop them a call in the morning and see if I can get anything out of them.
Please remember, NAT is a hack to get around the IPv4 address shortage and should not be used unless absolutely necessary.
This is why I do not want to use it, and can not use it because of the way the servers are setup. I also have a OpenVZ node sat behind pfsense. NAT doesn't work on that, I can get to the host node from the web using 1:1 NAT, but when I try and goto one of the OpenVZ containers virtualised on the node, they don't even appear on the ARP table from the LAN side never mind trying to reach them from the web.
Based on the info provided, it's not, assuming he has no more than 13 servers.
Thats right I don't have anymore than 13 servers, at the moment. I have 10 servers with a buffer of 3 spare public IP's for expansion.
Incidentally, there appears to be a minor error in that list. Shouldn't the last octet range from 192 to 207? That would be the normal range for a /28, with 217.13.XX.192 the network address and 217.13.XX.207, broadcast.
Yes sorry was a typo, apologies there its been a long day trying to get this stupid thing working correctly. I feel as I have wasted two entire days on this, and to be told "out network cant do what you want" when they said "yes our network will support your network without an issue.
Hopefully I have managed to awnser your questions for you, if I have missed anything that I need to ask the ISP in the morning, then do let me know and I will add it to my list to ask them.
-
this is how I had it setup previously with Spitfire and it worked perfectly.
217.13.XX.192 (unusable)
217.13.XX.193 (assigned to the router/firewall by me)
217.13.XX.194 (Physical Host Node 1 - OpenVZ)
217.13.XX.195 (Virtual Server 1 - OpenVZ)
217.13.XX.196 (Virtual Server 1 - OpenVZ)
217.13.XX.197 (Virtual Server 1 - OpenVZ)
217.13.XX.198 (Virtual Mail Server 1 - OpenVZ)
217.13.XX.199 (Virtual File Server 1 - OpenVZ)
217.13.XX.200 (Virtual Application Server 1 - Mirrored with Virtual Application Server 2 - OpenVZ) ——— This is where NAT would fail even before the issue with 1:1 NAT doesn’t like virtualised instances
217.13.XX.201 (Virtual Application Server 2 - Mirrored with Virtual Application Server 1 - OpenVZ) ——— This is where NAT would fail even before the issue with 1:1 NAT doesn’t like virtualised instances
217.13.XX.202 (Media Server)
217.13.XX.203 (NAS Server)
217.13.XX.204 (Buffer IP: 1)
217.13.XX.205 (Buffer IP: 2)
217.13.XX.206 (Buffer IP: 3)
217.13.XX.207 (broadcast address / useless to me) -
This post is deleted! -
I have to wonder about your understanding of networks. With both ISPs, you do not appear to have a separate WAN address and what you are now saying indicates this to be true. Your issue with licences has nothing to do with this, other than pointing out one way that NAT is failing you.
As I have mentioned, NAT is a hack to get around the IPv4 address shortage. In the process it breaks things. For example, years ago, some FTP clients wouldn't work with it. These days, things like IPSec authentication headers don't work at all. Other things, like Voice over IP and some games require using STUN servers to tell the other end of the connection what the real IP address is, rather than the NAT address. Then firewalls have to be able to manage whatever services are passing through NAT to ensure they work. Not all are a simple address/port remap. Also, some people running VPNs may run into address conflicts, when the subnet address is the same at both ends. There are many reasons why NAT should be avoided.
The first thing you have to do is get the network working properly, without setting up VMs on the same address etc. Just set it up and ensure you can configure a computer or server on each of the addresses. Pick an address from the list and use static config. Use the assigned router address for the default gateway. If that works, then the network is set up properly for your address range. Now you can start worrying about your VMs, licences, etc.. However those things are beyond pfSense. As I mentioned, pfSense can be configured as a bridge and the same filter rules apply as with a router. When you do that, you probably want to apply one of those addresses to pfSense so you can manage it, though you could set up another interface, with an address outside of your block.
BTW, VMs should behave just like real hardware when it comes to networking, if set up with a bridged adapter. I run Oracle VirtualBox, where I have a choice of bridged or NAT adapters . If you're using NAT for the VMs, this might be the cause of the licence issues. However, that is beyond pfSense.
Bottom line, keep things simple by going one step at a time and seeing where the problems pop up.
-
So you had a routed subnet with Spitfire and now you have a /28 on the WAN interface with Zen.
Im not sure why I should need to change my entire setup just to get it working (sort of).
Because your new ISP isn't provisioned the same as the old one. You have addresses on the outside interface and nothing left to put on the inside. Spitfire gave you provisioning that matched what you needed. You did not buy the same thing from Zen. Not pfSense's fault there.
Each node has two separate licence codes that are assigned to two separate public IPs. The issue with NAT is that the servers behind pfsense are issued with local IPs when 1:1 Nat is being used, and when they send the call-backs out to the licensing servers of the software vendors, it sees 2 servers on 1 IP (The WAN IP) and as soon as the licencing servers detect this, automation takes over and they think its some kind of licence abuse, and suspends my licence and both servers stop working correctly. This is just one example why NAT wouldn't work with my setup
No, you can make the outbound connections appear as different addresses. That's what 1:1 NAT does anyway. Outbound connections will be NATted to the 1:1 for that server on the outside.
-
Looking at Zen’s own support documentation it looks like they offer two types of transit networks
Routed Subnets and NAT Subnets
https://support.zen.co.uk/kb/KnowledgebaseArticle.aspx?articleid=10134
So I really would love to know why they are saying they Carnt do it since thier own support documentation says otherwise
-
Maybe they only do it over ethernet or mpls.
-
@nogbadthebad I will ask them that question Monday morning before I put in my cancelation request
-
@landman16
I have a /29 from Zen. In my current setup, pfSense manages the PPPoE connection and any servers are on a 1:1 NAT behind it.I've previosuly set it up differently. If you have a router that supports Zen's 'routed IP' service, you can put the servers on it like this.
x.x.x.0/29, router address x.x.x.6 xDSL router(PPPoE, IP x.x.x.6)------firewall(IP x.x.x.1)-----LAN | | | servers (IP x.x.x.2-x.x.x.5)I think this is what @JKnott suggested above. Of course that keeps pfSense completely away from the servers and it uses an additional IP address for the firewall WAN IP address.
-
Ok been on the phone with a fella called Ben from
Zen for some time yesturday trying to tap/chip away at this issue.He is asking when we manually configure IP assignment for the WAN interface instead of letting it do it automatically. It’s asking for the following details
- New IPv4 WAN address: now we are assuming this is the public ip in the range that I’m told should be assigned to the router
2 Then it asks if I want to turn on DHCP I say “no”
- Then It asks for the upstream gateway, this is where it starts to get a bit of a gray area ISP is asking if this is the upstream gateway of Zen or some IP within my public subnet. We did try the up of the upstream gateway for zen and it errors and says not within the Subnet. So we then tried the public broadcast address in the range and while it didn’t error, Internet didn’t come online ether.
What Ben did ask is when we manually configure the wan interface with IPs is it still transmitting the PPPOE data, or as its now static do we have to take additional steps for it to do this?
-
You cannot request a routed subnet from a PPPoE provider. They must be configured to do it.
You give it a username and password, maybe, they take that plus whatever else they have (VP/VC on [AV]DSL for instance) and provision your circuit.
There are generally three attributes used in RADIUS to do this:
Framed-IP-Address - sets your interface address
Framed-IP-Netmask - sets your interface netmask
Framed-Route - tells their gear to route a subnet to Framed-IP-AddressWhen I designed an ISP the RADIUS server would be configured to reply to the access servers appropriately, based on the provisioning database, and the access servers would send the routing information, if any, to the infrastructure via OSPF. Worked flawlessly.
-
@landman16 said in Issue with a block of 16 IPv4 addresses:
ISP is asking if this is the upstream gateway of Zen or some IP within my public subnet.
Sounds like your ISP needs some tech support that's not clueless. When configuring a router, it's the ISP's gateway. With computers, it's your own, in this case pfSense.
