Does anyone have a link to a good site for Multi WAN
-
@luc1231122 Is that regular behaviour in 2019 - demanding information but not giving answers? Instead posting an (incomplete at best) graphic and asking unrelated questions. Wow!
@luc1231122 said in Does anyone have a link to a good site for Multi WAN:
...domain controller in a different subnet...
Why a different subnet? Aren't they all in 172.16.0.0 /16 ?
Just a quick look at your diagram:
172.16.16.2 is double
172.16.17.131 is double or whatever you wanted to show
FA/1 is double (whatever FA/1 & FA/2 are)
FA/2 is missing
IPv6 is missing completely in the diagram (but is allowed by FW rules!?)
... -
@jahonix Yeah sorry but some questions I do not have the answers.
-
@jahonix
we got 1 ISPI do not know what I have to port forward
We got DSL
I think they are all around 90mbps
I used subnetmask /24
And I re uploaded the diagram hopes it makes anymore more sense now
-
I am just wondering do these 2 routers need to have a static route between each other?
-
Now we have another firewall in the mix? Why?
No that diagram makes no sense at all.. There is no masks on the diagram, So your using /24
So you have network 172.16.16/24 and 172.16.17/24
So you have managment port of pfsense on 17.4 and then another interface on 17.131? So a VIP? You can not put address in the same network on multiple ports.. Pfsense won't let you do that even.
And what the hell is untangle doing out there? Doing Nat to what? That is another internet connection? Your not trying to use untangle with the freaking arp spoofing/poisoning shit it does?? OMG!!
How are you people touching anyone's network in the first place???
If your going to connect two routers, you would use a transit network... And then yes there would need to be routes between the networks.. If your throwing that untangle POS into your network with its arp nonsense it does... Good freaking luck to you - go have fun over on their forums.
-
And remember: this is for a software company which is also serving internet to clients.
The one person responsible for that backbone is a trainee. Really respect what you do, Luc. But your trainer, the CEO and the (obviously not available) operations or network manager should get a serious slap!Best advise: hire someone who has done this kind of work before, who knows what he's doing and learn from him.
All you, as a trainee, can do is come up with a tinkered solution which might work in parts. It surely is not a system engineered for safety and performance, let alone for commercial use. -
Yeah no offense to the trainee guy... But come on!!
More than happy to help you... But there needs to be some common ground of knowledge and exchange of information... Can not help you with your calculus problem when you don't understand addition and subtraction ;)
More than happy to help you get there... But seems like this is a complete mess, and they expect you to fix it? Who designed the setup in the first place? What was there before, why is pfsense and untangle being used together.. Was the untangle box there and your trying to replace it with pfsense, was pfsense there and your wanting to add untangle?
How were they connected to the internet before, etc. etc.
-
Sorry .131 is the management port for the hyper-v its incorrect and I should remove it from the diagram because its not connected to pfsense.
The untangle router is the current router with his own incoming wan interface.the network is for the company which I have my internship.
and he wants me to make a new / integrate network.
And we probably gonna replace untangle. -
I know it's a mess and I am doing probably a lot wrong and you guys should not be my teachers my trainer should be, I am just trying to learn.
I mean if you really do not feel like helping me you can. I hope I do not come over unappreciative.Also want to give as much information as I can but neither my trainer or I have enough knowledge.
-
More than happy to help you but as mentioned by Jahonix, it can get frustrating running around in circles and having to pull teeth with a pair of tweezers to get any actual info.
I will give you some advice right up front - an accurate drawing is going to be your best friend, and will instantly allow anyone in the field to understand what is going on.
So lets work on detailed an accurate drawing and work from there...
What are the rules fa/1 and fa/2, those are pfsense - but looks like your interface on pfsense are hn1 and hn2?
-
I am making one at the moment and do you mean a drawing of the current network or the one I would want to create?
-
Lets have the CURRENT network!!! As it currently is, and then can work towards what you want.. And can go over what if that even makes sense.
Why does the hv3 have 2 public ips? What is being served on this box? But it has only 1 private IP?
-
I probably should ask more what to current network looks like but he does not really know himself.
This is what he drawed for me. the current setup is really really weird at least I do not understand why they made it like this.But what he wants is separate networks for the clients and the the Hyper-visors need their own public IP but he also still want access to the Hyper-visors not sure if he can have access internally to the hyper-visors if he also does not want them on the same subnet. hope that this make's sense?
He said that he use so many untangle NAT because he did not know how to give out mutiple public ip's from one router.
but he wants to use pfsense and have one firewall/router do everything.(I am probably using the wrong terms here and there and not understanding what I am actually saying and I am sorry for that I am a newbie to this)
-
Is this a lost case?
-
and this is what I want to start with need to add other things like probably VPN and wireless access point etc but that is for later. Also later on gonna make the firewall rules a bit more strict.
-
Why are you calling out a L3 switch when clearly you have the L3s assigned on pfsense? Makes ZERO sense... So this switch has 3 different L2 vlans created?
What is the Router your calling in the first drawing that has x.x.x.32/27 directly assigned to your Untangle box that is doing nat?
-
Just to give you a starting point may I suggest to work your way through these infos:
Network Documentation Best Practices: What’s Important & How To Track It
How to Draw Clear L3 Logical Network DiagramsTry to draw what you have in both a physical and a logical layout.
Then make a layout of how it's supposed to look in the future (there hardly is a final stage with network, they do change sooner or later). To restrict infos of your real public IPs you can use IPs from the range 203.0.113.0/24 instead which is TEST-NET - the equivalent of www.example.com in the IPv4 world.Here are some more in-depth infos if needed or if you're really curious
Network Documentation Series -
The .32 is assigned to the Router of the office I am not sure what kind. We can not configured it.
And I why the L3 switch because he has an L3 switch and I thought I needed it but I can just use a L2 switch.
Also I am working on making a better network topology. -
I have a L3 switch, its not like they are crazy enterprise hardware.. But when you call them out on a drawing as L3.. Points to them actually being used as L3 and routing.
If you call out switch, its assumed L2, if you state L3 its normally used to point out that your routing at the switch.
You do understand an L3 can both do L3 and L2 at the same time, etc.
So the router is Providers Router.. From your drawing that 32/27 is routed to you.. Where does it get natted, at the 3com L3 or are your HV1 and HV2, etc. have public IPs in that 32/27 network.
So contact the provider and have them change the router so that you can route that /27 to downstream pfsense you want to put in. What is the make and model of the device - take a picture of its model number, etc.
-
I think it gets natted on HV1 and HV2 there going 4 wan cable's in every hyper-visor.
