Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Want to Access Switch from a Different Subnet.

    Scheduled Pinned Locked Moved General pfSense Questions
    subnetrouting
    23 Posts 8 Posters 5.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • JKnottJ
      JKnott @aeboi80
      last edited by

      @aeboi80

      Either change the DHCP address range or change the address of the switch. Of course, since the switch is on the LAN side of pfSense, you could temporarily assign a computer a static address in the same subnet as the switch.

      PfSense running on Qotom mini PC
      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
      UniFi AC-Lite access point

      I haven't lost my mind. It's around here...somewhere...

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        Hmm, is 10.10.0.0 on the LAN side if pfSense? The WAN is a public IP?

        Then, yes, why is the switch in a different subnet? Just change the switch IP.

        You can add a virtual IP to the pfSense LAN in the 192.168.0.0 subnet that will allow it to route traffic to it. You will end up with an asymmetric route if it's all on the same interface though.

        Steve

        A stephenw10S 2 Replies Last reply Reply Quote 0
        • A
          aeboi80 @stephenw10
          last edited by

          @stephenw10 Yes 10.10.0.0 is on the LAN side of pfSense. The WAN is a public IP

          While yes I could assign the switch an IP in the 10.10.0.0 range and that would solve this, but for the sake of learning something...is it not possible to access the web interface of the switch at all from the 10.10.0.0 network? I thought for sure there would be a way to configure it to allow connections from that network within pfSense.

          GertjanG JKnottJ 2 Replies Last reply Reply Quote 0
          • GertjanG
            Gertjan @aeboi80
            last edited by

            @aeboi80 said in Want to Access Switch from a Different Subnet.:

            I could assign the switch an IP in the 10.10.0.0 range and that would solve this,
            is it not possible to access the web interface of the switch at all from the 10.10.0.0 network?

            ?
            When assigned into the 10.10.x.y range, it's possible to access the device in the 10.10.x.y ....

            No "help me" PM's please. Use the forum, the community will thank you.
            Edit : and where are the logs ??

            A 1 Reply Last reply Reply Quote 0
            • JKnottJ
              JKnott @aeboi80
              last edited by

              @aeboi80 said in Want to Access Switch from a Different Subnet.:

              is it not possible to access the web interface of the switch at all from the 10.10.0.0 network?

              You could create an alias address on pfSense and then allow routing. But as soon as you try to connect to the switch, pfSense will give you an ICMP redirect, telling you to connect directly to the switch. An alias on the computer should work, but that has nothing to do with pfSense. Creating an alias in Linux is easy enough, but I don't know about Windows.

              PfSense running on Qotom mini PC
              i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
              UniFi AC-Lite access point

              I haven't lost my mind. It's around here...somewhere...

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator @stephenw10
                last edited by

                @stephenw10 said in Want to Access Switch from a Different Subnet.:

                You can add a virtual IP to the pfSense LAN in the 192.168.0.0 subnet that will allow it to route traffic to it. You will end up with an asymmetric route if it's all on the same interface though.

                If you also add an outbound NAT rule for 10.10.0.0 to 192.168.0.0 on the LAN interface that will work around asymmetric routing and allow you to access the switch.
                It's a useful technique to access some device when you have no way to change it, something stuck at it's default config for example. But be sure you understand what is happening there, it's a bit if an ugly hack. I would not want to use it permanently, it will probably come back to bite you if you do. ๐Ÿ˜‰

                Steve

                1 Reply Last reply Reply Quote 0
                • JKnottJ
                  JKnott
                  last edited by

                  @stephenw10 said in Want to Access Switch from a Different Subnet.:

                  If you also add an outbound NAT rule for 10.10.0.0 to 192.168.0.0 on the LAN interface that will work around asymmetric routing and allow you to access the switch.

                  I bet an ICMP redirect is more likely. PfSense will see that both the switch and computer IP addresses are on the same network and will tell the computer to connect directly. And yes, I have experienced that years ago, when I tried something similar.

                  PfSense running on Qotom mini PC
                  i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                  UniFi AC-Lite access point

                  I haven't lost my mind. It's around here...somewhere...

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    That might happen but since neither the client or the switch have an IP in the others subnet....

                    Mmm, in fact that should not end up asymmtreic in that case. ๐Ÿค”

                    JKnottJ 1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by johnpoz

                      Im not really getting how you have this all connected together... WTF is layer 2+ ?? ;)

                      Sounds a bit like your wanting to run multiple layer 3 on the same layer2? If your switch is on the the 10.10 layer 2, then it should have an IP on the 10.10, if you want to route to a different network with 192.168 - then yeah you can easy route to that.. But it needs to be a different layer 2 network.

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      NogBadTheBadN A 2 Replies Last reply Reply Quote 0
                      • JKnottJ
                        JKnott @stephenw10
                        last edited by

                        @stephenw10 said in Want to Access Switch from a Different Subnet.:

                        That might happen but since neither the client or the switch have an IP in the others subnet....

                        I assume you're referring to my post. If you set up an alias on pfSense, then it will have 2 addresses on the same network. When the computer tries to reach the switch or vice versa, pfSense will see they are on the same wire and should be able to reach the destination directly, without going through the router, and send the redirect. The only way to do this is to add an alias on the computer. That way the computer will send out the packets, with the correct address to reach the switch, with absolutely no involvement by pfSense.

                        PfSense running on Qotom mini PC
                        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                        UniFi AC-Lite access point

                        I haven't lost my mind. It's around here...somewhere...

                        1 Reply Last reply Reply Quote 0
                        • NogBadTheBadN
                          NogBadTheBad @johnpoz
                          last edited by

                          @johnpoz said in Want to Access Switch from a Different Subnet.:

                          Im not really getting how you have this all connected together... WTF is layer 2+ ?? ;)

                          Sounds a bit like your wanting to run multiple layer 3 on the same layer2? If your switch is on the the 10.10 layer 2, then it should have an IP on the 10.10, if you want to route to a different network with 192.168 - then yeah you can easy route to that.. But it needs to be a different layer 2 network.

                          Knew I'd seen a brand somewhere saying L2+ lol its Netgear.

                          Screenshot 2019-09-17 at 15.19.07.png

                          Andy

                          1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                          JKnottJ 1 Reply Last reply Reply Quote 0
                          • JKnottJ
                            JKnott @NogBadTheBad
                            last edited by

                            @NogBadTheBad said in Want to Access Switch from a Different Subnet.:

                            Knew I'd seen a brand somewhere saying L2+ lol its Netgear.

                            That still doesn't say what L2+ is. Is it VLANs? Routing? Something else?

                            PfSense running on Qotom mini PC
                            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                            UniFi AC-Lite access point

                            I haven't lost my mind. It's around here...somewhere...

                            NogBadTheBadN 1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              You can route between layer 3 subnets on the same layer 2 segment. You shouldn't do it.... but you can. ๐Ÿ˜‰

                              However the switch would need to be using whatever VIP address you add to pfSense as it's gateway in order to have a route back. It probably doesn't have that so adding the outbound NAT rule will allow it to reply.

                              I say any of this only because:
                              @aeboi80 said:

                              ... but for the sake of learning something...is it not possible to access the web interface of the switch at all from the 10.10.0.0 network?

                              Steve

                              1 Reply Last reply Reply Quote 1
                              • NogBadTheBadN
                                NogBadTheBad @JKnott
                                last edited by

                                @JKnott said in Want to Access Switch from a Different Subnet.:

                                @NogBadTheBad said in Want to Access Switch from a Different Subnet.:

                                Knew I'd seen a brand somewhere saying L2+ lol its Netgear.

                                That still doesn't say what L2+ is. Is it VLANs? Routing? Something else?

                                I tried to look exactly what they meant by L2+, gave up after a few mins.

                                Andy

                                1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                                GertjanG 1 Reply Last reply Reply Quote 0
                                • GertjanG
                                  Gertjan @NogBadTheBad
                                  last edited by

                                  @NogBadTheBad said in Want to Access Switch from a Different Subnet.:

                                  L2+

                                  Easy : ISO 2 and above (?) โ˜บ

                                  No "help me" PM's please. Use the forum, the community will thank you.
                                  Edit : and where are the logs ??

                                  1 Reply Last reply Reply Quote 0
                                  • P
                                    pfSense4ME
                                    last edited by

                                    Layer 2 vs Layer 3: What Makes Layer 3 Switch Different?
                                    When comparing the Layer 2 switch to a Layer 3 switch the first thing to look at is what additional software functionality you are getting. When a switch supports Dynamic Routing Protocols, itโ€™s no longer a strictly Layer 2 switch. Because static routing allows traffic to be routed between VLANs. In fact, the switches that add only Static Routing to their software features are considered to be somewhere between a Layer 2 and full Layer 3 switch. Sometimes called Layer 2+ or Layer 3 Lite. Unlike Layer 2+ switch, Layer 3 switch is Dynamic Routing ,which are used to link large networks together and share routing tables between them. They can also allow for dynamic routing of multicast traffic on the network.

                                    Google search:
                                    layer 2 vs "layer 2+" switch

                                    Source:
                                    Link_Info.jpg
                                    *Sorry for the pic but when I tried to input the url as a link or plain text it kept getting flagged as spam. If the link / pic is not acceptable (because it voilates a rule - apologies) please remove or correct.

                                    1 Reply Last reply Reply Quote 1
                                    • A
                                      aeboi80 @Gertjan
                                      last edited by

                                      @Gertjan Yes

                                      1 Reply Last reply Reply Quote 0
                                      • A
                                        aeboi80 @johnpoz
                                        last edited by

                                        @johnpoz said in Want to Access Switch from a Different Subnet.:

                                        WT

                                        This is the switch - https://www.tp-link.com/us/business-networking/smart-switch/t1600g-28ps/

                                        1 Reply Last reply Reply Quote 0
                                        • stephenw10S
                                          stephenw10 Netgate Administrator
                                          last edited by

                                          Mmm, so static routing between segments/subnets. That's layer 3 in my opinion. ๐Ÿ˜€
                                          I guess I can see why they wanted some in-between label.

                                          Steve

                                          1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator
                                            last edited by

                                            Hehehe - dude really? There is layer 2, and then there is layer 3 ;) There is no layer 2+ heheheh

                                            These stupid marketing nonsense terms.. If you want to call it layer 3 lite would be better than layer 2+

                                            Where is this drawing of your network? Do you need some color+ crayons to use? ;)

                                            While it is technically feasible to route multiple layer 3 on the same layer 2 - it would be the technical term BORKED if you actually do something like that ;)

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.