Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    What am I doing wrong (pfSense behind edge router)

    Scheduled Pinned Locked Moved General pfSense Questions
    22 Posts 5 Posters 2.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      duhduhdee @stephenw10
      last edited by duhduhdee

      @stephenw10

      The devices were all connected to the switchports that I thought they were.

      Idk what format would be the most helpful, so here's a screenshot.

      FW_Log.PNG

      Here also is part of my states summary page by IP pair:

      States_Summary.PNG

      I seem to be connected enough to make this post from the ip address (10.64.0.3) and VLAN that I want to be on. But frustratingly, I can go to the youtube page below and see all the thumbnails load and get a bunch of the page formatting, but the video itself just loads and loads forever.

      Youtube.PNG

      As I write this, I seem to also be blocking a bunch of 239.255.255.250:1900 UDP, which is Simple Service Discovery Protocol. But I don't know why I need that to communicate with most sites on the internet.

      Thanks for your help.

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        That network is clearly asymmetrical - you can NOT put hosts on a transit network without issues, unless your going to host route or nat.. I have gone over this so many times its becoming sad!!!

        I got tied up in meetings all day at work so unable to draw up how it would be done correctly... And now going to watch some TV with the wife, just got home... But will for sure draw up how you would do this correctly with out being asymmetrical..

        Again you have to follow the traffic when devices are talking to each other from the different segments and where their default gateway is to see the asymmetrical flow.. If your just talking traffic to and from the outside internet then its not a problem.. The problem is when you have devices talking to each other over such a setup.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        D 1 Reply Last reply Reply Quote 0
        • D
          duhduhdee @johnpoz
          last edited by

          @johnpoz I appreciate your help.

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by johnpoz

            So here is why its asymmetrical

            asym.jpg

            Here is how you fix that - with a transit network.

            transit.jpg

            If you want to put hosts on a transit network, then you need a route on every host saying hey to get to the downstream network go to X vs your default gateway. Or you have to nat at the downstream network.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            D 1 Reply Last reply Reply Quote 1
            • D
              duhduhdee @johnpoz
              last edited by

              @johnpoz I really appreciate the diagram.

              I think I understand you, but I don't think I have the hardware to accomplish it. I have two Cisco routers, and each only has 2 ports. I also have the edge router, a Netgear R7800, which has one WAN port and then 4 switch ports.

              The edge router in your diagram has at least 3 ports. I don't think I have any device capable of routing in more than 2 directions.

              So I guess I either need to buy another router or figure out how to NAT what I have.

              JKnottJ 1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                do it with vlans then.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • JKnottJ
                  JKnott @duhduhdee
                  last edited by

                  @duhduhdee said in What am I doing wrong (pfSense behind edge router):

                  So I guess I either need to buy another router or figure out how to NAT what I have.

                  Or you could get a cheap managed switch (avoid TP-Link) and use VLANs.

                  PfSense running on Qotom mini PC
                  i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                  UniFi AC-Lite access point

                  I haven't lost my mind. It's around here...somewhere...

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    Yeah he already has a cisco switch there that clearly can do vlans... So he should be good to go as long as his edge router can do vlans...

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by

                      Unless I'm misreading this the connection seeing issues is from 10.64.0.3 to external IPs, which should not be asymmetric.

                      Yes you would certainly have asymmetry problems connecting from, say, 10.64.0.3 to 10.2.0.4. Assuming the Cisco is not NATing, which I assume it isn't since there appears to be a static route to 10.64.0.0/11 on pfSense.

                      None of that blocked traffic you've shown looks like the result of asymmetry either. It would all be TCP flagged if so.

                      Steve

                      1 Reply Last reply Reply Quote 0
                      • D
                        duhduhdee
                        last edited by

                        Yeah, I'm reading in the manual about the edge router's VLAN options. It talks about "Setting up a bridge for a VLAN Tag group". Which I guess bridge = trunk, in netgear's terminology?

                        If that works, that would be ideal. If all else fails I'll take the laptop pfSense is running on, connect it to the modem, make it the edge router, put the netgear router in AP mode, get rid of the other routers and subnets and just let the cisco switch separate everything by VLAN.

                        Maybe my wife won't mind if I try to arrange things around the laptop in a pleasing fashion.

                        Thanks everyone.

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          To external IPs it shouldn't be a problem with asymmetrical true... But the overall design is flawed... Even if he has no need to talk to other devices at this time... The design is not correct to ever allow internal hosts to talk to each other at some future point in time.

                          Hosts should never be on a transit. If you have something that forces you do to it, then you have to host routing or natting.. Neither of which are desired things to have to do.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            I look forward to pics of your decorative laptop arrangement. 😁

                            1 Reply Last reply Reply Quote 1
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.