MultiWAN pfsense routing
-
@Derelict thanks.. I have created virtual ip.
I talked to the ISP, and they do dhcp reservation (MAC binding)... Is there any workaround to get around this issue?
-
Not really. They need to figure out that is stupid. It sounds like the service you purchased is locked down to connecting one IP address per MAC address. That is dumb. See if they can give you a proper subnet.
-
Mmm, if you can only use the IPs directly and they require a different MAC for each IP your options are limited.
If you have one or two public IPs there some workarounds you might use but for more than that you will have to bridge the WAN to another interface and use the IPs directly on hosts connected to it. You can still filter traffic to/from them in that scenario.
Steve
-
@stephenw10 yea... They need a Mac for each IP. We have 5 IPs from the same subnet. But I just need 3 public IPs, one being the PFSENSE IP. What's the workaround? The pfsense is bridged to ISP ROUTER.
-
I don't think you can do three. You can add a single interface bridge and set a MAC on that.
You will to bridge it to another interface and use them directly.
Steve
-
Thanks @stephenw10.. Logically speaking, if adding the interface cards for the other connections to connect to the other public IPs, do they leave those connections on the DMZ? Or can I still monitor/control the traffic? Can I interact with that LAN from the other LAN?
Is there a document I can refer to?
-
The only document is probably this:
https://docs.netgate.com/pfsense/en/latest/book/firewall/methods-of-using-additional-public-ip-addresses.html#bridgingYou can still filter the traffic between the actual WAN and the bridged segment even though they are in the same subnet. So you don't have to don't have to have those IPs exposed and you can control what they can connect to.
You can connect to them from the LAN just like any subnet connected to the firewall.Steve
-
Or just get a circuit that is properly-provisioned for your use case.
-
Yeah, do that if it's an option for you. Bridging should always be a last resort.
-
Ok.. I'll give it a try. Thanks guys..
