Static Routing on Additional Lan Gateway
-
I have a pf-sense firewall that is connected to internet via static 192.168.3.184 interface as wan. Internal LAN IP for the same is 10.10.10.75. I have another MiKrotik Cloud Core router on 10.10.10.150(LAN) which has 196.29.149.99/24 as WAN(external) address. this Mikrotik doesn't have any access to internet, I have windows share on 196.29.149.205 PC and a printer on 196.29.149.207.
What i want is to be able to access that windows share and printing services pointed by 10.10.10.150 router.
On my PF sense firewall I tried to add additional gateway 10.10.10.150 on LAN and added static route for 196.29.149.0/24 network also i added one firewall LAN rule to pass allow passing traffic from LAN net to 196.29.149.0/24 with gateway as 10.10.10.150 in advanced settings.
after all this setup i am able to open windows share as desired but whenever i am trying to move files from 10.10.10.0/24 network to windows share it just says "failed" after keeping coping window in preparing mode for sometime. However if i copy data from windows share to 10.10.10.0/24 side then its flawless.
also i can open the printer webpage with no issue..its just that unable to copy data from pf-sense LAN network to miKkotik wan network.moreover if i set a new pf sense firewall with cloud core router as wan gateway and wan ip as 10.10.10.90/24 then everything gets resolved, so for sure this inst an issue of Mikrotik cloud-core router.
Can someone help me out with this sort of problem or if i am missing something out.
-
@Rupesh Correction!!! The printer is on 145.54.26.207/24
-
imho you don't need a gateway but only a static route that go to 145.54.26.0/24 from 10.10.10.150
i think that you run into an asymmetric routing with that gateway -
@kiokoman but when I set static route I need to define a gateway and it cannot be pfsense default gateway.
-
ah well i never had the chance to use the gui to create a static route, it was my misunderstanding
the command line would be
route add -net 145.54.26.0/24 10.10.10.150
where 10.10.10.150 is the gateway after allis it like this?
-
yes like this
-
-
check with packet capture, the traffic is probably right from pfsense side but going out from the wrong interface after RouterOS, i don't understand that 162.29. gateway, can you make a draw of your network?
-
@kiokoman oh thank you for pointing out...infact it's just a typo that happened while I was taking that screenshots...it should be..145.54.26.36...
Sure I would give you a diagram -
@Rupesh said in Static Routing on Additional Lan Gateway:
have windows share on 145.54.26.205 PC and a printer on 145.54.26.205.
So you just pulling IP space out of thin air and using it internally? That is borked!
Also if your going to have a downstream network, your going to want to use a transit network (no hosts on it) your will have issues with asymmetrical routing talking to and from devices on your lan (that you are using as transit)..
-
@johnpoz sorry about that..that was typo..however I did correct it there in my next reply ....
-
@Rupesh said in Static Routing on Additional Lan Gateway:
The printer is on 145.54.26.207/24
That is owned by some ISP in the netherlands - you can not just grab any IP space you want and using it internally without issues... Just use rfc1918.. You do not own this 145.54.26 address space do you??
netnum: 145.54.0.0 - 145.54.255.255 netname: PTT2 country: NL organisation: ORG-KOVN1-RIPE descr: KPN Internet Solutions address: NETHERLANDS -
@johnpoz sorry for asking silly question...im kind of newbie.
by transit network you mean 10.10.10.0/24 ?? Doesn't it defeats the very purpose of having another gateway in my lan? Or perhaps I didn't get you completely..can you please elaborate a bit...
-
Do you have devices or hosts on this 10.10.10 network? Then you will have issues talking to this downstream network unless you host route on them or do natting of your downstream network
A transit network to another downstream network should have no hosts on it or you will have asymmetrical problems... I have been over this a 100 times ;)
-
@johnpoz it is being used in local network..not connected at all with internet... That is the only reason to keep it on entirely different network...
-
That is fine still shouldn't be PUBLIC space - pick a network out of the rfc1918 space to use... There is plenty of it!!!
Using public space internally that is not yours - is borked!! And now what if for some reason there is a website hosted on this public network you want to get to?? ;) Do not use public space internally unless you actually own it!!
Here is older thread and drawing where show the problem of hosts on transit, ie asymmetrical routing.
https://forum.netgate.com/post/865509 -
@johnpoz got it..I'll do the needful regarding class of addressing, however my issue/question still remains the same.
I'm able to open the share and even printers webpage is opening without any issues...
I can copy from windows share to my 10.10.10.0/24 subnet but can't do the other way around... -
Lets see your drawing you were going to do ;)
-
@johnpoz ok removed that 145 network Here is what it looks like now
-
@Rupesh also this 162.29.149.0/24 network is not under my control. Its my organizational network strictly isolated from internet.
