Static Routing on Additional Lan Gateway
-
@kiokoman but when I set static route I need to define a gateway and it cannot be pfsense default gateway.
-
ah well i never had the chance to use the gui to create a static route, it was my misunderstanding
the command line would be
route add -net 145.54.26.0/24 10.10.10.150
where 10.10.10.150 is the gateway after allis it like this?
-
yes like this
-
-
check with packet capture, the traffic is probably right from pfsense side but going out from the wrong interface after RouterOS, i don't understand that 162.29. gateway, can you make a draw of your network?
-
@kiokoman oh thank you for pointing out...infact it's just a typo that happened while I was taking that screenshots...it should be..145.54.26.36...
Sure I would give you a diagram -
@Rupesh said in Static Routing on Additional Lan Gateway:
have windows share on 145.54.26.205 PC and a printer on 145.54.26.205.
So you just pulling IP space out of thin air and using it internally? That is borked!
Also if your going to have a downstream network, your going to want to use a transit network (no hosts on it) your will have issues with asymmetrical routing talking to and from devices on your lan (that you are using as transit)..
-
@johnpoz sorry about that..that was typo..however I did correct it there in my next reply ....
-
@Rupesh said in Static Routing on Additional Lan Gateway:
The printer is on 145.54.26.207/24
That is owned by some ISP in the netherlands - you can not just grab any IP space you want and using it internally without issues... Just use rfc1918.. You do not own this 145.54.26 address space do you??
netnum: 145.54.0.0 - 145.54.255.255 netname: PTT2 country: NL organisation: ORG-KOVN1-RIPE descr: KPN Internet Solutions address: NETHERLANDS -
@johnpoz sorry for asking silly question...im kind of newbie.
by transit network you mean 10.10.10.0/24 ?? Doesn't it defeats the very purpose of having another gateway in my lan? Or perhaps I didn't get you completely..can you please elaborate a bit...
-
Do you have devices or hosts on this 10.10.10 network? Then you will have issues talking to this downstream network unless you host route on them or do natting of your downstream network
A transit network to another downstream network should have no hosts on it or you will have asymmetrical problems... I have been over this a 100 times ;)
-
@johnpoz it is being used in local network..not connected at all with internet... That is the only reason to keep it on entirely different network...
-
That is fine still shouldn't be PUBLIC space - pick a network out of the rfc1918 space to use... There is plenty of it!!!
Using public space internally that is not yours - is borked!! And now what if for some reason there is a website hosted on this public network you want to get to?? ;) Do not use public space internally unless you actually own it!!
Here is older thread and drawing where show the problem of hosts on transit, ie asymmetrical routing.
https://forum.netgate.com/post/865509 -
@johnpoz got it..I'll do the needful regarding class of addressing, however my issue/question still remains the same.
I'm able to open the share and even printers webpage is opening without any issues...
I can copy from windows share to my 10.10.10.0/24 subnet but can't do the other way around... -
Lets see your drawing you were going to do ;)
-
@johnpoz ok removed that 145 network Here is what it looks like now
-
@Rupesh also this 162.29.149.0/24 network is not under my control. Its my organizational network strictly isolated from internet.
-
162.29.149 is not RFC1918... WTF dude?
NetRange: 162.29.0.0 - 162.29.255.255 CIDR: 162.29.0.0/16 NetName: WELLSFARGO-162-29-0-0Are you wells fargo? Why are you using that space? Is it yours? Use rfc1918 10.x.x.x, 192.168.x.x, 172.16-31.x.x there is plenty of space to use..
And yeah that is going to a be a asymmetrical nightmare..., Where to the windows machine and the print point to for their gateway? Do they have specific routes on how to get back cto your 10.10.10 network? Is this mikrotik router natting these IPs?
Its my organizational network strictly isolated from internet.
So you are wellsfargo? If not your IT org are a bunch of freaking idiots!!
-
@johnpoz yes all routers are natting in here. About the IP addresses for now please consider them to be on class C like 190.xx.xx.xx/24.
-
Doesn't actually matter from a technical point of view as long as your not advertising them out.. .But it is so freaking BORKED!!! you can not just pull public space out your ass and use it internally ;)
Well if that downstream router is natting, then you would have to do port forwards if you want say that PC to create an unsolicited connection into the 10.x.x.x network.
