Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Static Routing on Additional Lan Gateway

    Scheduled Pinned Locked Moved Routing and Multi WAN
    50 Posts 3 Posters 6.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      Rupesh
      last edited by

      yes like this

      1 Reply Last reply Reply Quote 0
      • R
        Rupesh @kiokoman
        last edited by Rupesh

        @kiokoman gateways.png gateway edit.png ssh.png

        1 Reply Last reply Reply Quote 0
        • kiokomanK
          kiokoman LAYER 8
          last edited by kiokoman

          check with packet capture, the traffic is probably right from pfsense side but going out from the wrong interface after RouterOS, i don't understand that 162.29. gateway, can you make a draw of your network?

          ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
          Please do not use chat/PM to ask for help
          we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
          Don't forget to Upvote with the 👍 button for any post you find to be helpful.

          R 1 Reply Last reply Reply Quote 0
          • R
            Rupesh @kiokoman
            last edited by

            @kiokoman oh thank you for pointing out...infact it's just a typo that happened while I was taking that screenshots...it should be..145.54.26.36...
            Sure I would give you a diagram

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by johnpoz

              @Rupesh said in Static Routing on Additional Lan Gateway:

              have windows share on 145.54.26.205 PC and a printer on 145.54.26.205.

              So you just pulling IP space out of thin air and using it internally? That is borked!

              Also if your going to have a downstream network, your going to want to use a transit network (no hosts on it) your will have issues with asymmetrical routing talking to and from devices on your lan (that you are using as transit)..

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

              R 2 Replies Last reply Reply Quote 0
              • R
                Rupesh @johnpoz
                last edited by

                @johnpoz sorry about that..that was typo..however I did correct it there in my next reply ....

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by johnpoz

                  @Rupesh said in Static Routing on Additional Lan Gateway:

                  The printer is on 145.54.26.207/24

                  That is owned by some ISP in the netherlands - you can not just grab any IP space you want and using it internally without issues... Just use rfc1918.. You do not own this 145.54.26 address space do you??

                  netnum:        145.54.0.0 - 145.54.255.255
                  netname:        PTT2
                  country:        NL
                  
                  organisation:   ORG-KOVN1-RIPE
                  descr:          KPN Internet Solutions
                  address:        NETHERLANDS
                  

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                  R 1 Reply Last reply Reply Quote 1
                  • R
                    Rupesh @johnpoz
                    last edited by

                    @johnpoz sorry for asking silly question...im kind of newbie.

                    by transit network you mean 10.10.10.0/24 ?? Doesn't it defeats the very purpose of having another gateway in my lan? Or perhaps I didn't get you completely..can you please elaborate a bit...

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      Do you have devices or hosts on this 10.10.10 network? Then you will have issues talking to this downstream network unless you host route on them or do natting of your downstream network

                      A transit network to another downstream network should have no hosts on it or you will have asymmetrical problems... I have been over this a 100 times ;)

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                      1 Reply Last reply Reply Quote 1
                      • R
                        Rupesh @johnpoz
                        last edited by

                        @johnpoz it is being used in local network..not connected at all with internet... That is the only reason to keep it on entirely different network...

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by johnpoz

                          That is fine still shouldn't be PUBLIC space - pick a network out of the rfc1918 space to use... There is plenty of it!!!

                          Using public space internally that is not yours - is borked!! And now what if for some reason there is a website hosted on this public network you want to get to?? ;) Do not use public space internally unless you actually own it!!

                          Here is older thread and drawing where show the problem of hosts on transit, ie asymmetrical routing.
                          https://forum.netgate.com/post/865509

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                          R 1 Reply Last reply Reply Quote 1
                          • R
                            Rupesh @johnpoz
                            last edited by

                            @johnpoz got it..I'll do the needful regarding class of addressing, however my issue/question still remains the same.

                            I'm able to open the share and even printers webpage is opening without any issues...
                            I can copy from windows share to my 10.10.10.0/24 subnet but can't do the other way around...

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by

                              Lets see your drawing you were going to do ;)

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                              R 1 Reply Last reply Reply Quote 0
                              • R
                                Rupesh @johnpoz
                                last edited by

                                @johnpoz ok removed that 145 network Here is what it looks like now
                                Capture.PNG

                                R 1 Reply Last reply Reply Quote 0
                                • R
                                  Rupesh @Rupesh
                                  last edited by

                                  @Rupesh also this 162.29.149.0/24 network is not under my control. Its my organizational network strictly isolated from internet.

                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by johnpoz

                                    162.29.149 is not RFC1918... WTF dude?

                                    NetRange:       162.29.0.0 - 162.29.255.255
                                    CIDR:           162.29.0.0/16
                                    NetName:        WELLSFARGO-162-29-0-0
                                    

                                    Are you wells fargo? Why are you using that space? Is it yours? Use rfc1918 10.x.x.x, 192.168.x.x, 172.16-31.x.x there is plenty of space to use..

                                    And yeah that is going to a be a asymmetrical nightmare..., Where to the windows machine and the print point to for their gateway? Do they have specific routes on how to get back cto your 10.10.10 network? Is this mikrotik router natting these IPs?

                                    Its my organizational network strictly isolated from internet.

                                    So you are wellsfargo? If not your IT org are a bunch of freaking idiots!!

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                    R 1 Reply Last reply Reply Quote 0
                                    • R
                                      Rupesh @johnpoz
                                      last edited by

                                      @johnpoz yes all routers are natting in here. About the IP addresses for now please consider them to be on class C like 190.xx.xx.xx/24.

                                      R 1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by johnpoz

                                        Doesn't actually matter from a technical point of view as long as your not advertising them out.. .But it is so freaking BORKED!!! you can not just pull public space out your ass and use it internally ;)

                                        Well if that downstream router is natting, then you would have to do port forwards if you want say that PC to create an unsolicited connection into the 10.x.x.x network.

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                        R 3 Replies Last reply Reply Quote 1
                                        • R
                                          Rupesh @Rupesh
                                          last edited by

                                          This post is deleted!
                                          R 1 Reply Last reply Reply Quote 0
                                          • R
                                            Rupesh @Rupesh
                                            last edited by

                                            This post is deleted!
                                            R 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.