Static Routing on Additional Lan Gateway
-
you need a static route on the other side like 10.10.10.0/24 with gateway 196.29.149.99 if there isn't already one
-
@kiokoman do you mean i need to create that static route on my pfsense? or mikrotik? I did try to create a additional gateway on lan interface with ip 10.10.10.150. and setup a static route 196.29.149.0/24 pointing to gateway 10.10.10.150. I added the firewall rule for the same as well.
however if i do "route add 196.29.149.0/24 10.10.10.150" on my windows machine in 10.10.10.0/24 subnet then it works without any problem.
-
the yellow line is what it's doing now
the red, what it should beif the gateway for the network is 196.29.149.36 than you have to tell that device to send the traffic back to 196.29.149.99
@Rupesh said in Static Routing on Additional Lan Gateway:
however if i do "route add 196.29.149.0/24 10.10.10.150" on my windows machine in 10.10.10.0/24 subnet then it works without any problem.
of course, you have to define that route inside 196.29.149.36 whatever it is
-
Not going to mater if natted.. Not going to work... For unsolicated traffic from the 196 network towards the 10 network. He would have to do port forwarding. When he is coming from the 10 network to the 196 network - say the printer the traffic would be natted so it looks to be coming from the router 196.29.149.99 address.
And the devices in that 10 network should have host routes going to the 196 network pointing to 10.10.10.150, or he needs to use an actual transit network.
-
@kiokoman That region inst my concern i just want to get access to printer and one windows share pc. The red line is pointing to my organistion gateway. moreover internal ip of my organization gateway 196.29.149.36 is in the same subnet as my mikrotik external IP(196.29.149.99) so shouldn't be any problem. Also if i remove my pfsense and set default gateway and dns to 10.10.10.150, then everything is resolved.
-
@johnpoz now in both the senarios explained in diagrams below everything is working without any problems. I didn't touch mikrotik router at all.
-
So now you have a transit, so not asymmetrical.. your other way with clients just pointing to the mikrotik works too..
You don't need any return routes in the 196 network, since your natting all traffic from your 10 network to the 196.29.149.99 address of your mikrotik router.. So the clients in this network think they are just talking to the ip in their own network.
-
-
@johnpoz can you please point out where should i make changes and what changes to make this work.
-
your way with the transit is all you need.. Setup a gateway to the 196 network on pfsense. And then you would need return on the mikrotik if using transit.
Your device in the 196 don't need any routes, nor your wan enterprise router because you are natting at the mikrotik
-
-
@johnpoz said in Static Routing on Additional Lan Gateway:
your way with the transit is all you need.. Setup a gateway to the 196 network on pfsense. And then you would need return on the mikrotik if using transit.
Your device in the 196 don't need any routes, nor your wan enterprise router because you are natting at the mikrotik
Yes i did add that static route to 196.29.149.0/24 after adding a 10.10.10.150 gateway on lan interface. Post that i made a rule to pass the traffic for 196.29.149.0/24 network through 10.10.10.150 gateway..
-
@Rupesh said in Static Routing on Additional Lan Gateway:
@johnpoz said in Static Routing on Additional Lan Gateway:
your way with the transit is all you need.. Setup a gateway to the 196 network on pfsense. And then you would need return on the mikrotik if using transit.
Your device in the 196 don't need any routes, nor your wan enterprise router because you are natting at the mikrotik
Yes i did add that static route to 196.29.149.0/24 after adding a 10.10.10.150 gateway on lan interface. Post that i made a rule to pass the traffic for 196.29.149.0/24 network through 10.10.10.150 gateway..
and this is why i am not getting what i am expecting.. i mentioned this is in the first post
-
ok.. so if the gateway on the microtik is 149.36 you need to add a static route on the mikrotik for the 10.10.10.0/24 network .. ?
-
@kiokoman said in Static Routing on Additional Lan Gateway:
ok.. so if the gateway on the microtik is 149.36 you need to add a static route on the mikrotik for the 10.10.10.0/24 network .. ?
correction !! gateway o mikrotik 192.168.149.36.
On my PF sense firewall I tried to add additional gateway 10.10.10.150 on LAN and added static route for 196.29.149.0/24 network also i added one firewall LAN rule to pass traffic from LAN net to 196.29.149.0/24 with gateway as 10.10.10.150 in advanced settings.
after all this setup i am able to open windows share as desired but whenever i am trying to move files from 10.10.10.0/24 network to windows share it just says "failed" after keeping coping window in preparing mode for sometime. However if i copy data from windows share to 10.10.10.0/24 side then its flawless.
also i can open the printer webpage with no issue..its just that unable to copy data from pf-sense LAN network to miKkotik wan network.moreover if i set a new pf sense firewall with cloud core router as wan gateway and wan ip as 10.10.10.90/24 then everything gets resolved, so for sure this inst an issue of Mikrotik cloud-core router.
-
OMG.... Where did your transit go?? YOU have an asymmetrical mess
Create a transit network between pfsense and mikrotik like you had before..
-
@johnpoz said in Static Routing on Additional Lan Gateway:
OMG.... Where did your transit go?? YOU have an asymmetrical mess
Ohh now I see...
So What is your solution about this? What is the point of having another gateway in LAN interface...Point to be noted "I had setup static route for desired network this LAN gateway".
-
route on pfsense to 172.16.0.1 to get to 196.29 network
route on mikrotek to get to 10 network 172.16.0.2This is basic 101 networking - there is nothing fancy about this..
If your going to put clients on a transit network then you have to use host routing or source natting, or your going to have issues with asymmetrical traffic... Hosts do not belong on a transit network!!!
No natting will be done between 10.x and 172.16
-
@johnpoz said in Static Routing on Additional Lan Gateway:
route on pfsense to 172.16.0.1 to get to 196.29 network
route on mikrotek to get to 10 network 172.16.0.2This is basic 101 networking - there is nothing fancy about this..
If your going to put clients on a transit network then you have to use host routing or source natting, or your going to have issues with asymmetrical traffic... Hosts do not belong on a transit network!!!
No natting will be done between 10.x and 172.16
So I need to create a transit network ?
-
YES!!!! unless you want to create routes on all your devices in the 10 telling them how to get to the 196 network so your not asymmetrical...
