Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    adding link to my shop

    Scheduled Pinned Locked Moved L2/Switching/VLANs
    38 Posts 5 Posters 3.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator
      last edited by johnpoz

      ^ exactly if this shop network is the only thing on igb3, then there is no reason for a "vlan" its just a native, untagged network now... There is no reason to set up a vlan in pfsense for this.

      So you shop network is 192.168.30/24.. This shouldn't be a vlan unless your devices downstream or there is a switch between pfsense and your wifi device that understands vlans and can strip them because I don't you have vlan info setup on your switches and or devices downstream.

      I also have the shop firewall setup to fail over to the T1 line if the link from my house goes down.

      So your using 192.168.1 behind this firewall? And you also use that network in your house??? Yeah that not ideal to be sure!!!

      If that is the case then you should be using transit between your 2 firewalls (both pfsense?) and not natting between these networks, etc. etc. Routes would be setup.. And to your shop firewall connection to house is primary wan, and T1 is backup wan, etc..

      the easiest way to make sure you can get to your wifi devices that your using as transit bridge between house and shop would be to source nat traffic to them from one of the locations that is not their default route, if you can not setup routing on the devices. This way you can get to them from either house or shop if one side is down, etc.

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      1 Reply Last reply Reply Quote 0
      • L
        lovingHDTV
        last edited by

        Yes I do have VLANs in the shop (Guest), and an IOT one, similar to my home.

        5e4c9d45-0dd8-4a00-881f-e2c75ffb05a0-image.png

        Yes I am using 192.168.1.0 behind the shop router and at the house. This was my original concern.

        The primary LAN is not a vlan so I remove the V on that in the picture. The router/firewall in the shop is a Netgear router running Tomato.

        I originally setup the link between the house and the shop as a subnet 10.10.1.0/24, and I could get to the nano beams, but couldn't get the shop to route to the internet. When I changed it to a VLAN I could get routing to the internet, but lost routing to the nano-beams.

        John, I have no idea what your last paragraph is saying. " source nat traffic to them from one of the locations that is not their default route, if you can not setup routing on the devices.", but like the conclusion.

        thanks again,
        david

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by johnpoz

          So your wifi devices 30.115 and 30.116 devices what do they have set for their gateway? Do they have one.. While I have to assume your tomato is natting, which means you wouldn't be able to get to stuff in the shop because its firewalled and you would have to port forward to get to stuff behind your shop firewall.

          So while you would be able to get to the devices from shop network because to the wifi devices you would be coming from shop firewalls IP in the 192.168.30 network... From your house side.. They wouldn't know how to talk to some other network, etc..

          Your current design with a firewall in shop complicates the setup.. But can be configured to do whatever you want to do, not sure about tomato and its limited feature set... But would assume you can disable nat on specific interfaces?

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • L
            lovingHDTV
            last edited by

            The shop router DHCPs and an IP from the home router, it happened to get 192.168.30.3. I can easily make that as static IP if it makes things easier.

            This is what is set as the gateway for the shop devices.

            My home devices get the gateway assigned to the igb2 interface, which is my static IP address.

            I don't need access to the shop devices from the home, but I would like to get access to the nano-beams. I can see that my home firewall passes the requests to the 192.168.30.0 vlan, but I get no response back. Ping just says no response.

            I'd love to be able to remove the double NAT if possible.

            thanks
            david

            1 Reply Last reply Reply Quote 0
            • L
              lovingHDTV
              last edited by

              If I just bridge my WAN to my shop_link, then have the router in the shop do everything, does the bridge impact my other interfaces, or does the bridge only impact the interfaces in the bridge.

              I don't want my LAN interface bridged to my WAN.

              thanks

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by johnpoz

                @lovingHDTV said in adding link to my shop:

                I'd love to be able to remove the double NAT if possible.

                Then do so - why do you think you need this tomato doing nat? Just use it as an AP in your shop put everything on vlan on pfsense in your home = done!

                My drawing from before.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                L 1 Reply Last reply Reply Quote 0
                • L
                  lovingHDTV @johnpoz
                  last edited by

                  @johnpoz I don't want to merge the two networks.

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by johnpoz

                    YOUR NOT!!!! It will be its own vlan!!

                    If you want to still leverage your T1 you could still do that.. And your home could even use it, since you have an L2 network connecting your home and shop via the wifi devices.

                    So now not only would you shop have a failover network with your T1, you could even use it for your home network if your home wan goes out.

                    Your wifi bridge setup is like a wire that runs from your home to your shop... Worse case scenario is if home network goes out, then traffic from shop to your T1 would be going over your wifi to hose connection twice, ie a hairpin.. But since its a T1, and slow as shit, that wouldn't be an issue ;)

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    L 1 Reply Last reply Reply Quote 0
                    • L
                      lovingHDTV @johnpoz
                      last edited by

                      @johnpoz OK I'm confused :)

                      My shop is on the 192.168.1.0 subnet and so is my LAN. I basically created them both the same way.

                      I created a 192.168.30.0 VLAN to get to my shop. If I remove the tomato router, or change it to an AP, that would change my shop to 192.168.30.0 right? So I would have to change everything to that subnet instead of 192.168.1.0. I would also have to manage everything in my shop from pfsense, and I was hoping to keep everything separate.

                      david

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by

                        OMG dude they would be separate.. But yeah you would need to use 2 different IP schemes.. If you want to use 192.168.1 in your shop, and you also want to use 192.168.1 in your house - then you would have to double NAT.. Or you make them the same network and just bridge for firewall between them..

                        Or just simply change one of the IP ranges.. Use 192.168.X in your house, use 192.168.Y in your shop..

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        L 1 Reply Last reply Reply Quote 0
                        • L
                          lovingHDTV @johnpoz
                          last edited by

                          @johnpoz OK thanks.

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.