LAN with two IP Network.

ramses.sevilla

Hi everyone,

I have configured the LAN interface in the IP Network 192.168.1.0/24 and all work fine.

But now I need to configure in LAN the IP Network 192.168.5.0/24 too.

I have added the 192.168.5.1/24 (Firewall > Virtual IP > IP Alias) associated to LAN Interface and a rule to LAN Interface permiting any IPv4.

I have configured a PC with the 192.168.5.10/24 and 192.168.5.1 as gateway.

The problem is that I can't do Ping from the 192.168.1.10 to 192.168.5.10 and viceversa, but I can do Ping to 192.168.5.1.

What am I doing wrong?

What would I need to do to forward from 192.168.1.0/0 IP Network to 192.168.5.0/24 IP Network.

Regards

kiokoman

check again the gateway for 192.168.5.10, it must be 192.168.5.1
there is really nothing else to do, if firewall rules are ok it should work. use packet capture to check the traffic

also routing table on pfsense should be similar to this

192.168.5.0/24	link#2	U	11	1500	vmx0	
192.168.5.1	link#2	UHS	0	16384	lo0

JKnott

@ramses-sevilla

While it is possible to have 2 subnets on the same network, as you found out, you can't ping from one subnet to the other. In order to do that, you have to pass through a router, such a pfsense. But when you do that, it will send an ICMP redirect, telling to go directly, but you can't do that, as the subnet mask, etc. won't allow it.

kiokoman

@JKnott i tested it a moment ago on my test-lab and it work ...

ramses.sevilla

@kiokoman said in LAN with two IP Network.:

check again the gateway for 192.168.5.10, it must be 192.168.5.1
there is really nothing else to do, if firewall rules are ok it should work. use packet capture to check the traffic

also routing table on pfsense should be similar to this
192.168.5.0/24	link#2	U	11	1500	vmx0	
192.168.5.1	link#2	UHS	0	16384	lo0

Hi @kiokoman,

I have verified the Gateway in the PC with the IP 192.168.5.10/24 and It's 192.168.10.1 (IP Allias in the pfSense) but don't works.

Regards

kiokoman

the gateway for 192.168.5.10 should be 192.168.5.1, not 192.168.10.1, was it a typo?
anyway maybe you have another firewall on that pc ? windows firewall must be disabled or configured to accept the 192.168.10.0/24 network and vice versa
you are actually on another subnet so windows firewall think it's an outside network and it will block it

johnpoz

@ramses-sevilla said in LAN with two IP Network.:

But now I need to configure in LAN the IP Network 192.168.5.0/24 too.

Your trying to run 2 L3 networks on the same L2? Sorry but Borked!! While technically possible - it is pointless.. You are not providing any security what so ever there since the network are not isolated. So just put them all on the same L3 network. If you have more devices than a /24 is viable for - then use a /23 or /22, etc.

Makes no sense to complex up a network for some sort of perceived isolation - when there isn't any.. Either actually isolate your networks and route/firewall between them - or put them all on the same network.

If you want to have 2 network and firewall between them, then use vlan. Or use physically isolated networks via another interface and dumb switches for each network.

ramses.sevilla

Hi @kiokoman,

It has been a typo

No, the 192.168.5.10 and the 192.168.1.10 don't have Firewalls.

Regards

johnpoz

There is no point to what your doing other then complexing up what is simple.. If your not going to firewall between these networks then there is no point to what your doing - put them all on the same network.

ramses.sevilla

@johnpoz said in LAN with two IP Network.:

@ramses-sevilla said in LAN with two IP Network.:

But now I need to configure in LAN the IP Network 192.168.5.0/24 too.

Your trying to run 2 L3 networks on the same L2? Sorry but Borked!! While technically possible - it is pointless.. You are not providing any security what so ever there since the network are not isolated. So just put them all on the same L3 network. If you have more devices than a /24 is viable for - then use a /23 or /22, etc.

Makes no sense to complex up a network for some sort of perceived isolation - when there isn't any.. Either actually isolate your networks and route/firewall between them - or put them all on the same network.

If you want to have 2 network and firewall between them, then use vlan. Or use physically isolated networks via another interface and dumb switches for each network.

Hi @johnpoz,

Thanks, I know, in this case I only need the pfSense for routing purposes.

Regards,

johnpoz

For why? Your devices are on the same network... There is no point to routing between devices that are on the same network... Your arbitrarily making it complex when there is no point to it.

Why should you bounce traffic off pfsense to talk to a box on the same physical network as you.. Your just making your network slower, more complex and not providing anything.. Its a complete and utter waste of time to even be discussing this..

ramses.sevilla

@kiokoman said in LAN with two IP Network.:

@JKnott i tested it a moment ago on my test-lab and it work ...

Hi @johnpoz,

It doesn't work for me. I don't know why... :-(

Regards

johnpoz

Good it doesn't work for you - because its NONSENSE!

Its like you came here and asking people how to best hit yourself in the head with a hammer.

There is zero point to doing what your asking to do - ZERO.. The only possible time it might make sense is you were in the middle of wanting to migrate to a different address scheme.. Where this would be temp work around until you can change all devices to be on the new network space.

What exactly do you feel this will accomplish.

Pros = NONE
Cons

Slower network, since now all traffic between devices on the 2 different address schemes that are actually on the same physical network will be hairpinned off your router interface.
Can not run dhcp for either network
Provides no actual security
Provides no broadcast or multicast isolation - all devices will still see all broadcasts.
More complex - as you can see, you can not even get it to work..

kiokoman

I was just proving that it works, I was not debating the fact that it's borked and nonsense, people sometimes want the answer without any questions. I would had suggested a VLAN if the op had told us for what was that configuration need for

johnpoz

@kiokoman said in LAN with two IP Network.:

people sometimes want the answer without any questions

Those people should use google ;)

Technically you can do it sure - but it makes no sense.. You could also put ketchup on your ice cream - but why would you want too ;)

stephenw10

Most commonly this is blocked because rules for 'LANnet' do not include the new subnet, you have to add rules to pass that.

However you say you don't have any firewall rules. Have you actually disabled pf?

Steve

ramses.sevilla

Sorry, sorry and sorry, I made a newbie error...

I had the same network on another pfSense interface... :-(

Now It works fine.

Regards and sorry again.

ramses.sevilla

@johnpoz sorry, It's for tests purposes.

This network only will have one host sporadically...

Regards

johnpoz

Well put that host on the actual network.. What are you trying to "test"?

ramses.sevilla

@johnpoz sometimes I need connect a device that send me from another network to test it and I can't change it the IP address.

Because that, I simulate that the device is in the remote network creating a IP Alias as the gateway in the remote network.

Regards