LAN with two IP Network.
-
@ramses-sevilla said in LAN with two IP Network.:
But now I need to configure in LAN the IP Network 192.168.5.0/24 too.
Your trying to run 2 L3 networks on the same L2? Sorry but Borked!! While technically possible - it is pointless.. You are not providing any security what so ever there since the network are not isolated. So just put them all on the same L3 network. If you have more devices than a /24 is viable for - then use a /23 or /22, etc.
Makes no sense to complex up a network for some sort of perceived isolation - when there isn't any.. Either actually isolate your networks and route/firewall between them - or put them all on the same network.
If you want to have 2 network and firewall between them, then use vlan. Or use physically isolated networks via another interface and dumb switches for each network.
-
Hi @kiokoman,
It has been a typo
No, the 192.168.5.10 and the 192.168.1.10 don't have Firewalls.
Regards
-
There is no point to what your doing other then complexing up what is simple.. If your not going to firewall between these networks then there is no point to what your doing - put them all on the same network.
-
@johnpoz said in LAN with two IP Network.:
@ramses-sevilla said in LAN with two IP Network.:
But now I need to configure in LAN the IP Network 192.168.5.0/24 too.
Your trying to run 2 L3 networks on the same L2? Sorry but Borked!! While technically possible - it is pointless.. You are not providing any security what so ever there since the network are not isolated. So just put them all on the same L3 network. If you have more devices than a /24 is viable for - then use a /23 or /22, etc.
Makes no sense to complex up a network for some sort of perceived isolation - when there isn't any.. Either actually isolate your networks and route/firewall between them - or put them all on the same network.
If you want to have 2 network and firewall between them, then use vlan. Or use physically isolated networks via another interface and dumb switches for each network.
Hi @johnpoz,
Thanks, I know, in this case I only need the pfSense for routing purposes.
Regards,
-
For why? Your devices are on the same network... There is no point to routing between devices that are on the same network... Your arbitrarily making it complex when there is no point to it.
Why should you bounce traffic off pfsense to talk to a box on the same physical network as you.. Your just making your network slower, more complex and not providing anything.. Its a complete and utter waste of time to even be discussing this..
-
@kiokoman said in LAN with two IP Network.:
@JKnott i tested it a moment ago on my test-lab and it work ...
Hi @johnpoz,
It doesn't work for me. I don't know why... :-(
Regards
-
Good it doesn't work for you - because its NONSENSE!
Its like you came here and asking people how to best hit yourself in the head with a hammer.
There is zero point to doing what your asking to do - ZERO.. The only possible time it might make sense is you were in the middle of wanting to migrate to a different address scheme.. Where this would be temp work around until you can change all devices to be on the new network space.
What exactly do you feel this will accomplish.
Pros = NONE
Cons- Slower network, since now all traffic between devices on the 2 different address schemes that are actually on the same physical network will be hairpinned off your router interface.
- Can not run dhcp for either network
- Provides no actual security
- Provides no broadcast or multicast isolation - all devices will still see all broadcasts.
- More complex - as you can see, you can not even get it to work..
-
I was just proving that it works, I was not debating the fact that it's borked and nonsense, people sometimes want the answer without any questions. I would had suggested a VLAN if the op had told us for what was that configuration need for
-
@kiokoman said in LAN with two IP Network.:
people sometimes want the answer without any questions
Those people should use google ;)
Technically you can do it sure - but it makes no sense.. You could also put ketchup on your ice cream - but why would you want too ;)
-
Most commonly this is blocked because rules for 'LANnet' do not include the new subnet, you have to add rules to pass that.
However you say you don't have any firewall rules. Have you actually disabled pf?
Steve
-
Sorry, sorry and sorry, I made a newbie error...
I had the same network on another pfSense interface... :-(
Now It works fine.
Regards and sorry again.
-
@johnpoz sorry, It's for tests purposes.
This network only will have one host sporadically...
Regards
-
Well put that host on the actual network.. What are you trying to "test"?
-
@johnpoz sometimes I need connect a device that send me from another network to test it and I can't change it the IP address.
Because that, I simulate that the device is in the remote network creating a IP Alias as the gateway in the remote network.
Regards
-
So they send you a device with IP address 192.168.42.12 on it for example... And you need to test that.. And you can not change this address?
The proper way to do that would be with a "test" vlan you have for such devices - that you just change the IP range on.
This way you isolate this test device from your actual network.. I would never plug a device someone sends me to "test" directly into my actual network.. It should always be on an isolated "test" network..
-
@johnpoz thanks so much.
They are fiable devices and in this form I don't need to change the config of the switch too.
Regards
-
Why would you need to change anything on the switch? You create a vlan that you use for testing. vlan X, all that needs to be changed is the IP address on the routers interface to match the network on the device.
-
@johnpoz and create the VLAN in the switch and asociate a port to that VLAN to connect the device, isn't it?
Later, yes, only to change the IP Address in the pfSense but first I need create the test VLAN in the switch and in the pfSense.
Regards
-
@kiokoman said in LAN with two IP Network.:
@JKnott i tested it a moment ago on my test-lab and it work ...
I see you are running a virtual machine. Are those two separate virtual machines? I have never tried to run 2 subnets on the same virtual machine, so I can't speak to that. However, I have worked with 2 subnets on a real network, with different devices and I can assure you, you cannot ping between them, unless both subnets appear on the same device.
You have to go back to basics about how routing works. When you try to send a packet to an address, the operating system compares the local address, remote address and subnet mask, to see if the destination is on the same network. If it is, the packet is sent directly. If it's not, then the packet is sent to the router to be sent elsewhere. However, if both networks appear on the same router, it will see both networks are on the same LAN and send an ICMP redirect, telling the source to send direct. But since that doesn't work because of the network address check, you can't send between networks. I verified that by experience many years ago.
There might be something happening with virtual machines that you wouldn't see on a physical network.
Why not fire up Wireshark and see what's actually on the wire when you try that.
-
one was a virtual machine with freebsd, the cmd windows is actually a real pc, my notebook, pfsense is another virtual machine. i perfectly know how routing works, but @viragomann mentioned it on another discussion, plus you are the one that should read the pfsense manual. idk why you are doing the professor on every discussion... I'm out of here.
https://docs.netgate.com/pfsense/en/latest/firewall/virtual-ip-addresses.html?highlight=virtual%20ip#ip-alias
They can also be used to handle multiple subnets on the same interface.
