LAN with two IP Network.
-
Good it doesn't work for you - because its NONSENSE!
Its like you came here and asking people how to best hit yourself in the head with a hammer.
There is zero point to doing what your asking to do - ZERO.. The only possible time it might make sense is you were in the middle of wanting to migrate to a different address scheme.. Where this would be temp work around until you can change all devices to be on the new network space.
What exactly do you feel this will accomplish.
Pros = NONE
Cons- Slower network, since now all traffic between devices on the 2 different address schemes that are actually on the same physical network will be hairpinned off your router interface.
- Can not run dhcp for either network
- Provides no actual security
- Provides no broadcast or multicast isolation - all devices will still see all broadcasts.
- More complex - as you can see, you can not even get it to work..
-
I was just proving that it works, I was not debating the fact that it's borked and nonsense, people sometimes want the answer without any questions. I would had suggested a VLAN if the op had told us for what was that configuration need for
-
@kiokoman said in LAN with two IP Network.:
people sometimes want the answer without any questions
Those people should use google ;)
Technically you can do it sure - but it makes no sense.. You could also put ketchup on your ice cream - but why would you want too ;)
-
Most commonly this is blocked because rules for 'LANnet' do not include the new subnet, you have to add rules to pass that.
However you say you don't have any firewall rules. Have you actually disabled pf?
Steve
-
Sorry, sorry and sorry, I made a newbie error...
I had the same network on another pfSense interface... :-(
Now It works fine.
Regards and sorry again.
-
@johnpoz sorry, It's for tests purposes.
This network only will have one host sporadically...
Regards
-
Well put that host on the actual network.. What are you trying to "test"?
-
@johnpoz sometimes I need connect a device that send me from another network to test it and I can't change it the IP address.
Because that, I simulate that the device is in the remote network creating a IP Alias as the gateway in the remote network.
Regards
-
So they send you a device with IP address 192.168.42.12 on it for example... And you need to test that.. And you can not change this address?
The proper way to do that would be with a "test" vlan you have for such devices - that you just change the IP range on.
This way you isolate this test device from your actual network.. I would never plug a device someone sends me to "test" directly into my actual network.. It should always be on an isolated "test" network..
-
@johnpoz thanks so much.
They are fiable devices and in this form I don't need to change the config of the switch too.
Regards
-
Why would you need to change anything on the switch? You create a vlan that you use for testing. vlan X, all that needs to be changed is the IP address on the routers interface to match the network on the device.
-
@johnpoz and create the VLAN in the switch and asociate a port to that VLAN to connect the device, isn't it?
Later, yes, only to change the IP Address in the pfSense but first I need create the test VLAN in the switch and in the pfSense.
Regards
-
@kiokoman said in LAN with two IP Network.:
@JKnott i tested it a moment ago on my test-lab and it work ...
I see you are running a virtual machine. Are those two separate virtual machines? I have never tried to run 2 subnets on the same virtual machine, so I can't speak to that. However, I have worked with 2 subnets on a real network, with different devices and I can assure you, you cannot ping between them, unless both subnets appear on the same device.
You have to go back to basics about how routing works. When you try to send a packet to an address, the operating system compares the local address, remote address and subnet mask, to see if the destination is on the same network. If it is, the packet is sent directly. If it's not, then the packet is sent to the router to be sent elsewhere. However, if both networks appear on the same router, it will see both networks are on the same LAN and send an ICMP redirect, telling the source to send direct. But since that doesn't work because of the network address check, you can't send between networks. I verified that by experience many years ago.
There might be something happening with virtual machines that you wouldn't see on a physical network.
Why not fire up Wireshark and see what's actually on the wire when you try that.
-
one was a virtual machine with freebsd, the cmd windows is actually a real pc, my notebook, pfsense is another virtual machine. i perfectly know how routing works, but @viragomann mentioned it on another discussion, plus you are the one that should read the pfsense manual. idk why you are doing the professor on every discussion... I'm out of here.
https://docs.netgate.com/pfsense/en/latest/firewall/virtual-ip-addresses.html?highlight=virtual%20ip#ip-alias
They can also be used to handle multiple subnets on the same interface.
-
The OP didn't mention a virtual machine. As for whether or not it would work on a real network, I know from actual experience, not just theory. When you involve virtual machines, you may introduce something that doesn't exist in real hardware. Now, instead of virtual machines, try on real hardware.
-
@ramses-sevilla said in LAN with two IP Network.:
but first I need create the test VLAN in the switch and in the pfSense.
Yes - this is a given if your going to be "testing" shit ;) - its a one time thing.. Takes 1 minute to setup.. How much time did you waste trying to do it the way your doing it, when a vlan could of been created in less than a minute..
How much time did you waste of others ;)
Even if this was a 1 off, and you have no plans to ever do such a thing again.. It would of been more secure, faster and easier to just create the vlan for your testing... Even if you blow it away when your done...
-
read here @JKnott https://forum.netgate.com/post/945853
Now It works fine.
do you suggest to open a bug report on vmware and one on redmine ? because it seems that netgate wrote something stupid on his manual
-
Testing or recovering a device temporarily like this is about the only time I would use two subnets on one interface. I have done that numerous times in the past. (but it does always feel dirty!
)Steve
