How to configure pfSense as a router for two internal LAN subnets?
-
A-ha!! :)
I added the second gateway into my machine and I can now ping 10.0.1.4 from 10.0.0.3. Feel like we're making some progress!
However, I can't ping 10.0.1.1 from 10.0.0.3…
What is odd is that I can ping the 10.0.1.1 machine from the LAN interface on pfSense:
-
You converted your WAN to LAB interface?
You have to disable all outbound NAT.
-
NO that is NOT the correct way to do it!!! Create a route to use not a default gateway - arrrgghhh..
-
You converted your WAN to LAB interface?
You have to disable all outbound NAT.
No I converted LAN to LAB interface and converted WAN to LAN interface. Here are my NAT outbound rules:
-
NO that is NOT the correct way to do it!!! Create a route to use not a default gateway - arrrgghhh..
OK, ok! :)
I've done this now and all good from 10.0.0.3 to 10.0.1.1!
I can also now ping from 10.0.1.1 to 10.0.0.3!!
I do however, have one small issue. I can't ping the netgate router (10.0.0.1) from my LAB network. Any ideas on why?
-
Hi everyone, thanks for reading, I still have an issue where no servers on the LAB domain can access the internet. I can't ping the LAN interface of my Netgate WAN router from the LAB network, but I can ping it from the LAN network. Any ideas?
-
Draw a picture of how you have this set up and talk about your ultimate goals.
-
Draw a picture of how you have this set up and talk about your ultimate goals.
OK. :)
Here's the network diagram.
I want pfSense on beryllium to allow traffic both ways between LAN and LAB networks unhindered. It seems that machines in LAB network can't reach some machines in LAN, but machines in LAN can reach all machines in LAB. Here are the results from a machine on each network.
On cowslip.duck.loc
Cannot ping 10.0.0.1, 10.0.0.8 (timed out)
Can ping 10.0.0.10, 10.0.0.4, 10.0.0.3, 10.0.0.9, 10.0.1.1, 10.0.1.4On lithium.duck.loc
Can ping everywhere fineHere are the firewall rules on beryllium.localdomain
-
All working now, I needed a static route to the LAB network on the SG-1000 router. Thanks for looking everyone!!
-
"I needed a static route to the LAB network on the SG-1000 router."
If your network is how you drew it you have asymmetrical setup.. If you want to use use your sg1000 router to get to the internet it should be on a transit network to your downstream router.. You shouldn't be using 10.0.0 as your transit or your going to have to put host routes on all boxes on that network..
-
Hmmm…
My SG-1000 only has two interfaces, so how would this work in practise? Would I have to create a VLAN for the transit network?
-
Using VLANs for that is fine but you must have a VLAN capable switch that can demux the tagged trunk traffic to selected switch ports.
-
@mewsense said in How to configure pfSense as a router for two internal LAN subnets?:
All working now, I needed a static route to the LAB network on the SG-1000 router. Thanks for looking everyone!!
May you please do elaborate on this solution?
Thank you
-
If you have a downstream (internal) router with other subnets behind it pfSense needs static route to those so it knows where to route traffic.
https://docs.netgate.com/pfsense/en/latest/routing/static.html#example-static-route
