Multi physical interface with same subnet



  • I have a configuration with 2 lan on 2 physical interfaces because my 2 lan have the same subnet and machines on LAN 1 and LAN 2 can have the same IP address.
    See joined picture.

    I know I can put 2 routers pfsense on the box between WLAN, LAN1 and LAN2, but can I put only one?
    And if it's possible, what will be the configuration?

    Note that I search on this forum before posting and I can't find my answer.


  • LAYER 8 Global Moderator

    Huh??  Doesn't work that way..

    Change lan 2 to 192.168.20 or something..



  • @johnpoz:

    Huh??  Doesn't work that way..

    Change lan 2 to 192.168.20 or something..

    I can't  :(
    My (very old) machines have fixed IP…
    I think it works at least with 2 routers with NAT, you don't think so?  :-[
    Like below.
    But with only one pfsense?



  • LAYER 8 Global Moderator

    Yeah you can isolate them on to different networks, and nat them into a common network.. But you have machines with the same exact IP??  That you can not change?  Sorry but my curiosity kat is meowing at that one ;)



  • My (very old) machines have fixed IP…

    My network experience goes back to 1978 and on a lot of different systems.  I don't think I've ever seen something where an address couldn't be changed.  If someone actually created such a device, they should be shot for incompetence.  ;)


  • LAYER 8 Global Moderator

    Yeah same here.. I was working in networking and computers before there was IP… Have never seen such a thing - even in manufacturing and test equipment.

    Only thing I can think of some sort of license tied to an IP.

    I remember like it was yesterday having to go around and install tcp/ip on the windows 3.11 machines as we were moving to that from ipx/spx


  • Galactic Empire

    @johnpoz:

    Yeah same here.. I was working in networking and computers before there was IP

    Apollo Token Ring, IPX & Appletalk here :)



  • @NogBadTheBad:

    @johnpoz:

    Yeah same here.. I was working in networking and computers before there was IP

    Apollo Token Ring, IPX & Appletalk here :)

    The first LAN I worked on was part of the Air Canada reservation system in Toronto.  It used time division multiplexing, that is time slots, instead of packets.  A device with data to send was assigned (usually permanently) a time slot to transmit and the destination would then listen on that time slot.  There were 2 networks.  The main "TDX" ring ran 8 Mb/s over tri-axial cable and the older TDM ring, 2 Mb over coax.
    Even on that ancient equipment, it was possible to change the device address.



  • Yes, you are right, it's possible to change the IP on these machine, but I can't as they are not mine and the owner doesn't want to. It seems complicated for him (old machine), and after use it on my network he wants to use it with this address without changing anything.

    Any idea if it's possible to use only 1 router for this config?
    Even if my configuration seems strange for you  :o


  • LAYER 8 Netgate

    How? When the router has a packet for 192.168.10.1 how is it supposed to know which interface to send it on?

    Tell your customer what's what.



  • @Derelict:

    How? When the router has a packet for 192.168.10.1 how is it supposed to know which interface to send it on?

    Tell your customer what's what.

    Well, machine can't be accessed by wan or the other lan, so if the router can NAT each machine differently knowing that machine are on different lan and interface…



  • Yes, you are right, it's possible to change the IP on these machine, but I can't as they are not mine and the owner doesn't want to. It seems complicated for him (old machine), and after use it on my network he wants to use it with this address without changing anything.

    Well, it's then your responsibility to advise him.  Wishful thinking doesn't get very far, when it contradicts reality.



  • @jaf:

    @Derelict:

    How? When the router has a packet for 192.168.10.1 how is it supposed to know which interface to send it on?

    Tell your customer what's what.

    Well, machine can't be accessed by wan or the other lan, so if the router can NAT each machine differently knowing that machine are on different lan and interface…

    NAT still has to know which interface to use.  If the same address is on both sides, how does it work?


  • LAYER 8 Global Moderator

    So let me get this right… There are more than one machine, and they both have 192.168.10.1 and you want to give them both internet access.  And you think it would be easier to run 2 pfsense boxes vs just having them change the IP of the one of these machines?

    At a total loss here..
    "the owner doesn't want to"

    Then tell him he can not be on your network ;)

    What is the relationship here - are you the customer, he is the customer?  Do you need this on your network, or does the owner?



  • @johnpoz:

    So let me get this right… There are more than one machine, and they both have 192.168.10.1 and you want to give them both internet access.  And you think it would be easier to run 2 pfsense boxes vs just having them change the IP of the one of these machines?

    At a total loss here..
    "the owner doesn't want to"

    Then tell him he can not be on your network ;)

    What is the relationship here - are you the customer, he is the customer?  Do you need this on your network, or does the owner?

    Yes, he is my customer, and customer is king…


  • LAYER 8 Global Moderator

    He is your customer.. Why would he think he could connect to a network and not change the IP on multiple machines all having the same IP?  So while he is king, he is also mentally challenged when it comes to networking..

    Why is the box not just dhcp?  I mean really set it to dhcp and there you go done..  You can have as many boxes then without any issue.



  • Yes, he is my customer, and customer is king…

    And if what he wants is impossible?  Assuming you set up NAT.  You will have 2 devices with the same IP address, but on opposite sides of it.  When the device behind NAT has traffic for it's twin on the outside, it will never leave that device, as it will assume it for itself.  When some other device has traffic for the device behind NAT, NAT will then have to decide which way to send the traffic.  It does this by comparing the destination address with the network addresses.  If both networks have the same address, there is absolutely no way for NAT to know which way to send that traffic.  What that customer wants is impossible.  King or not he has to be told and hopefully you won't lose your head!  ;)


  • LAYER 8 Global Moderator

    Its not impossible just stupid… You would have to it like he showed with different nat device for very box that wants to use 192.168.10.1 so you could nat it to a different network..

    Each box would have to be isolated from each other on their own network with a different nat box.  Utterly moronic...



  • @johnpoz:

    He is your customer.. Why would he think he could connect to a network and not change the IP on multiple machines all having the same IP?  So while he is king, he is also mentally challenged when it comes to networking..

    Why is the box not just dhcp?  I mean really set it to dhcp and there you go done..  You can have as many boxes then without any issue.

    Sorry, I can't give here the full context of my customer. But believe me, if I ask this question, it's because I really need this configuration. If I can do it differently, I will do!

    What that customer wants is impossible.  King or not he has to be told and hopefully you won't lose your head!  ;)

    Sorry, I don't understand why it's impossible. Do you agree it's possible at least with 2 routers?
    If not, I don't understand what's the purpose of lan with NAT if all lan must have strictly different subnet and address?


  • LAYER 8 Global Moderator

    You can do it - you would just need a box to nat every single box that wants to use the same address so you can put them all on different networks.



  • Sorry, I don't understand why it's impossible. Do you agree it's possible at least with 2 routers?
    If not, I don't understand what's the purpose of lan with NAT if all lan must have strictly different subnet and address?

    You need to understand how a device knows whether to use a router or direct connection to another device.  It is based on the IP address, the network address and the subnet mask.  The network address is determined by doing a logical AND of the host address and subnet mask.  This leaves only the network address.  Then, when the device wants to send traffic to another, it again uses the subnet mask to determine whether the other device is on the same network or reachable through a router.  If the other device has the same network address, it is assumed to be on the local network and the router, NAT or otherwise, will not be used.  This means that it is impossible for anything from that device to ever reach the network on the other side of the router, since both sides have the same network address.

    You'll have to advise your customer that what he wants is not possible.  There's no way around it.

    BTW, NAT was created to get around the IPv4 address shortage, though it's sometimes used to merge networks.


  • LAYER 8 Global Moderator

    where did he say he was using same address on both sides?



  • @johnpoz:

    where did he say he was using same address on both sides?

    In the first post.

    I have a configuration with 2 lan on 2 physical interfaces because my 2 lan have the same subnet and machines on LAN 1 and LAN 2 can have the same IP address.


  • LAYER 8 Global Moderator

    Agreed he can not do that with 1 pfsense.  But he can do it with two - the picture he posted..

    As long as the common wan network is different than 192.168.10 then he can attach multiple 192.168.10 devices to this common network via different nat boxes..  See attached example




  • So it seems I have my answer of my question asked on the first post.
    It's impossible with 1 pfsense, I need 2.
    Thanks.


  • LAYER 8 Global Moderator

    I said you could do it back n post #3
    https://forum.pfsense.org/index.php?topic=144526.msg786761#msg786761

    But you would need multiple nat boxes to do it.



  • @johnpoz:

    Agreed he can not do that with 1 pfsense.  But he can do it with two - the picture he posted..

    As long as the common wan network is different than 192.168.10 then he can attach multiple 192.168.10 devices to this common network via different nat boxes..  See attached example

    Will the computer on the left ever have to communicate with the one on the right?  Depending on what else is on the network, there could be some real FUN with port forwarding.  Regardless, it seems like a lot of trouble to avoid changing an IP address.



  • @JKnott:

    Will the computer on the left ever have to communicate with the one on the right?

    No I say that on this post : https://forum.pfsense.org/index.php?topic=144526.msg786831#msg786831
    @johnpoz:

    I said you could do it back n post #3
    https://forum.pfsense.org/index.php?topic=144526.msg786761#msg786761

    But you would need multiple nat boxes to do it.

    My initial question was to know if it's possible with only 1 pfsense.
    I didn't know if this "strange case" can be solve by 1 pfsense, it seems it's too strange to be implemented.  :-\


  • LAYER 8 Global Moderator

    You can not use 1 pfsense and have interfaces on the same network, and also have devices on this network having the same IP..

    Now if the IPs were different and you just needed to leverage connections to pfsense that could be done via bridge the ports..

    So if your machines/devices had IPs say 192.168.10.1 and 192.168.10.2 then you could bridge 2 interfaces on pfsense and that would work.  But in such a case its easier to just use a switch if you need multiple connections, etc. ;)



  • It's all down to routing. Imagine if you had the same subnet, for example 192.168.1.0/24, on two different interfaces. The routing table would have two entries for the same subnet like:

    
    Destination     Gateway
    192.168.1.0/24	link#1 ....
    192.168.1.0/24	link#2 ....
    
    

    If the system would be now asked to forward a packet to host 192.168.1.100 that is on the first (link#1) network, would it be able to decide which link (interface) to use? The answer is an absolute no because both entries in the routing table are equally wide (/24) so there is no way to decide which link to use.


  • LAYER 8 Global Moderator

    In such a scenario it "could" (in theory) be possible if the routing device also looked in its arp table and said own 192.168.1.100 is connected to link2..  But where you for sure have a problem is in his scenario both devices have the same IP… So there are 2 192.168.1.100..

    His proposed setup is borked for sure.. The correct solution would be to change 1 of the segments to a different L3 scheme.  Or if you want single L2 to make sure devices all have different IPs in the L3 addressing your using on that L2



  • @kpa:

    It's all down to routing. Imagine if you had the same subnet, for example 192.168.1.0/24, on two different interfaces. The routing table would have two entries for the same subnet like:

    
    Destination     Gateway
    192.168.1.0/24	link#1 ....
    192.168.1.0/24	link#2 ....
    
    

    If the system would be now asked to forward a packet to host 192.168.1.100 that is on the first (link#1) network, would it be able to decide which link (interface) to use? The answer is an absolute no because both entries in the routing table are equally wide (/24) so there is no way to decide which link to use.

    The only possible solution would still require at least a different IP address.  Then there could be a specific route to the device and then the routing longest path match would work.  The device would also need to be configured with a suitable subnet mask, so that it knew other devices in the same network were elsewhere.  Even then it's still a messy solution to a problem that could be avoided entirely by changing the address to a different subnet.


  • LAYER 8 Netgate

    or a metric, etc.



  • @jaf:

    if it's possible with only 1 pfsense.

    Definitely no.

    @jaf:

    …it seems it's too strange to be implemented.

    It's technically not possible to do something like that with one device.

    Imagine putting two green apples on one table. Now tell your customer to "grab the green apple".
    He just doesn't know which one.
    Same for an IP packet. It just doesn't know if it should take the left or the right route to one of two devices with the exact same address. Routing doesn't work this way.



  • @jahonix:

    @jaf:

    if it's possible with only 1 pfsense.

    Definitely no.

    @jaf:

    …it seems it's too strange to be implemented.

    It's technically not possible to do something like that with one device.

    Imagine putting two green apples on one table. Now tell your customer to "grab the green apple".
    He just doesn't know which one.
    Same for an IP packet. It just doesn't know if it should take the left or the right route to one of two devices with the exact same address. Routing doesn't work this way.

    Well, if it's possible to do it on 2 devices, maybe it's possible to virtualize it on 1, no?
    But I agree you must have at least 2 IP address on the wan (like you have with 2 devices) to make the difference for the 2 green apples.
    But anyway, it's to uncommon to implement something like that all in once, so I can use 2 (in reality for my project more than 2).


  • LAYER 8 Netgate

    Of course you could virtualize two pfSenses on one physical to do the same job as two physicals.



  • @Derelict:

    Of course you could virtualize two pfSenses on one physical to do the same job as two physicals.

    I wanted to say, making one VM that you call "pfsenseMulti", containing an implementation of pfsense containing all that in once, with a smart HMI like pfsense  :)



  • @jahonix:

    It's technically not possible to do something like that with one device.

    @jaf:

    … it's to uncommon to implement something like that all in once...

    @jaf:

    …implementation of pfsense containing all that in once...

    Just out of sheer curiosity: you cannot understand or you don't want to believe that technically this is not possible?



  • I think the problem is that my English is not so good, and my explanation not clear. :(
    Or maybe I'm an idiot? I hope not.

    And yes, I don't understand how it can be technically impossible to develop a VM integrating the 2 devices solution, and developing a special HMI to control all that. After, you call this VM "pfsenseMulti".


  • LAYER 8 Global Moderator

    Huh?
    You can for sure have a VM host box and put as many Pfsense VMS on it as you your host can support from memory and horse power..

    The point is you can not have the same IP on the same network and expect it to work..  How you put them on different networks is up to you.. Be it virtual routers or physical ones.


Log in to reply