Multi physical interface with same subnet
-
Yes, you are right, it's possible to change the IP on these machine, but I can't as they are not mine and the owner doesn't want to. It seems complicated for him (old machine), and after use it on my network he wants to use it with this address without changing anything.
Any idea if it's possible to use only 1 router for this config?
Even if my configuration seems strange for you :o -
How? When the router has a packet for 192.168.10.1 how is it supposed to know which interface to send it on?
Tell your customer what's what.
-
How? When the router has a packet for 192.168.10.1 how is it supposed to know which interface to send it on?
Tell your customer what's what.
Well, machine can't be accessed by wan or the other lan, so if the router can NAT each machine differently knowing that machine are on different lan and interface…
-
Yes, you are right, it's possible to change the IP on these machine, but I can't as they are not mine and the owner doesn't want to. It seems complicated for him (old machine), and after use it on my network he wants to use it with this address without changing anything.
Well, it's then your responsibility to advise him. Wishful thinking doesn't get very far, when it contradicts reality.
-
@jaf:
How? When the router has a packet for 192.168.10.1 how is it supposed to know which interface to send it on?
Tell your customer what's what.
Well, machine can't be accessed by wan or the other lan, so if the router can NAT each machine differently knowing that machine are on different lan and interface…
NAT still has to know which interface to use. If the same address is on both sides, how does it work?
-
So let me get this right… There are more than one machine, and they both have 192.168.10.1 and you want to give them both internet access. And you think it would be easier to run 2 pfsense boxes vs just having them change the IP of the one of these machines?
At a total loss here..
"the owner doesn't want to"Then tell him he can not be on your network ;)
What is the relationship here - are you the customer, he is the customer? Do you need this on your network, or does the owner?
-
So let me get this right… There are more than one machine, and they both have 192.168.10.1 and you want to give them both internet access. And you think it would be easier to run 2 pfsense boxes vs just having them change the IP of the one of these machines?
At a total loss here..
"the owner doesn't want to"Then tell him he can not be on your network ;)
What is the relationship here - are you the customer, he is the customer? Do you need this on your network, or does the owner?
Yes, he is my customer, and customer is king…
-
He is your customer.. Why would he think he could connect to a network and not change the IP on multiple machines all having the same IP? So while he is king, he is also mentally challenged when it comes to networking..
Why is the box not just dhcp? I mean really set it to dhcp and there you go done.. You can have as many boxes then without any issue.
-
Yes, he is my customer, and customer is king…
And if what he wants is impossible? Assuming you set up NAT. You will have 2 devices with the same IP address, but on opposite sides of it. When the device behind NAT has traffic for it's twin on the outside, it will never leave that device, as it will assume it for itself. When some other device has traffic for the device behind NAT, NAT will then have to decide which way to send the traffic. It does this by comparing the destination address with the network addresses. If both networks have the same address, there is absolutely no way for NAT to know which way to send that traffic. What that customer wants is impossible. King or not he has to be told and hopefully you won't lose your head! ;)
-
Its not impossible just stupid… You would have to it like he showed with different nat device for very box that wants to use 192.168.10.1 so you could nat it to a different network..
Each box would have to be isolated from each other on their own network with a different nat box. Utterly moronic...
-
He is your customer.. Why would he think he could connect to a network and not change the IP on multiple machines all having the same IP? So while he is king, he is also mentally challenged when it comes to networking..
Why is the box not just dhcp? I mean really set it to dhcp and there you go done.. You can have as many boxes then without any issue.
Sorry, I can't give here the full context of my customer. But believe me, if I ask this question, it's because I really need this configuration. If I can do it differently, I will do!
What that customer wants is impossible. King or not he has to be told and hopefully you won't lose your head! ;)
Sorry, I don't understand why it's impossible. Do you agree it's possible at least with 2 routers?
If not, I don't understand what's the purpose of lan with NAT if all lan must have strictly different subnet and address? -
You can do it - you would just need a box to nat every single box that wants to use the same address so you can put them all on different networks.
-
Sorry, I don't understand why it's impossible. Do you agree it's possible at least with 2 routers?
If not, I don't understand what's the purpose of lan with NAT if all lan must have strictly different subnet and address?You need to understand how a device knows whether to use a router or direct connection to another device. It is based on the IP address, the network address and the subnet mask. The network address is determined by doing a logical AND of the host address and subnet mask. This leaves only the network address. Then, when the device wants to send traffic to another, it again uses the subnet mask to determine whether the other device is on the same network or reachable through a router. If the other device has the same network address, it is assumed to be on the local network and the router, NAT or otherwise, will not be used. This means that it is impossible for anything from that device to ever reach the network on the other side of the router, since both sides have the same network address.
You'll have to advise your customer that what he wants is not possible. There's no way around it.
BTW, NAT was created to get around the IPv4 address shortage, though it's sometimes used to merge networks.
-
where did he say he was using same address on both sides?
-
where did he say he was using same address on both sides?
In the first post.
I have a configuration with 2 lan on 2 physical interfaces because my 2 lan have the same subnet and machines on LAN 1 and LAN 2 can have the same IP address.
-
Agreed he can not do that with 1 pfsense. But he can do it with two - the picture he posted..
As long as the common wan network is different than 192.168.10 then he can attach multiple 192.168.10 devices to this common network via different nat boxes.. See attached example
-
So it seems I have my answer of my question asked on the first post.
It's impossible with 1 pfsense, I need 2.
Thanks. -
I said you could do it back n post #3
https://forum.pfsense.org/index.php?topic=144526.msg786761#msg786761But you would need multiple nat boxes to do it.
-
Agreed he can not do that with 1 pfsense. But he can do it with two - the picture he posted..
As long as the common wan network is different than 192.168.10 then he can attach multiple 192.168.10 devices to this common network via different nat boxes.. See attached example
Will the computer on the left ever have to communicate with the one on the right? Depending on what else is on the network, there could be some real FUN with port forwarding. Regardless, it seems like a lot of trouble to avoid changing an IP address.
-
Will the computer on the left ever have to communicate with the one on the right?
No I say that on this post : https://forum.pfsense.org/index.php?topic=144526.msg786831#msg786831
@johnpoz:I said you could do it back n post #3
https://forum.pfsense.org/index.php?topic=144526.msg786761#msg786761But you would need multiple nat boxes to do it.
My initial question was to know if it's possible with only 1 pfsense.
I didn't know if this "strange case" can be solve by 1 pfsense, it seems it's too strange to be implemented. :-\