Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Subnet 192.168.0.0/20(DHCP 192.168.0.x has internet but Static 192.168.1.x dont)

    Scheduled Pinned Locked Moved General pfSense Questions
    23 Posts 7 Posters 4.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • V
      vkad
      last edited by

      I have about 50 devices.
      Home: (5 smart tvs, 5 phones, 5 tablets, 5 laptops, 2 desktops, 10 amazon echo, 20 other smart devices home issue).

      Home office area:
      I have about 20 virtual machines.

      HOME DEVICES + HOME OFFICE share the same SWITCH. THE Switch is connected to a SINGLE NIC (LAN port of pfSense)

      I AM NOT ASSIGNING TWO SEPARATE SUBNETS. I WANT TO BE ABLE TO USE 192.168.0.0/20 for managing all the devices in my home through single LAN interface.

      I JUST WANT THE DHCP TO ASSIGN 192.168.0.100-192.168.0.100 for DHCP devices
      ALL THE OTHER RANGES I WANT TO BE ABLE TO SET MYSELF.

      Previously all the devices were on 192.168.0.1/24 range.

      To separate concerns and enable easy setup I started using range 192.168.0.1/20 on LAN of pfsense (netmask 255.255.240.0 - 4000+ devices)

      pfsense ip: 192.168.0.1/20 (as it shows in the cli)

      Home IP: 192.168.0.100-192.168.0.200/20 (DHCP from pfsense)

      Home Office (I am only using static IPs) : 192.168.1.100 - 192.168.1.200 /20 (I statically assign these).

      Now the issue I am facing is that, 192.168.1.x can't ping pfsense, and vice versa. 192.168.1.x <<–-No Connection--->>192.168.0.1

      On other IPs, I can connect devices from 192.168.1.x/20 <<--->> 192.168.0.x/20 without any issues.


      Additional info:

      192.168.0.1/20 (pfsense) | Single LAN<=> 10G Switch <=>Gig Switch<=>Home (192.168.0.100-192.168.0.100/20) (can access lan/192.168.1.x/pfsense/internet)           
                                                                              ||
                                                                              ===>>Home Office (I use a range of 192.168.1.100-192.168.1.200/20) (able to access lan/ 192.168.0.x) No Pfsense/internet

      I am not using /24 anywhere. All my devices are on /20 subnet. That is why I am confused as to why devices from 192.168.0.x/20 are able to access pfsense/internet But, as soon as I change the IP to any other range such as 192.168.1.x/20, pfsense and internet don't work, yet I have access to the other local devices 192.168.0.0/20

      ADDITIONAL COMMENTS

      I am already using the range 192.168.0.0/20 for all the devices in home and home  office. However for the separation for my concerns, I have set the pfsense DHCP server to give out IPs between 192.168.0.100-192.168.0.200

      The rest of the range I want to be able to use myself by setting static IPs. Especially for VMs, etc.

      I am using single router, single interface and single subnet for this LAN. So all these devices in home and home office are able to connect to each other without a problem. However, the issue is that any of the IP range other than 192.168.0.X is not able to ping pfsense or connect to the internet.

      Can someone please help me connect 192.168.1.x/20 to pfsense so that it can access internet.

      =+=+=+=+=+=+=+=+=+=+FIXED THE PROBLEM=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
      The issue was that an overlooked openVPN configuration was generating 192.168.0.1/24 in OUTBOUND NAT
      Removing this and reloading firewall fixed the ISSUE.
      =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=

      ![pfsense ip.PNG](/public/imported_attachments/1/pfsense ip.PNG)
      ![pfsense ip.PNG_thumb](/public/imported_attachments/1/pfsense ip.PNG_thumb)

      1 Reply Last reply Reply Quote 0
      • JKnottJ
        JKnott
        last edited by

        Your subnets are overlapping.  192.168.0.0 /20 runs from 192.168.0.0 to 192.168.15.255, which completely overlaps 192.168.1.0 /24.  Also, if you are in fact using 192.168.1.0 /20 at home, that is the exact same address space as 192.168.0.0 /20, as the least significant 4 bits of the 3rd octet are masked out to the same value for both ranges.  Since you can't have overlapping networks, it will fail, as you're experiencing.

        PfSense running on Qotom mini PC
        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
        UniFi AC-Lite access point

        I haven't lost my mind. It's around here...somewhere...

        1 Reply Last reply Reply Quote 0
        • V
          vkad
          last edited by

          @JKnott:

          Your subnets are overlapping.  192.168.0.0 /20 runs from 192.168.0.0 to 192.168.15.255, which completely overlaps 192.168.1.0 /24.  Also, if you are in fact using 192.168.1.0 /20 at home, that is the exact same address space as 192.168.0.0 /20, as the least significant 4 bits of the 3rd octet are masked out to the same value for both ranges.  Since you can't have overlapping networks, it will fail, as you're experiencing.

          I am a little confused about the overlap. There are no other DHCP servers or routers I am using.

          192.168.0.1/20 (pfsense) <<–>>Home (192.168.0.100-192.168.0.100/20) (able to access lan/ 192.168.1.x/ pfsense / internet)
              |
              --->>Home Office (I use a range of 192.168.1.100-192.168.1.200/20) (able to access lan/ 192.168.0.x) No Pfsense/internet

          I am not using /24 anywhere. All my devices are on /20 subnet. That is why I am confused as to why devices from 192.168.0.x/20 are able to access pfsense/internet But, as soon as I change the IP to any other range such as 192.168.1.x/20, pfsense and internet don't work, yet I have access to the other local devices on 192.168.0.0/20

          1 Reply Last reply Reply Quote 0
          • SammyWooS
            SammyWoo
            last edited by

            Are u using 2 LAN NICs or everything comes out from a single LAN port?

            1 Reply Last reply Reply Quote 0
            • V
              vkad
              last edited by

              @SammyWoo:

              Are u using 2 LAN NICs or everything comes out from a single LAN port?

              I am only using 1 NIC for LAN. 1 NIC for WAN.
              What would be the point of using 2 NICs in a LAN in a /20 network?

              1 Reply Last reply Reply Quote 0
              • SammyWooS
                SammyWoo
                last edited by

                I got it.  192.168.0.0 is a CLASS C IP address, by default allowing no more than 256 hosts.  If more hosts are desired you should use class B of 172.16.0.0, or class A of 10.0.0.0.

                Myself I have always used 10.0.0.0 because my old employer did that and ten-zero-zero-zero is so much easier to remember. I remember the time I ran out of IP at /24 and all I did was to tell the users to shut down their PCs before going home, that evening all I did was to change the DHCP from /24 to /23, next day when user turned on their machines BAM.  Easy-peasy.

                1 Reply Last reply Reply Quote 0
                • N
                  Napsterbater
                  last edited by

                  @SammyWoo:

                  I got it.  192.168.0.0 is a CLASS C IP address, by default allowing no more than 256 hosts.  If more hosts are desired you should use class B of 172.16.0.0, or class A of 10.0.0.0.

                  What is this 1993? There is no difference in using 192.168.0.0/16, 172.16.0.0/12 or 10.0.0.0/8 for private addressing in terms of size, as long as you are not trying to use a /15 in 192.168.0.0/16, for example.

                  @SammyWoo:

                  Myself I have always used 10.0.0.0 because my old employer did that and ten-zero-zero-zero is so much easier to remember. I remember the time I ran out of IP at /24 and all I did was to tell the users to shut down their PCs before going home, that evening all I did was to change the DHCP from /24 to /23, next day when user turned on their machines BAM.  Easy-peasy.

                  You could do that if you used 192.168.0.0/24 as well.

                  1 Reply Last reply Reply Quote 0
                  • N
                    Napsterbater
                    last edited by

                    @JKnott:

                    Your subnets are overlapping.  192.168.0.0 /20 runs from 192.168.0.0 to 192.168.15.255, which completely overlaps 192.168.1.0 /24.  Also, if you are in fact using 192.168.1.0 /20 at home, that is the exact same address space as 192.168.0.0 /20, as the least significant 4 bits of the 3rd octet are masked out to the same value for both ranges.  Since you can't have overlapping networks, it will fail, as you're experiencing.

                    This is the answer.

                    Keep your "Home" LAN 192.168.0.0/20 = 192.168.0.1 - 192.168.15.254 (Not sure why you need 4094 IPs/Host, but it will work) - IP Calculator link http://jodies.de/ipcalc?host=192.168.0.1&mask1=20&mask2=
                    and make your "Home Office"  192.168.16.0/20 = 192.168.16.1 - 192.168.31.254 - IP Calculator link http://jodies.de/ipcalc?host=192.168.16.1&mask1=20&mask2=

                    1 Reply Last reply Reply Quote 0
                    • V
                      vkad
                      last edited by

                      @SammyWoo:

                      I got it.  192.168.0.0 is a CLASS C IP address, by default allowing no more than 256 hosts.  If more hosts are desired you should use class B of 172.16.0.0, or class A of 10.0.0.0.

                      Myself I have always used 10.0.0.0 because my old employer did that and ten-zero-zero-zero is so much easier to remember. I remember the time I ran out of IP at /24 and all I did was to tell the users to shut down their PCs before going home, that evening all I did was to change the DHCP from /24 to /23, next day when user turned on their machines BAM.  Easy-peasy.

                      Sorry, but you didn't quite get it. I am already using the range 192.168.0.0/20 for all the devices in home and home  office. However for the separation for my concerns, I have set the pfsense DHCP server to give out IPs between 192.168.0.100-192.168.0.200

                      The rest of the range I want to be able to use myself by setting static IPs. Especially for VMs, etc.

                      I am using single router, single interface and single subnet for this LAN. So all these devices in home and home office are able to connect to each other without a problem. However, the issue is that any of the IP range other than 192.168.0.X is not able to ping pfsense or connect to the internet.

                      1 Reply Last reply Reply Quote 0
                      • V
                        vkad
                        last edited by

                        @vkad:

                        @SammyWoo:

                        I got it.  192.168.0.0 is a CLASS C IP address, by default allowing no more than 256 hosts.  If more hosts are desired you should use class B of 172.16.0.0, or class A of 10.0.0.0.

                        Myself I have always used 10.0.0.0 because my old employer did that and ten-zero-zero-zero is so much easier to remember. I remember the time I ran out of IP at /24 and all I did was to tell the users to shut down their PCs before going home, that evening all I did was to change the DHCP from /24 to /23, next day when user turned on their machines BAM.  Easy-peasy.

                        Sorry, but you didn't quite get it. I am already using the range 192.168.0.0/20 for all the devices in home and home  office. However for the separation for my concerns, I have set the pfsense DHCP server to give out IPs between 192.168.0.100-192.168.0.200

                        The rest of the range I want to be able to use myself by setting static IPs. Especially for VMs, etc.

                        I am using single router, single interface and single subnet for this LAN. So all these devices in home and home office are able to connect to each other without a problem. However, the issue is that any of the IP range other than 192.168.0.X is not able to ping pfsense or connect to the internet.

                        I am already using the range 192.168.0.0/20 for all the devices in home and home  office. However for the separation for my concerns, I have set the pfsense DHCP server to give out IPs between 192.168.0.100-192.168.0.200

                        The rest of the range I want to be able to use myself by setting static IPs. Especially for VMs, etc.

                        I am using single router, single interface and single subnet for this LAN. So all these devices in home and home office are able to connect to each other without a problem. However, the issue is that any of the IP range other than 192.168.0.X is not able to ping pfsense or connect to the internet.

                        1 Reply Last reply Reply Quote 0
                        • V
                          vkad
                          last edited by

                          @vkad:

                          @SammyWoo:

                          I got it.  192.168.0.0 is a CLASS C IP address, by default allowing no more than 256 hosts.  If more hosts are desired you should use class B of 172.16.0.0, or class A of 10.0.0.0.

                          Myself I have always used 10.0.0.0 because my old employer did that and ten-zero-zero-zero is so much easier to remember. I remember the time I ran out of IP at /24 and all I did was to tell the users to shut down their PCs before going home, that evening all I did was to change the DHCP from /24 to /23, next day when user turned on their machines BAM.  Easy-peasy.

                          Sorry, but you didn't quite get it. I am already using the range 192.168.0.0/20 for all the devices in home and home  office. However for the separation for my concerns, I have set the pfsense DHCP server to give out IPs between 192.168.0.100-192.168.0.200

                          The rest of the range I want to be able to use myself by setting static IPs. Especially for VMs, etc.

                          I am using single router, single interface and single subnet for this LAN. So all these devices in home and home office are able to connect to each other without a problem. However, the issue is that any of the IP range other than 192.168.0.X is not able to ping pfsense or connect to the internet.

                          I am already using the range 192.168.0.0/20 for all the devices in home and home  office. However for the separation for my concerns, I have set the pfsense DHCP server to give out IPs between 192.168.0.100-192.168.0.200

                          The rest of the range I want to be able to use myself by setting static IPs. Especially for VMs, etc.

                          I am using single router, single interface and single subnet for this LAN. So all these devices in home and home office are able to connect to each other without a problem. However, the issue is that any of the IP range other than 192.168.0.X is not able to ping pfsense or connect to the internet.

                          1 Reply Last reply Reply Quote 0
                          • H
                            heper
                            last edited by

                            @vkad:

                            To separate concerns and enable easy setup I started using range 192.168.0.1/20 on LAN of pfsense (netmask 255.255.240.0 - 4000+ devices)

                            ?? what concerns ?whats more  easy? using a /24 you should have more then enough ip's available if you only have 50 devices + 20 VM's …
                            it appears absolutely pointless to use a /20.

                            so basically you can ping devices in the same subnet, but you can't ping pfsense ?
                            have you rebooted after changing the cidr range ? (perhaps an alias didn't update )
                            try checking the lan-firewall rules. (try setting src to any instead of lan_subnet)

                            1 Reply Last reply Reply Quote 0
                            • V
                              vkad
                              last edited by

                              192.168.0.1/20 (pfsense) | Single LAN<=> 10G Switch <=>Gig Switch<=>Home (192.168.0.100-192.168.0.100/20) (can access lan/192.168.1.x/pfsense/internet)           
                                                                                                      ||
                                                                                                      ===>>Home Office (I use a range of 192.168.1.100-192.168.1.200/20) (able to access lan/ 192.168.0.x) No Pfsense/internet

                              I am not using /24 anywhere. All my devices are on /20 subnet. That is why I am confused as to why devices from 192.168.0.x/20 are able to access pfsense/internet But, as soon as I change the IP to any other range such as 192.168.1.x/20, pfsense and internet don't work, yet I have access to the other local devices 192.168.0.0/20

                              HOME DEVICES + HOME OFFICE share the same SWITCH. THE Switch is connected to a SINGLE NIC (LAN port of pfSense)

                              I AM NOT ASSIGNING TWO SEPARATE SUBNETS. I WANT TO BE ABLE TO USE 192.168.0.0/20 for managing all the devices in my home through single LAN interface.

                              I JUST WANT THE DHCP TO ASSIGN 192.168.0.100-192.168.0.100 for DHCP devices
                              ALL THE OTHER RANGES I WANT TO BE ABLE TO SET MYSELF.

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                It should work as you have it configured.

                                Since it isn't working something is probably not configured as you think it is. A bad subnet mask somewhere maybe. Or a firewall rule set to /24.

                                Run a packet capture on LAN when you are trying to ping it from something that's failing; are the pings arriving? Check the firewall logs.

                                Steve

                                1 Reply Last reply Reply Quote 0
                                • JKnottJ
                                  JKnott
                                  last edited by

                                  @vkad:

                                  @JKnott:

                                  Your subnets are overlapping.  192.168.0.0 /20 runs from 192.168.0.0 to 192.168.15.255, which completely overlaps 192.168.1.0 /24.  Also, if you are in fact using 192.168.1.0 /20 at home, that is the exact same address space as 192.168.0.0 /20, as the least significant 4 bits of the 3rd octet are masked out to the same value for both ranges.  Since you can't have overlapping networks, it will fail, as you're experiencing.

                                  I am a little confused about the overlap. There are no other DHCP servers or routers I am using.

                                  192.168.0.1/20 (pfsense) <<–>>Home (192.168.0.100-192.168.0.100/20) (able to access lan/ 192.168.1.x/ pfsense / internet)
                                      |
                                      --->>Home Office (I use a range of 192.168.1.100-192.168.1.200/20) (able to access lan/ 192.168.0.x) No Pfsense/internet

                                  I am not using /24 anywhere. All my devices are on /20 subnet. That is why I am confused as to why devices from 192.168.0.x/20 are able to access pfsense/internet But, as soon as I change the IP to any other range such as 192.168.1.x/20, pfsense and internet don't work, yet I have access to the other local devices on 192.168.0.0/20

                                  Sorry, I was thinking you had 2 networks.

                                  Regardless, the normal practice is to create a subnet large enough for all your devices.  I would think a /24 would suffice though.

                                  Based on your description, it sounds as though you don't have pfSense configured correctly for the larger network.  On the LAN page, check the prefix selected on the IPv4 address and make sure it's /20

                                  PfSense running on Qotom mini PC
                                  i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                  UniFi AC-Lite access point

                                  I haven't lost my mind. It's around here...somewhere...

                                  1 Reply Last reply Reply Quote 0
                                  • JKnottJ
                                    JKnott
                                    last edited by

                                    @SammyWoo:

                                    I got it.  192.168.0.0 is a CLASS C IP address, by default allowing no more than 256 hosts.  If more hosts are desired you should use class B of 172.16.0.0, or class A of 10.0.0.0.

                                    Address classes have been obsolete for many years.  These days we use classless addresses with variable length subnet masks.

                                    PfSense running on Qotom mini PC
                                    i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                    UniFi AC-Lite access point

                                    I haven't lost my mind. It's around here...somewhere...

                                    1 Reply Last reply Reply Quote 0
                                    • V
                                      vkad
                                      last edited by

                                      @stephenw10:

                                      It should work as you have it configured.

                                      Since it isn't working something is probably not configured as you think it is. A bad subnet mask somewhere maybe. Or a firewall rule set to /24.

                                      Run a packet capture on LAN when you are trying to ping it from something that's failing; are the pings arriving? Check the firewall logs.

                                      Steve

                                      I know, I have enabled the firewall rule  in System -> Advanced "Bypass firewall rules for traffic on the same interface"
                                      Additionally, none of the firewall rules use /20 or /24 in them. They just use IP addresses.

                                      I am assuming that the ping is arriving at pfsense, as the IP randmoly shows in ARP table.

                                      1 Reply Last reply Reply Quote 0
                                      • V
                                        vkad
                                        last edited by

                                        @JKnott:

                                        @vkad:

                                        @JKnott:

                                        Your subnets are overlapping.  192.168.0.0 /20 runs from 192.168.0.0 to 192.168.15.255, which completely overlaps 192.168.1.0 /24.  Also, if you are in fact using 192.168.1.0 /20 at home, that is the exact same address space as 192.168.0.0 /20, as the least significant 4 bits of the 3rd octet are masked out to the same value for both ranges.  Since you can't have overlapping networks, it will fail, as you're experiencing.

                                        I am a little confused about the overlap. There are no other DHCP servers or routers I am using.

                                        192.168.0.1/20 (pfsense) <<–>>Home (192.168.0.100-192.168.0.100/20) (able to access lan/ 192.168.1.x/ pfsense / internet)
                                            |
                                            --->>Home Office (I use a range of 192.168.1.100-192.168.1.200/20) (able to access lan/ 192.168.0.x) No Pfsense/internet

                                        I am not using /24 anywhere. All my devices are on /20 subnet. That is why I am confused as to why devices from 192.168.0.x/20 are able to access pfsense/internet But, as soon as I change the IP to any other range such as 192.168.1.x/20, pfsense and internet don't work, yet I have access to the other local devices on 192.168.0.0/20

                                        Sorry, I was thinking you had 2 networks.

                                        Regardless, the normal practice is to create a subnet large enough for all your devices.  I would think a /24 would suffice though.

                                        Based on your description, it sounds as though you don't have pfSense configured correctly for the larger network.  On the LAN page, check the prefix selected on the IPv4 address and make sure it's /20

                                        I know, I have enabled the firewall rule  in System -> Advanced "Bypass firewall rules for traffic on the same interface"
                                        Additionally, none of the firewall rules use /20 or /24 in them. They just use IP addresses.

                                        I am assuming that the ping is arriving at pfsense, as the IP randmoly shows in ARP table.

                                        1 Reply Last reply Reply Quote 0
                                        • V
                                          vkad
                                          last edited by

                                          @JKnott:

                                          @vkad:

                                          @JKnott:

                                          Your subnets are overlapping.  192.168.0.0 /20 runs from 192.168.0.0 to 192.168.15.255, which completely overlaps 192.168.1.0 /24.  Also, if you are in fact using 192.168.1.0 /20 at home, that is the exact same address space as 192.168.0.0 /20, as the least significant 4 bits of the 3rd octet are masked out to the same value for both ranges.  Since you can't have overlapping networks, it will fail, as you're experiencing.

                                          I am a little confused about the overlap. There are no other DHCP servers or routers I am using.

                                          192.168.0.1/20 (pfsense) <<–>>Home (192.168.0.100-192.168.0.100/20) (able to access lan/ 192.168.1.x/ pfsense / internet)
                                              |
                                              --->>Home Office (I use a range of 192.168.1.100-192.168.1.200/20) (able to access lan/ 192.168.0.x) No Pfsense/internet

                                          I am not using /24 anywhere. All my devices are on /20 subnet. That is why I am confused as to why devices from 192.168.0.x/20 are able to access pfsense/internet But, as soon as I change the IP to any other range such as 192.168.1.x/20, pfsense and internet don't work, yet I have access to the other local devices on 192.168.0.0/20

                                          Sorry, I was thinking you had 2 networks.

                                          Regardless, the normal practice is to create a subnet large enough for all your devices.  I would think a /24 would suffice though.

                                          Based on your description, it sounds as though you don't have pfSense configured correctly for the larger network.  On the LAN page, check the prefix selected on the IPv4 address and make sure it's /20

                                          On LAN page, the subnet is set to /20

                                          1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator
                                            last edited by

                                            "I know, I have enabled the firewall rule  in System -> Advanced "Bypass firewall rules for traffic on the same interface""

                                            What what possible reason would you do that?

                                            "I am not using /24 anywhere. All my devices are on /20 subnet"

                                            WHY??? You clearly do not have 4,000 some devices do you??

                                            As to devices in your /20 not getting internet access that you set as static.  Can they ping pfsense IP 192.168.0.1?  What are you lan rules?  What is your outbound nat?  Did you mess with them from automatic? And maybe you set them to manual or something then changed your mask?  So its only outbound natting portion of your /20

                                            Just at a loss to the point of using a /20 for a network with a handful of devices on it?  Using a network that is way bigger than required is just pointless.. While sure it will work, it makes no sense to do such a thing.  Shoot even a /24 is way to big for most home networks.  But it makes for easy human understanding of what the network actually is from address space range.  And gives you plenty of space to work with if you want to put some devices in different ranges of the address space.  Using an odd mask leads to mistakes as well.

                                            You have mentioned using 192.168.0 and 192.168.1 then why would you not just use a /23?

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.