4. Subnet 192.168.0.0/20(DHCP 192.168.0.x has internet but Static 192.168.1.x dont)

Subnet 192.168.0.0/20(DHCP 192.168.0.x has internet but Static 192.168.1.x dont)

  • V

    I have about 50 devices.
    Home: (5 smart tvs, 5 phones, 5 tablets, 5 laptops, 2 desktops, 10 amazon echo, 20 other smart devices home issue).

    Home office area:
    I have about 20 virtual machines.

    HOME DEVICES + HOME OFFICE share the same SWITCH. THE Switch is connected to a SINGLE NIC (LAN port of pfSense)

    I AM NOT ASSIGNING TWO SEPARATE SUBNETS. I WANT TO BE ABLE TO USE 192.168.0.0/20 for managing all the devices in my home through single LAN interface.

    I JUST WANT THE DHCP TO ASSIGN 192.168.0.100-192.168.0.100 for DHCP devices
    ALL THE OTHER RANGES I WANT TO BE ABLE TO SET MYSELF.

    Previously all the devices were on 192.168.0.1/24 range.

    To separate concerns and enable easy setup I started using range 192.168.0.1/20 on LAN of pfsense (netmask 255.255.240.0 - 4000+ devices)

    pfsense ip: 192.168.0.1/20 (as it shows in the cli)

    Home IP: 192.168.0.100-192.168.0.200/20 (DHCP from pfsense)

    Home Office (I am only using static IPs) : 192.168.1.100 - 192.168.1.200 /20 (I statically assign these).

    Now the issue I am facing is that, 192.168.1.x can't ping pfsense, and vice versa. 192.168.1.x <<–-No Connection--->>192.168.0.1

    On other IPs, I can connect devices from 192.168.1.x/20 <<--->> 192.168.0.x/20 without any issues.

    Additional info:

    192.168.0.1/20 (pfsense) | Single LAN<=> 10G Switch <=>Gig Switch<=>Home (192.168.0.100-192.168.0.100/20) (can access lan/192.168.1.x/pfsense/internet)           
                                                                            ||
                                                                            ===>>Home Office (I use a range of 192.168.1.100-192.168.1.200/20) (able to access lan/ 192.168.0.x) No Pfsense/internet

    I am not using /24 anywhere. All my devices are on /20 subnet. That is why I am confused as to why devices from 192.168.0.x/20 are able to access pfsense/internet But, as soon as I change the IP to any other range such as 192.168.1.x/20, pfsense and internet don't work, yet I have access to the other local devices 192.168.0.0/20

    ADDITIONAL COMMENTS

    I am already using the range 192.168.0.0/20 for all the devices in home and home  office. However for the separation for my concerns, I have set the pfsense DHCP server to give out IPs between 192.168.0.100-192.168.0.200

    The rest of the range I want to be able to use myself by setting static IPs. Especially for VMs, etc.

    I am using single router, single interface and single subnet for this LAN. So all these devices in home and home office are able to connect to each other without a problem. However, the issue is that any of the IP range other than 192.168.0.X is not able to ping pfsense or connect to the internet.

    Can someone please help me connect 192.168.1.x/20 to pfsense so that it can access internet.

    =+=+=+=+=+=+=+=+=+=+FIXED THE PROBLEM=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
    The issue was that an overlooked openVPN configuration was generating 192.168.0.1/24 in OUTBOUND NAT
    Removing this and reloading firewall fixed the ISSUE.
    =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=

    ![pfsense ip.PNG](/public/imported_attachments/1/pfsense ip.PNG)
    ![pfsense ip.PNG_thumb](/public/imported_attachments/1/pfsense ip.PNG_thumb)

    0

  • Your subnets are overlapping.  192.168.0.0 /20 runs from 192.168.0.0 to 192.168.15.255, which completely overlaps 192.168.1.0 /24.  Also, if you are in fact using 192.168.1.0 /20 at home, that is the exact same address space as 192.168.0.0 /20, as the least significant 4 bits of the 3rd octet are masked out to the same value for both ranges.  Since you can't have overlapping networks, it will fail, as you're experiencing.

    0
  • V

    @JKnott:

    Your subnets are overlapping.  192.168.0.0 /20 runs from 192.168.0.0 to 192.168.15.255, which completely overlaps 192.168.1.0 /24.  Also, if you are in fact using 192.168.1.0 /20 at home, that is the exact same address space as 192.168.0.0 /20, as the least significant 4 bits of the 3rd octet are masked out to the same value for both ranges.  Since you can't have overlapping networks, it will fail, as you're experiencing.

    I am a little confused about the overlap. There are no other DHCP servers or routers I am using.

    192.168.0.1/20 (pfsense) <<–>>Home (192.168.0.100-192.168.0.100/20) (able to access lan/ 192.168.1.x/ pfsense / internet)
        |
        --->>Home Office (I use a range of 192.168.1.100-192.168.1.200/20) (able to access lan/ 192.168.0.x) No Pfsense/internet

    I am not using /24 anywhere. All my devices are on /20 subnet. That is why I am confused as to why devices from 192.168.0.x/20 are able to access pfsense/internet But, as soon as I change the IP to any other range such as 192.168.1.x/20, pfsense and internet don't work, yet I have access to the other local devices on 192.168.0.0/20

    0

  • Are u using 2 LAN NICs or everything comes out from a single LAN port?

    0
  • V

    @SammyWoo:

    Are u using 2 LAN NICs or everything comes out from a single LAN port?

    I am only using 1 NIC for LAN. 1 NIC for WAN.
    What would be the point of using 2 NICs in a LAN in a /20 network?

    0

  • I got it.  192.168.0.0 is a CLASS C IP address, by default allowing no more than 256 hosts.  If more hosts are desired you should use class B of 172.16.0.0, or class A of 10.0.0.0.

    Myself I have always used 10.0.0.0 because my old employer did that and ten-zero-zero-zero is so much easier to remember. I remember the time I ran out of IP at /24 and all I did was to tell the users to shut down their PCs before going home, that evening all I did was to change the DHCP from /24 to /23, next day when user turned on their machines BAM.  Easy-peasy.

    0
  • N

    @SammyWoo:

    I got it.  192.168.0.0 is a CLASS C IP address, by default allowing no more than 256 hosts.  If more hosts are desired you should use class B of 172.16.0.0, or class A of 10.0.0.0.

    What is this 1993? There is no difference in using 192.168.0.0/16, 172.16.0.0/12 or 10.0.0.0/8 for private addressing in terms of size, as long as you are not trying to use a /15 in 192.168.0.0/16, for example.

    @SammyWoo:

    Myself I have always used 10.0.0.0 because my old employer did that and ten-zero-zero-zero is so much easier to remember. I remember the time I ran out of IP at /24 and all I did was to tell the users to shut down their PCs before going home, that evening all I did was to change the DHCP from /24 to /23, next day when user turned on their machines BAM.  Easy-peasy.

    You could do that if you used 192.168.0.0/24 as well.

    0
  • N

    @JKnott:

    Your subnets are overlapping.  192.168.0.0 /20 runs from 192.168.0.0 to 192.168.15.255, which completely overlaps 192.168.1.0 /24.  Also, if you are in fact using 192.168.1.0 /20 at home, that is the exact same address space as 192.168.0.0 /20, as the least significant 4 bits of the 3rd octet are masked out to the same value for both ranges.  Since you can't have overlapping networks, it will fail, as you're experiencing.

    This is the answer.

    Keep your "Home" LAN 192.168.0.0/20 = 192.168.0.1 - 192.168.15.254 (Not sure why you need 4094 IPs/Host, but it will work) - IP Calculator link http://jodies.de/ipcalc?host=192.168.0.1&mask1=20&mask2=
    and make your "Home Office"  192.168.16.0/20 = 192.168.16.1 - 192.168.31.254 - IP Calculator link http://jodies.de/ipcalc?host=192.168.16.1&mask1=20&mask2=

    0
  • V

    @SammyWoo:

    I got it.  192.168.0.0 is a CLASS C IP address, by default allowing no more than 256 hosts.  If more hosts are desired you should use class B of 172.16.0.0, or class A of 10.0.0.0.

    Myself I have always used 10.0.0.0 because my old employer did that and ten-zero-zero-zero is so much easier to remember. I remember the time I ran out of IP at /24 and all I did was to tell the users to shut down their PCs before going home, that evening all I did was to change the DHCP from /24 to /23, next day when user turned on their machines BAM.  Easy-peasy.

    Sorry, but you didn't quite get it. I am already using the range 192.168.0.0/20 for all the devices in home and home  office. However for the separation for my concerns, I have set the pfsense DHCP server to give out IPs between 192.168.0.100-192.168.0.200

    The rest of the range I want to be able to use myself by setting static IPs. Especially for VMs, etc.

    I am using single router, single interface and single subnet for this LAN. So all these devices in home and home office are able to connect to each other without a problem. However, the issue is that any of the IP range other than 192.168.0.X is not able to ping pfsense or connect to the internet.

    0
  • V

    @vkad:

    @SammyWoo:

    I got it.  192.168.0.0 is a CLASS C IP address, by default allowing no more than 256 hosts.  If more hosts are desired you should use class B of 172.16.0.0, or class A of 10.0.0.0.

    Myself I have always used 10.0.0.0 because my old employer did that and ten-zero-zero-zero is so much easier to remember. I remember the time I ran out of IP at /24 and all I did was to tell the users to shut down their PCs before going home, that evening all I did was to change the DHCP from /24 to /23, next day when user turned on their machines BAM.  Easy-peasy.

    Sorry, but you didn't quite get it. I am already using the range 192.168.0.0/20 for all the devices in home and home  office. However for the separation for my concerns, I have set the pfsense DHCP server to give out IPs between 192.168.0.100-192.168.0.200

    The rest of the range I want to be able to use myself by setting static IPs. Especially for VMs, etc.

    I am using single router, single interface and single subnet for this LAN. So all these devices in home and home office are able to connect to each other without a problem. However, the issue is that any of the IP range other than 192.168.0.X is not able to ping pfsense or connect to the internet.

    I am already using the range 192.168.0.0/20 for all the devices in home and home  office. However for the separation for my concerns, I have set the pfsense DHCP server to give out IPs between 192.168.0.100-192.168.0.200

    The rest of the range I want to be able to use myself by setting static IPs. Especially for VMs, etc.

    I am using single router, single interface and single subnet for this LAN. So all these devices in home and home office are able to connect to each other without a problem. However, the issue is that any of the IP range other than 192.168.0.X is not able to ping pfsense or connect to the internet.

    0
  • V

    @vkad:

    @SammyWoo:

    I got it.  192.168.0.0 is a CLASS C IP address, by default allowing no more than 256 hosts.  If more hosts are desired you should use class B of 172.16.0.0, or class A of 10.0.0.0.

    Myself I have always used 10.0.0.0 because my old employer did that and ten-zero-zero-zero is so much easier to remember. I remember the time I ran out of IP at /24 and all I did was to tell the users to shut down their PCs before going home, that evening all I did was to change the DHCP from /24 to /23, next day when user turned on their machines BAM.  Easy-peasy.

    Sorry, but you didn't quite get it. I am already using the range 192.168.0.0/20 for all the devices in home and home  office. However for the separation for my concerns, I have set the pfsense DHCP server to give out IPs between 192.168.0.100-192.168.0.200

    The rest of the range I want to be able to use myself by setting static IPs. Especially for VMs, etc.

    I am using single router, single interface and single subnet for this LAN. So all these devices in home and home office are able to connect to each other without a problem. However, the issue is that any of the IP range other than 192.168.0.X is not able to ping pfsense or connect to the internet.

    I am already using the range 192.168.0.0/20 for all the devices in home and home  office. However for the separation for my concerns, I have set the pfsense DHCP server to give out IPs between 192.168.0.100-192.168.0.200

    The rest of the range I want to be able to use myself by setting static IPs. Especially for VMs, etc.

    I am using single router, single interface and single subnet for this LAN. So all these devices in home and home office are able to connect to each other without a problem. However, the issue is that any of the IP range other than 192.168.0.X is not able to ping pfsense or connect to the internet.

    0
  • H

    @vkad:

    To separate concerns and enable easy setup I started using range 192.168.0.1/20 on LAN of pfsense (netmask 255.255.240.0 - 4000+ devices)

    ?? what concerns ?whats more  easy? using a /24 you should have more then enough ip's available if you only have 50 devices + 20 VM's …
    it appears absolutely pointless to use a /20.

    so basically you can ping devices in the same subnet, but you can't ping pfsense ?
    have you rebooted after changing the cidr range ? (perhaps an alias didn't update )
    try checking the lan-firewall rules. (try setting src to any instead of lan_subnet)

    0
  • V

    192.168.0.1/20 (pfsense) | Single LAN<=> 10G Switch <=>Gig Switch<=>Home (192.168.0.100-192.168.0.100/20) (can access lan/192.168.1.x/pfsense/internet)           
                                                                            ||
                                                                            ===>>Home Office (I use a range of 192.168.1.100-192.168.1.200/20) (able to access lan/ 192.168.0.x) No Pfsense/internet

    I am not using /24 anywhere. All my devices are on /20 subnet. That is why I am confused as to why devices from 192.168.0.x/20 are able to access pfsense/internet But, as soon as I change the IP to any other range such as 192.168.1.x/20, pfsense and internet don't work, yet I have access to the other local devices 192.168.0.0/20

    HOME DEVICES + HOME OFFICE share the same SWITCH. THE Switch is connected to a SINGLE NIC (LAN port of pfSense)

    I AM NOT ASSIGNING TWO SEPARATE SUBNETS. I WANT TO BE ABLE TO USE 192.168.0.0/20 for managing all the devices in my home through single LAN interface.

    I JUST WANT THE DHCP TO ASSIGN 192.168.0.100-192.168.0.100 for DHCP devices
    ALL THE OTHER RANGES I WANT TO BE ABLE TO SET MYSELF.

    0
  • Netgate Administrator

    It should work as you have it configured.

    Since it isn't working something is probably not configured as you think it is. A bad subnet mask somewhere maybe. Or a firewall rule set to /24.

    Run a packet capture on LAN when you are trying to ping it from something that's failing; are the pings arriving? Check the firewall logs.

    Steve

    0

  • @vkad:

    @JKnott:

    Your subnets are overlapping.  192.168.0.0 /20 runs from 192.168.0.0 to 192.168.15.255, which completely overlaps 192.168.1.0 /24.  Also, if you are in fact using 192.168.1.0 /20 at home, that is the exact same address space as 192.168.0.0 /20, as the least significant 4 bits of the 3rd octet are masked out to the same value for both ranges.  Since you can't have overlapping networks, it will fail, as you're experiencing.

    I am a little confused about the overlap. There are no other DHCP servers or routers I am using.

    192.168.0.1/20 (pfsense) <<–>>Home (192.168.0.100-192.168.0.100/20) (able to access lan/ 192.168.1.x/ pfsense / internet)
        |
        --->>Home Office (I use a range of 192.168.1.100-192.168.1.200/20) (able to access lan/ 192.168.0.x) No Pfsense/internet

    I am not using /24 anywhere. All my devices are on /20 subnet. That is why I am confused as to why devices from 192.168.0.x/20 are able to access pfsense/internet But, as soon as I change the IP to any other range such as 192.168.1.x/20, pfsense and internet don't work, yet I have access to the other local devices on 192.168.0.0/20

    Sorry, I was thinking you had 2 networks.

    Regardless, the normal practice is to create a subnet large enough for all your devices.  I would think a /24 would suffice though.

    Based on your description, it sounds as though you don't have pfSense configured correctly for the larger network.  On the LAN page, check the prefix selected on the IPv4 address and make sure it's /20

    0

  • @SammyWoo:

    I got it.  192.168.0.0 is a CLASS C IP address, by default allowing no more than 256 hosts.  If more hosts are desired you should use class B of 172.16.0.0, or class A of 10.0.0.0.

    Address classes have been obsolete for many years.  These days we use classless addresses with variable length subnet masks.

    0
  • V

    @stephenw10:

    It should work as you have it configured.

    Since it isn't working something is probably not configured as you think it is. A bad subnet mask somewhere maybe. Or a firewall rule set to /24.

    Run a packet capture on LAN when you are trying to ping it from something that's failing; are the pings arriving? Check the firewall logs.

    Steve

    I know, I have enabled the firewall rule  in System -> Advanced "Bypass firewall rules for traffic on the same interface"
    Additionally, none of the firewall rules use /20 or /24 in them. They just use IP addresses.

    I am assuming that the ping is arriving at pfsense, as the IP randmoly shows in ARP table.

    0
  • V

    @JKnott:

    @vkad:

    @JKnott:

    Your subnets are overlapping.  192.168.0.0 /20 runs from 192.168.0.0 to 192.168.15.255, which completely overlaps 192.168.1.0 /24.  Also, if you are in fact using 192.168.1.0 /20 at home, that is the exact same address space as 192.168.0.0 /20, as the least significant 4 bits of the 3rd octet are masked out to the same value for both ranges.  Since you can't have overlapping networks, it will fail, as you're experiencing.

    I am a little confused about the overlap. There are no other DHCP servers or routers I am using.

    192.168.0.1/20 (pfsense) <<–>>Home (192.168.0.100-192.168.0.100/20) (able to access lan/ 192.168.1.x/ pfsense / internet)
        |
        --->>Home Office (I use a range of 192.168.1.100-192.168.1.200/20) (able to access lan/ 192.168.0.x) No Pfsense/internet

    I am not using /24 anywhere. All my devices are on /20 subnet. That is why I am confused as to why devices from 192.168.0.x/20 are able to access pfsense/internet But, as soon as I change the IP to any other range such as 192.168.1.x/20, pfsense and internet don't work, yet I have access to the other local devices on 192.168.0.0/20

    Sorry, I was thinking you had 2 networks.

    Regardless, the normal practice is to create a subnet large enough for all your devices.  I would think a /24 would suffice though.

    Based on your description, it sounds as though you don't have pfSense configured correctly for the larger network.  On the LAN page, check the prefix selected on the IPv4 address and make sure it's /20

    I know, I have enabled the firewall rule  in System -> Advanced "Bypass firewall rules for traffic on the same interface"
    Additionally, none of the firewall rules use /20 or /24 in them. They just use IP addresses.

    I am assuming that the ping is arriving at pfsense, as the IP randmoly shows in ARP table.

    0
  • V

    @JKnott:

    @vkad:

    @JKnott:

    Your subnets are overlapping.  192.168.0.0 /20 runs from 192.168.0.0 to 192.168.15.255, which completely overlaps 192.168.1.0 /24.  Also, if you are in fact using 192.168.1.0 /20 at home, that is the exact same address space as 192.168.0.0 /20, as the least significant 4 bits of the 3rd octet are masked out to the same value for both ranges.  Since you can't have overlapping networks, it will fail, as you're experiencing.

    I am a little confused about the overlap. There are no other DHCP servers or routers I am using.

    192.168.0.1/20 (pfsense) <<–>>Home (192.168.0.100-192.168.0.100/20) (able to access lan/ 192.168.1.x/ pfsense / internet)
        |
        --->>Home Office (I use a range of 192.168.1.100-192.168.1.200/20) (able to access lan/ 192.168.0.x) No Pfsense/internet

    I am not using /24 anywhere. All my devices are on /20 subnet. That is why I am confused as to why devices from 192.168.0.x/20 are able to access pfsense/internet But, as soon as I change the IP to any other range such as 192.168.1.x/20, pfsense and internet don't work, yet I have access to the other local devices on 192.168.0.0/20

    Sorry, I was thinking you had 2 networks.

    Regardless, the normal practice is to create a subnet large enough for all your devices.  I would think a /24 would suffice though.

    Based on your description, it sounds as though you don't have pfSense configured correctly for the larger network.  On the LAN page, check the prefix selected on the IPv4 address and make sure it's /20

    On LAN page, the subnet is set to /20

    0
  • LAYER 8 Global Moderator

    "I know, I have enabled the firewall rule  in System -> Advanced "Bypass firewall rules for traffic on the same interface""

    What what possible reason would you do that?

    "I am not using /24 anywhere. All my devices are on /20 subnet"

    WHY??? You clearly do not have 4,000 some devices do you??

    As to devices in your /20 not getting internet access that you set as static.  Can they ping pfsense IP 192.168.0.1?  What are you lan rules?  What is your outbound nat?  Did you mess with them from automatic? And maybe you set them to manual or something then changed your mask?  So its only outbound natting portion of your /20

    Just at a loss to the point of using a /20 for a network with a handful of devices on it?  Using a network that is way bigger than required is just pointless.. While sure it will work, it makes no sense to do such a thing.  Shoot even a /24 is way to big for most home networks.  But it makes for easy human understanding of what the network actually is from address space range.  And gives you plenty of space to work with if you want to put some devices in different ranges of the address space.  Using an odd mask leads to mistakes as well.

    You have mentioned using 192.168.0 and 192.168.1 then why would you not just use a /23?

    0
  • V

    @johnpoz:

    "I know, I have enabled the firewall rule  in System -> Advanced "Bypass firewall rules for traffic on the same interface""

    What what possible reason would you do that?

    "I am not using /24 anywhere. All my devices are on /20 subnet"

    WHY??? You clearly do not have 4,000 some devices do you??

    As to devices in your /20 not getting internet access that you set as static.  Can they ping pfsense IP 192.168.0.1?  What are you lan rules?  What is your outbound nat?  Did you mess with them from automatic? And maybe you set them to manual or something then changed your mask?  So its only outbound natting portion of your /20

    Just at a loss to the point of using a /20 for a network with a handful of devices on it?  Using a network that is way bigger than required is just pointless.. While sure it will work, it makes no sense to do such a thing.  Shoot even a /24 is way to big for most home networks.  But it makes for easy human understanding of what the network actually is from address space range.  And gives you plenty of space to work with if you want to put some devices in different ranges of the address space.  Using an odd mask leads to mistakes as well.

    You have mentioned using 192.168.0 and 192.168.1 then why would you not just use a /23?

    If its a static IP in 192.168.0.1-192.168.0.255 then able to ping pfsense/internet works.

    All other ranges cant ping pfsense/no internet. They do show in ARP table randomly. If I change their IP to the 192.168.0.1 range they suddenly work fine.

    0
  • Netgate Administrator

    If you cannot ping the pfSense LAN then either there is a firewall rule blocking it (check the logs, try adding an allow all rule as a test) or a bad route/subnet somewhere.

    Is it possible you're using 192.168.1.0/24 on the WAN side?

    Is your 10GbE switch layer 2 only?

    Can we see some screenshots?

    A packet capture on LAN whilst trying to ping from something in 192.168.1.X would show if pings are arriving and if pfSense is able to respond.

    Steve

    0

  • VKAD, u are making yourself crazy doing something unusual, do u REALLY need 4096 hosts?

    0
Log in to reply
 

Products

Services

Support

News

Resources

Company

Our Mission

We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

Subscribe to our Newsletter

Product information, software announcements, and special offers. See our newsletter archive for past announcements.

© Copyright 2002 - 2019 Rubicon Communications, LLC | Privacy Policy