Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Balance on a block of IPs

    Scheduled Pinned Locked Moved General pfSense Questions
    7 Posts 3 Posters 684 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • L
      laidback_01
      last edited by

      hello all. I've purchased an XG-1537, and while I await delivery, I've got what I think is a simple question.

      We have a 1G line from Spectrum. It's on a 10G SFP if that makes any difference. They've assigned us a block of IPs. We have upwards of 200 clients utilizing this connection, and we want to make sure the outbound data doesn't all appear to come from one IP. So... what's the best way to 'balance' the outbound IPs ?

      thanks much!

      1 Reply Last reply Reply Quote 0
      • JKnottJ
        JKnott
        last edited by

        Are you using NAT or are there enough addresses for everyone? If the latter, then there's nothing to do other than don't use NAT.

        PfSense running on Qotom mini PC
        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
        UniFi AC-Lite access point

        I haven't lost my mind. It's around here...somewhere...

        1 Reply Last reply Reply Quote 0
        • L
          laidback_01
          last edited by

          yes, I'll be using NAT. The overall concept here is 3 buildings (residential rentals) connected to a single datacenter. These buildings are loosely affiliated, and they will be in separate VLANs as they have no need to chat to each other save via email - which will be hosted in the datacenter. However, the people in these buildings wish to use Netflix and related media services. So... to keep Netflix from thinking there are too many people using the same IP, I'd like to ensure IP rotation or balance among connections. Hope this makes sense.

          1 Reply Last reply Reply Quote 0
          • jimpJ
            jimp Rebel Alliance Developer Netgate
            last edited by

            You can do that with hybrid or manual outbound NAT rules. You can setup an alias containing the IP addresses from the block you want to use for outbound NAT, and then setup outbound NAT rules to translate from the inside network(s) to that alias.

            Depending on how the IP addresses are delivered to you, you might need to make some VIPs for them. If the addresses are a part of your WAN subnet, you'll need VIPs. If they are routed to you through a different WAN subnet, then you don't need VIPs.

            Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

            Need help fast? Netgate Global Support!

            Do not Chat/PM for help!

            1 Reply Last reply Reply Quote 0
            • L
              laidback_01
              last edited by

              I totally forgot about IP Aliases and how you can group them. that's perfect! thanks much ;)

              1 Reply Last reply Reply Quote 0
              • L
                laidback_01
                last edited by

                @jimp said in Balance on a block of IPs:

                Depending on how the IP addresses are delivered to you, you might need to make some VIPs for them. If the addresses are a part of your WAN subnet, you'll need VIPs. If they are routed to you through a different WAN subnet, then you don't need VIPs.

                i'm afraid I don't understand the 'why' or 'how' of this. I just logged into one of my personal pfSense boxes, and I have a alias for 'Win10BlockList' for IPs I don't want the Win10 machines chatting with. Okay, so using that as an example, I went to 'Virtual IPs' in the Firewall menu, and begin the process of adding one. I can see no way to assign a VIP to the Alias. would you mind pointing me at the documentation which shows this?

                thanks much!

                1 Reply Last reply Reply Quote 0
                • jimpJ
                  jimp Rebel Alliance Developer Netgate
                  last edited by

                  There is no direct relationship between VIPs and aliases.

                  The aliases collect addresses to use in firewall/NAT rules and so on.

                  VIPs setup alternate addresses on the interface, for example to inform an upstream router on the same segment that the firewall will handle traffic for that address. See https://www.netgate.com/docs/pfsense/firewall/virtual-ip-address-feature-comparison.html

                  Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                  Need help fast? Netgate Global Support!

                  Do not Chat/PM for help!

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post
                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.