Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Routing in 3 local lan

    Scheduled Pinned Locked Moved Routing and Multi WAN
    13 Posts 2 Posters 1.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • faxmodemF
      faxmodem
      last edited by

      hi
      What should I use static route to connect the following networks?

      pfsense config:
      lan 1 : 172.21.1.1
      wan: adsl modem :192.168.1.1

      lan2 : 172.21.2.1
      lan3 : 172.21.3.1

      I used to use kerio control before
      And I was doing the following
      routing > add : microsft static route >>>> 172.16.0.0 mask 255.240.0.0 172.21.1.1

      How do I add this routine in pf?

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        Why would you think you need to create routes.. If those networks are directly attached to pfsense it knows that.. No need to create any routes..

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        faxmodemF 1 Reply Last reply Reply Quote 0
        • faxmodemF
          faxmodem @johnpoz
          last edited by

          @johnpoz
          Each one in a city that is linked by the intranet

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by johnpoz

            You want to just route to rfc1918 space over the public internet? Oh you said intranet..

            So this is your company network than.. Connected via point to point, mpls ?

            So those are via downstream routers off pfsense lan? That is going to lead to asymmetrical traffic flow.. You would connect other networks via transit network... Can you draw up your network please and we can work out the details.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            faxmodemF 1 Reply Last reply Reply Quote 0
            • faxmodemF
              faxmodem @johnpoz
              last edited by faxmodem

              @johnpoz
              They are connected through the telecommunications lines of these cities. I want to use this server to control traffic and the Internet, but when I launch DHCP, I can not ping other IPs of other companies in other cities.
              When I used KerioControl, I used the following method and had no problem

              https://imgur.com/NtO4eSg

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by johnpoz

                Dude please draw up your network.

                You list pfsense lan as 172.21.1.1, you can not route to that to get to other networks..

                routing > add : microsft static route >>>> 172.16.0.0 mask 255.240.0.0 172.21.1.1

                When you create a route you are saying - hey go to this "ROUTER" at this IP to get to network XYZ... What device is at 172.21.1.1?? if that is connected via your lan network you list above

                Now it might of worked with whatever you were using before - but I can tell you for sure that if you route to other networks via your lan network. Any traffic between hosts on that lan network and other networks is going to be asymmetrical and a PROBLEM with a stateful firewall.. And besides that just messy and not optimal and also hairpins for no reason at all, etc. etc..

                So from that image... Looks like to me you were just handing out a host route to the clients saying hey to get to 172.16/12 - but your default gateway was 172.16.21.10..

                But from above you look like you made pfsense ip 172.21.1.1 - Which is the IP address of whatever other router gets to your other networks.

                Please draw up your network.. So we can fix this... You do not need to host route when you can just connect a transit network to pfsense... Then you could actually firewall between these other networks and your clients, etc. etc.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                faxmodemF 1 Reply Last reply Reply Quote 0
                • faxmodemF
                  faxmodem @johnpoz
                  last edited by

                  @johnpoz
                  Thank you for your guide
                  I used the following method. My problem was solved. Maybe I did it badly
                  Advanced DHCP Options
                  0_1540919026115_Untitled.png

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by johnpoz

                    yeah that is WRONG way to go about what your doing.. Adding routes on every host is not an optimal solution when you can just do it at the default router with simple config.

                    And that route makes NO sense.. your routing 172.16.0.0/32 to your default router.. That sure and the hell is not doing anything.

                    Why can you not break out the crayons and draw your network on a napkin so we can discuss the correct way to do this?

                    BTW your clients are using a mask of /16... So 172.21.X would all be on the local network.. So no your client would never send anything to default router if it thinks the network is local... Please just draw up your networks and their masks and how they are connected to you so we can FIX the clear mess you have.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 1
                    • faxmodemF
                      faxmodem
                      last edited by

                      Good time
                      I posted an overview of the network to you
                      0_1540919281065_Diagram.png
                      This network configuration is up to 172.30.1.0/16

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by johnpoz

                        172.21.1/16 and 172.21.2/16 are the SAME network.. Do you really have 65,000 some devices

                        172.21.1/24 and 172.21.2/24 would be different networks.. Are you saying that is 1 flat layer 2 network??

                        What is telecommunication line??? You have to have some device?? That connects these cities.. How is it your job to set this up??

                        Is this some sort of school work you have been assigned... Nobody could be this clueless and be responsible for setting this up..

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        faxmodemF 1 Reply Last reply Reply Quote 0
                        • faxmodemF
                          faxmodem @johnpoz
                          last edited by

                          @johnpoz
                          Yes, networks are in different cities with different IPs.
                          Each city has its own IP.
                          The communication lines are mpls.
                          The link between cities is via Cisco devices on the mpls

                          Each city has its own separate internal network that is connected with this suffering with other citys

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by

                            You can not have 2 cites with the SAME networks talk to each other - you would have to NAT between them... It would be a PITA..

                            Why do you not use different network
                            172.21.1.0/24 and 172.21.2.0/24 when you use mask of /16 you make it the SAME network.

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            1 Reply Last reply Reply Quote 1
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by

                              Here is how you would do what your talking about..

                              0_1540978852735_howdone.png

                              Route in pfsense left would be 172.16/12 go to 192.168.0.2
                              Route in pfsense right would be 172.16/12 go to 192.168.0.6

                              These are transit networks that connect to your mpls network which would route to your different locations. Clients in each location would only talk to pfsense as their gateway.. In the example 172.21.1.254 and 172.21.2.254

                              These are all different networks that could have 254 devices.. If you have more than that then you could increase the mask to /23 or even /22 - or create different vlans in each location.. As long as your different locations do not use overlapping networks..

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 1
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.