Issue with a block of 16 IPv4 addresses
-
Hello all hope your all well, happy new year to you all
SO, after a little bit of support to try and get my block of 16 IPv4 addresses working.
Now Zen Internet (UK) is now routing their block of 16 IP’s to me like this:
217.13.XX.193
217.13.XX.194
217.13.XX.195
217.13.XX.196
217.13.XX.197
217.13.XX.198
217.13.XX.199
217.13.XX.200
217.13.XX.201
217.13.XX.202
217.13.XX.203
217.13.XX.204
217.13.XX.205
217.13.XX.206
217.13.XX.207 (router/firewall)
217.13.XX.208 (broadcast address)I currently have my Pfsense box managing the PPPOE connection. I need to know what IP to put where in Pfsense to get it working, I’ve tried many different ways and all fail on me.
Any help would be greatly appreciated
-
Hello from another Zen Internet user
Use the others as VIPS and do a 1:1 nat or nat if you dont need a 1:1.
https://www.netgate.com/docs/pfsense/firewall/virtual-ip-address-feature-comparison.html
-
With my previous supplier all I needed to do was to set the PPPOE data and then under services -> DHCP Server set my avalible Range in there. But zen appears to be totally different
-
You have hosts the WAN side of pfSesnse ?
-
I have file servers behind the pfsense box
-
Is 217.13.XX.207 your WAN interface IP ?
If it is you'll need to do a 1:1 nat.
-
The way the servers were configured was the public ip, subnet mask and the public gateway address were directly assigned to the nic card on the servers
-
@nogbadthebad I have tried that server still now resolving
-
It looks to me like they're just giving you a block of addresses and expect you to use them as is. This means you need a pass through firewall that does not do routing and especially not NAT. If you were to connect all those servers, through a switch, to the ISP, I bet they'd work. You could certainly do that, but you'd want to make sure the firewall on each server is configured correctly. Perhaps you could set up pfSense as a bridge between the WAN and LAN interfaces and set up the appropriate rules.
-
@landman16 said in Issue with a block of 16 IPv4 addresses:
217.13.XX.207 (router/firewall)
Im with jknott, If they told you that was the router - then that block is not "routed" to you.. But they just attached them to your connection.
They would not tell you what the router is if they actually routed that .192/28 to you.. Since it would just be routed to your current IP. And then yeah you could put the /28 behind pfsense without any nat.
-
Zen are not even able to tell me how they are routing the IPs to me. This is half the battle if they could I wouldn’t be where I am now
-
@nogbadthebad said in Issue with a block of 16 IPv4 addresses:
Is 217.13.XX.207 your WAN interface IP ?
We'd know exactly how to help if you answered the question I posted.
Is 217.13.XX.207 your WAN interface IP ?
"I have tried that server still now resolving" doesn't really mean a thing.
-
@landman16 said in Issue with a block of 16 IPv4 addresses:
Zen are not even able to tell me how they are routing the IPs to me. This is half the battle if they could I wouldn’t be where I am now
Sorry but I find that very hard to believe, they are one of the better ISPs in the UK.
-
@nogbadthebad yes that is the WAN address
-
OK then you need to nat those addresses, but not 217.13.XX.207
217.13.XX.192/28 can't exist on your WAN and LAN interface.
-
If .207 is your WAN, then that /28 is not "routed" to you... Your just attached to that network, yeah your going to have to NAT to use them as vips.
Have them ROUTE the /28 to you if you want to put it behind pfsense.
-
How would I go about doing that ?
-
Doing what? Routed call your ISP and tell them to route that /28 you via transit network..
1:1 nat just create those IPs as vips and do 1:1 nat..
https://www.netgate.com/docs/pfsense/book/nat/1-1-nat.html -
-
@landman16 said in Issue with a block of 16 IPv4 addresses:
Zen are not even able to tell me how they are routing the IPs to me. This is half the battle if they could I wouldn’t be where I am now
If they're just giving you a block of addresses, then use them that way. No need to route them. As I mentioned above, you just need a bridge/firewall, to pass the addresses to the servers. Take a computer, configure it with a static address from that list. If it works, that's all you need to do for each server. Also, if those servers run Linux, they will already have a good firewall built in. Just configure and you wouldn't even need pfSense, though an extra layer of protection is better.
-
@nogbadthebad said in Issue with a block of 16 IPv4 addresses:
OK then you need to nat those addresses, but not 217.13.XX.207
NO! NO! NO! NAT. He has a block of public addresses. If he has an address for a router, then set up pfSense as a router/firewall. If he doesn't then set up pfSense as a bridge/firewall. Which config he uses depends on what the ISP provides. My own ISP provides 2 IPv4 addresses, so I could directly connect 2 devices to my cable modem, if I choose. However, as I have more than 2 devices, I am forced to use NAT for IPv4.
I wish people would get out of the habit of thinking NAT is the way things are done. NAT is a hack, created to get around the IPv4 address shortage and, due to problems it causes, shouldn't be used when not needed. The OP has a block of 16 addresses, so NAT most definitely should not be used.
-
Call your ISP.
Tell them to give you a /29 on the WAN interface.
Tell them to route 217.13.XX.192/28 to your address on that.
If they want justification for the /29 tell them you need to run VRRP. (Even though it's not really possible on PPPoE. You might have to settle for something else there, like a static address. Try for the /29 anyway)
Put 217.13.XX.193/28 on an inside interface.
Make a NO NAT Hybrid outbound NAT rule for 217.13.XX.192/28
Put your servers on that inside interface. Give them addresses 217.13.XX.194 - 217.13.XX.207.
And you're done - and it's done correctly.
-
@jknott said in Issue with a block of 16 IPv4 addresses:
The OP has a block of 16 addresses, so NAT most definitely should not be used.
Neither should any silly bridging.
-
@derelict I will give them a call in a bit and ask them to give me a /29 and see where I go from there. If they will issue a /29 Will that allow me to assign the servers behind pfsense the public IPs directly to the NIC cards on the physical servers?
-
It's what @Derelict said 2 posts up, you need to make it clear to Zen you want the /28 subnet routed via a /29 transit network.
Out of interest when you asked for additional IP addresses did you get an option of how you wanted them ?
-
@nogbadthebad They gave me no option on how I wanted them to be routed to me, but previously with my old supplier that I had 3 days ago. They issued them to me directly I would assume via a /29 transit network. As all I had to do is assign one to my router (at the start of the range (217.13.XX.193) and then all the public IPs between 217.13.XX.194 through to 217.13.XX.207 were signed directly to each nodes NIC cards this was the settings I gave the each Nodes NIC card
Node 1: -
Static IP: 217.13.XX.194
Subnet Mask: 255.255.255.240
Gateway IP: 217.13.XX.193Node 2: -
Static IP: 217.13.XX.195
Subnet Mask: 255.255.255.240
Gateway IP: 217.13.XX.193So on, and so on...All the way to 217.13.XX.207 with the final IP 217.13.XX.208 being the broadcast address (unusable)
-
@nogbadthebad the issue is here is as before when I was with my old supplier they gave the IP's to me like this
217.13.XX.193 (router/firewall)
217.13.XX.194
217.13.XX.195
217.13.XX.196
217.13.XX.197
217.13.XX.198
217.13.XX.199
217.13.XX.200
217.13.XX.201
217.13.XX.202
217.13.XX.203
217.13.XX.204
217.13.XX.205
217.13.XX.206
217.13.XX.207
217.13.XX.208 (broadcast address)Now Zen Internet issue them to me like this
217.13.XX.193
217.13.XX.194
217.13.XX.195
217.13.XX.196
217.13.XX.197
217.13.XX.198
217.13.XX.199
217.13.XX.200
217.13.XX.201
217.13.XX.202
217.13.XX.203
217.13.XX.204
217.13.XX.205
217.13.XX.206
217.13.XX.207 (router/firewall)
217.13.XX.208 (broadcast address)So when the router is assigned 217.13.XX.207 automatically , its causing issues with my setup. When I try and tell the system it can use the other IP's available to me. It just returns an error basically saying they overlap with the WAN address.
-
@landman16 said in Issue with a block of 16 IPv4 addresses:
So when the router is assigned 217.13.XX.207 automatically , its causing issues with my setup. When I try and tell the system it can use the other IP's available to me. It just returns an error basically saying they overlap with the WAN address.
That router address would be on the LAN side, not WAN. On the WAN side, you need an address that's outside of that block of addresses. This is why we've been asking about what you're being provided. If they expect you to use a router, then they need to provided an appropriate WAN address, which I haven't seen yet. If they're only providing those 16 addresses and no WAN address, then they're expecting you to use them as is, unusual but possible. In that case, you need to configure pfSense as a bridge. Please call your ISP's support and find out what they are providing and expecting you to provide. Until we know that, we're just guessing.
-
@nogbadthebad said in Issue with a block of 16 IPv4 addresses:
It's what @Derelict said 2 posts up, you need to make it clear to Zen you want the /28 subnet routed via a /29 transit network.
Out of interest when you asked for additional IP addresses did you get an option of how you wanted them ?
Looks like they have not routed the block of 16 IP's to me correctly, I have just phoned Zen and asked them if they can route my public subnet of 16 IP's via a /29 transit network. Maybe then I will get a WAN address that is outside of my allocated IP range, so I able then to use my public subnet without it erroring and saying "It cant do it as it overlaps the auto allocated WAN IP. Not sure if this will work, but its worth a go.
Thank you to everyone so far for your help, this has been a tricky one as Zen are/were sure it was my end. Im waiting on a call back. Will be back to update once they have come back to me with the verdict!
-
@landman16 said in Issue with a block of 16 IPv4 addresses:
/29 transit network
Transit networks are commonly /30, though /31 might also be used. With the IPv4 shortage, they're not likely to give you more than you need.
-
Well Zen say "NO!" they do not have the tech onboard their network to route the IPs over a /29 transit network. They are telling me that they are telling me they are only able to route the block of 16 IP's via a Ip frame unnumbered where the wan ip is included within the public subnet range. So not entirely sure what to do here, since they did tell me that they were able to accommodate my needs from the outset. So this is a little disappointing to say the least
-
You’ll need to NAT the addresses then as suggested.
Out of interest is this for business use or home use.
Zen do offer business ethernet and MPLS.
I wish I’d have asked for the 8 public IP addresses that they were handing out FOC when I originally placed my ADSL order with them years ago.
-
@nogbadthebad said in Issue with a block of 16 IPv4 addresses:
You’ll need to NAT the addresses then as suggested.
What's this obsession with NAT? If he has a valid WAN address, then set up pfSense as a regular router. However, if that list of addresses is correct, they're expecting him to run without a router, meaning he configures each server to use that router address as the default gateway, just as you'd configure any computer behind a router. The only difference is the router is at the ISP's and not his location. This is why I suggested configuring a computer with one of those addresses and seeing if it works. If it does, then the ISP does not want a router at his site and pfSense has to be configured as a bridge. It would be really nice if the OP would confirm what arrangements the ISP wants, so we're not speculating. Either way, forget NAT. It's not needed, as he apparently has all the addresses he needs for his servers.
Please remember, NAT is a hack to get around the IPv4 address shortage and should not be used unless absolutely necessary. Based on the info provided, it's not, assuming he has no more than 13 servers.
Incidentally, there appears to be a minor error in that list. Shouldn't the last octet range from 192 to 207? That would be the normal range for a /28, with 217.13.XX.192 the network address and 217.13.XX.207, broadcast.
-
@landman16 said in Issue with a block of 16 IPv4 addresses:
So this is a little disappointing to say the least
Try using it as a block of "LAN" addresses as I suggested. As I mentioned, that's easily tested by configuring a computer using one of those addresses. As noted above, verify the actual addresses, as there seems to be a discrepancy for a /28.
-
.192/28
.192 = wire
.193 = first address
.207 = last address
.208 = broadcast.That aint right is it.. jknot is correct .207 would be broadcast not last host.
.208 would be the next net
.208/28 -
Yeah .207 is broadcast in .192/28.
If you CANNOT get a subnet routed to you and you CANNOT NAT, then the only other thing you can do is bridge as has been suggested.
Personally, I would 1:1 NAT in that case. Not for any love of NAT, but that would be my preferred way of dealing with this ISP crap unless the application was NAT-sensitive like FTP or VoIP. In that case I would look for an ISP that could deliver the provisioning correct for the application.
-
@derelict said in Issue with a block of 16 IPv4 addresses:
Not for any love of NAT, but that would be my preferred way of dealing with this ISP crap
Why not just use bridge mode and filter that way. Unless I'm mistaken, pfSense can do that, though I have never tried it.
-
I consider bridging to be a last resort.
-
@derelict said in Issue with a block of 16 IPv4 addresses:
I consider bridging to be a last resort.
What's the issue? I'd consider NAT to be a last resort.
-
Mostly because people don't understand what they are doing. Even worse than usual.
I said bridging was an option. I said I would NAT. You have your preference. I have mine. I also said it depends on the application. If it's web servers I really don't care if it's NAT to get around a stupid ISP.
I would actually insist my ISP did it right or get a different one. But I'm pretty far to the edge of the bell curve there.
