Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    need WAN Network to access LAN network and vise versa

    Routing and Multi WAN
    3
    5
    527
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      seramis
      last edited by seramis

      Hi all,

      I need my WAN network/devices 192.168.254.0/24 to access or ping LAN network/devices 172.1.1.0/24 and vise versa.
      I will be using these for AP, LAN network for Local Wifi(Like Internal Network via Wifi) and VLAN30 network for Guest Wifi.
      I need 172 network to be able to communicate with 192 network for DHCP Service because I use filter profiles.

      Can anyone tell me what i need(NAT? Firewall Rule?) and steps how to do?

      IP Adress:
      -ISP Modem 192.168.254.254/24
      -WAN 192.168.254.2/24 (Upstream Gateway ISP Modem IP 192.168.254.254/24)
      -LAN 172.1.1.0/24
      -VLAN30 10.1.1.0/8
      -Windows DHCP Server for LAN 192.168.254.1/24

      98e1b35c-8b52-4d5c-8457-68b6a2c14791-image.png

      Thank you in advance =)

      V 1 Reply Last reply Reply Quote 0
      • V
        viragomann @seramis
        last edited by viragomann

        @seramis said in need WAN Network to access LAN network and vise versa:

        Can anyone tell me what i need(NAT? Firewall Rule?) and steps how to do?

        Probably routes and firewall rules to allow the access.
        So pfSense is the default gateway in LAN and VLAN30. So the packets toward WAN network should be routed well. But the devices in the WAN network will need routes pointing to pfSense for the networks behind.
        You may push that routes via DHCP to all clients that are configured to use it. On the others you will have to set the routes manually.

        Also in the WAN interface settings you have to remove the check from "Block private networks".

        And of course you have to add firewall rules to allow the access you wish.

        @seramis said in need WAN Network to access LAN network and vise versa:

        I need 172 network to be able to communicate with 192 network for DHCP Service because I use filter profiles.

        You want the LAN devices to get IPs from the DHCP in the WAN subnet?

        S 1 Reply Last reply Reply Quote 0
        • S
          seramis @viragomann
          last edited by

          @viragomann Hi thank you for your reply.

          I already disabled blocking private networks and blocking bogon networks on WAN.
          also, i already added firewall rules to WAN any-any
          22545401-63d1-4d67-9ec7-57f46ee79cca-image.png

          WAN network still not able to ping or communicate with LAN network?

          But my LAN network is able to ping and communicate, even RDP with WAN network.

          -For your second question, if "You want the LAN devices to get IPs from the DHCP in the WAN subnet?"
          Answer: Yes Sir, I need LAN devices to be able to communicate to WAN network and get DHCP IP from it, DHCP Server is running on WAN Network and on Scope I added 172.1.1.1 Router.

          Thank you

          1 Reply Last reply Reply Quote 0
          • V
            viragomann
            last edited by

            And what's about the routes? Do your WAN devices have the correct route to the LAN network?

            For DHCP on LAN you need to enable and configure the DHCP relay on pfSense.

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by

              172.1.1/24 - dude come on!!

              NetRange: 172.0.0.0 - 172.15.255.255
              Organization: AT&T Corp. (AC-3280)

              Don't use address space that is not yours.. Use valid rfc space there 172.16.1/24 would be fine..

              So did you turn off NAT, if not to get to stuff behind pfsense you would have to port forward.. If you want to route and firewall only, then make sure you turn off nat.

              And yes devices sitting on your 192.168 wan network would need a host route to tell them how to get to the 172 and 10 networks.. If your clients on your wan are talking to some other router as their default, so yeah they would need route to get to behind pfsense.. If you try and route them off your default router your going to run into asymmetrical problem.

              The correct solution here is to have your downstream router (pfsense) connected to your upstream via a transit network.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

              1 Reply Last reply Reply Quote 0
              • First post
                Last post
              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.