• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Static Routing on Additional Lan Gateway

Scheduled Pinned Locked Moved Routing and Multi WAN
50 Posts 3 Posters 6.4k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • R
    Rupesh
    last edited by Rupesh Feb 20, 2020, 3:33 PM Feb 20, 2020, 8:14 AM

    I have a pf-sense firewall that is connected to internet via static 192.168.3.184 interface as wan. Internal LAN IP for the same is 10.10.10.75. I have another MiKrotik Cloud Core router on 10.10.10.150(LAN) which has 196.29.149.99/24 as WAN(external) address. this Mikrotik doesn't have any access to internet, I have windows share on 196.29.149.205 PC and a printer on 196.29.149.207.

    What i want is to be able to access that windows share and printing services pointed by 10.10.10.150 router.

    On my PF sense firewall I tried to add additional gateway 10.10.10.150 on LAN and added static route for 196.29.149.0/24 network also i added one firewall LAN rule to pass allow passing traffic from LAN net to 196.29.149.0/24 with gateway as 10.10.10.150 in advanced settings.

    after all this setup i am able to open windows share as desired but whenever i am trying to move files from 10.10.10.0/24 network to windows share it just says "failed" after keeping coping window in preparing mode for sometime. However if i copy data from windows share to 10.10.10.0/24 side then its flawless.
    also i can open the printer webpage with no issue..its just that unable to copy data from pf-sense LAN network to miKkotik wan network.

    moreover if i set a new pf sense firewall with cloud core router as wan gateway and wan ip as 10.10.10.90/24 then everything gets resolved, so for sure this inst an issue of Mikrotik cloud-core router.

    Can someone help me out with this sort of problem or if i am missing something out.

    R 1 Reply Last reply Feb 20, 2020, 8:25 AM Reply Quote 0
    • R
      Rupesh @Rupesh
      last edited by Rupesh Feb 20, 2020, 8:25 AM Feb 20, 2020, 8:25 AM

      @Rupesh Correction!!! The printer is on 145.54.26.207/24

      1 Reply Last reply Reply Quote 0
      • K
        kiokoman LAYER 8
        last edited by Feb 20, 2020, 9:12 AM

        imho you don't need a gateway but only a static route that go to 145.54.26.0/24 from 10.10.10.150
        i think that you run into an asymmetric routing with that gateway

        ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
        Please do not use chat/PM to ask for help
        we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
        Don't forget to Upvote with the 👍 button for any post you find to be helpful.

        R 1 Reply Last reply Feb 20, 2020, 10:04 AM Reply Quote 1
        • R
          Rupesh @kiokoman
          last edited by Feb 20, 2020, 10:04 AM

          @kiokoman but when I set static route I need to define a gateway and it cannot be pfsense default gateway.

          1 Reply Last reply Reply Quote 0
          • K
            kiokoman LAYER 8
            last edited by kiokoman Feb 20, 2020, 10:26 AM Feb 20, 2020, 10:17 AM

            ah well i never had the chance to use the gui to create a static route, it was my misunderstanding
            the command line would be
            route add -net 145.54.26.0/24 10.10.10.150
            where 10.10.10.150 is the gateway after all

            is it like this?
            Immagine.jpg

            ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
            Please do not use chat/PM to ask for help
            we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
            Don't forget to Upvote with the 👍 button for any post you find to be helpful.

            R 1 Reply Last reply Feb 20, 2020, 11:33 AM Reply Quote 1
            • R
              Rupesh
              last edited by Feb 20, 2020, 11:07 AM

              yes like this

              1 Reply Last reply Reply Quote 0
              • R
                Rupesh @kiokoman
                last edited by Rupesh Feb 20, 2020, 4:43 PM Feb 20, 2020, 11:33 AM

                @kiokoman gateways.png gateway edit.png ssh.png

                1 Reply Last reply Reply Quote 0
                • K
                  kiokoman LAYER 8
                  last edited by kiokoman Feb 20, 2020, 12:08 PM Feb 20, 2020, 12:06 PM

                  check with packet capture, the traffic is probably right from pfsense side but going out from the wrong interface after RouterOS, i don't understand that 162.29. gateway, can you make a draw of your network?

                  ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
                  Please do not use chat/PM to ask for help
                  we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
                  Don't forget to Upvote with the 👍 button for any post you find to be helpful.

                  R 1 Reply Last reply Feb 20, 2020, 12:40 PM Reply Quote 0
                  • R
                    Rupesh @kiokoman
                    last edited by Feb 20, 2020, 12:40 PM

                    @kiokoman oh thank you for pointing out...infact it's just a typo that happened while I was taking that screenshots...it should be..145.54.26.36...
                    Sure I would give you a diagram

                    1 Reply Last reply Reply Quote 0
                    • J
                      johnpoz LAYER 8 Global Moderator
                      last edited by johnpoz Feb 20, 2020, 1:39 PM Feb 20, 2020, 1:37 PM

                      @Rupesh said in Static Routing on Additional Lan Gateway:

                      have windows share on 145.54.26.205 PC and a printer on 145.54.26.205.

                      So you just pulling IP space out of thin air and using it internally? That is borked!

                      Also if your going to have a downstream network, your going to want to use a transit network (no hosts on it) your will have issues with asymmetrical routing talking to and from devices on your lan (that you are using as transit)..

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      R 2 Replies Last reply Feb 20, 2020, 1:41 PM Reply Quote 0
                      • R
                        Rupesh @johnpoz
                        last edited by Feb 20, 2020, 1:41 PM

                        @johnpoz sorry about that..that was typo..however I did correct it there in my next reply ....

                        1 Reply Last reply Reply Quote 0
                        • J
                          johnpoz LAYER 8 Global Moderator
                          last edited by johnpoz Feb 20, 2020, 1:44 PM Feb 20, 2020, 1:43 PM

                          @Rupesh said in Static Routing on Additional Lan Gateway:

                          The printer is on 145.54.26.207/24

                          That is owned by some ISP in the netherlands - you can not just grab any IP space you want and using it internally without issues... Just use rfc1918.. You do not own this 145.54.26 address space do you??

                          netnum:        145.54.0.0 - 145.54.255.255
                          netname:        PTT2
                          country:        NL
                          
                          organisation:   ORG-KOVN1-RIPE
                          descr:          KPN Internet Solutions
                          address:        NETHERLANDS
                          

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          R 1 Reply Last reply Feb 20, 2020, 1:46 PM Reply Quote 1
                          • R
                            Rupesh @johnpoz
                            last edited by Feb 20, 2020, 1:44 PM

                            @johnpoz sorry for asking silly question...im kind of newbie.

                            by transit network you mean 10.10.10.0/24 ?? Doesn't it defeats the very purpose of having another gateway in my lan? Or perhaps I didn't get you completely..can you please elaborate a bit...

                            1 Reply Last reply Reply Quote 0
                            • J
                              johnpoz LAYER 8 Global Moderator
                              last edited by Feb 20, 2020, 1:46 PM

                              Do you have devices or hosts on this 10.10.10 network? Then you will have issues talking to this downstream network unless you host route on them or do natting of your downstream network

                              A transit network to another downstream network should have no hosts on it or you will have asymmetrical problems... I have been over this a 100 times ;)

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 1
                              • R
                                Rupesh @johnpoz
                                last edited by Feb 20, 2020, 1:46 PM

                                @johnpoz it is being used in local network..not connected at all with internet... That is the only reason to keep it on entirely different network...

                                1 Reply Last reply Reply Quote 0
                                • J
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by johnpoz Feb 20, 2020, 1:53 PM Feb 20, 2020, 1:47 PM

                                  That is fine still shouldn't be PUBLIC space - pick a network out of the rfc1918 space to use... There is plenty of it!!!

                                  Using public space internally that is not yours - is borked!! And now what if for some reason there is a website hosted on this public network you want to get to?? ;) Do not use public space internally unless you actually own it!!

                                  Here is older thread and drawing where show the problem of hosts on transit, ie asymmetrical routing.
                                  https://forum.netgate.com/post/865509

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  R 1 Reply Last reply Feb 20, 2020, 2:06 PM Reply Quote 1
                                  • R
                                    Rupesh @johnpoz
                                    last edited by Feb 20, 2020, 2:06 PM

                                    @johnpoz got it..I'll do the needful regarding class of addressing, however my issue/question still remains the same.

                                    I'm able to open the share and even printers webpage is opening without any issues...
                                    I can copy from windows share to my 10.10.10.0/24 subnet but can't do the other way around...

                                    1 Reply Last reply Reply Quote 0
                                    • J
                                      johnpoz LAYER 8 Global Moderator
                                      last edited by Feb 20, 2020, 2:09 PM

                                      Lets see your drawing you were going to do ;)

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      R 1 Reply Last reply Feb 20, 2020, 2:49 PM Reply Quote 0
                                      • R
                                        Rupesh @johnpoz
                                        last edited by Feb 20, 2020, 2:49 PM

                                        @johnpoz ok removed that 145 network Here is what it looks like now
                                        Capture.PNG

                                        R 1 Reply Last reply Feb 20, 2020, 2:52 PM Reply Quote 0
                                        • R
                                          Rupesh @Rupesh
                                          last edited by Feb 20, 2020, 2:52 PM

                                          @Rupesh also this 162.29.149.0/24 network is not under my control. Its my organizational network strictly isolated from internet.

                                          1 Reply Last reply Reply Quote 0
                                          10 out of 50
                                          • First post
                                            10/50
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received