Static Routing on Additional Lan Gateway

Rupesh

@johnpoz sorry for asking silly question...im kind of newbie.

by transit network you mean 10.10.10.0/24 ?? Doesn't it defeats the very purpose of having another gateway in my lan? Or perhaps I didn't get you completely..can you please elaborate a bit...

johnpoz

Do you have devices or hosts on this 10.10.10 network? Then you will have issues talking to this downstream network unless you host route on them or do natting of your downstream network

A transit network to another downstream network should have no hosts on it or you will have asymmetrical problems... I have been over this a 100 times ;)

Rupesh

@johnpoz it is being used in local network..not connected at all with internet... That is the only reason to keep it on entirely different network...

johnpoz

That is fine still shouldn't be PUBLIC space - pick a network out of the rfc1918 space to use... There is plenty of it!!!

Using public space internally that is not yours - is borked!! And now what if for some reason there is a website hosted on this public network you want to get to?? ;) Do not use public space internally unless you actually own it!!

Here is older thread and drawing where show the problem of hosts on transit, ie asymmetrical routing.
https://forum.netgate.com/post/865509

Rupesh

@johnpoz got it..I'll do the needful regarding class of addressing, however my issue/question still remains the same.

I'm able to open the share and even printers webpage is opening without any issues...
I can copy from windows share to my 10.10.10.0/24 subnet but can't do the other way around...

johnpoz

Lets see your drawing you were going to do ;)

Rupesh

@johnpoz ok removed that 145 network Here is what it looks like now

Rupesh

@Rupesh also this 162.29.149.0/24 network is not under my control. Its my organizational network strictly isolated from internet.

johnpoz

162.29.149 is not RFC1918... WTF dude?

NetRange:       162.29.0.0 - 162.29.255.255
CIDR:           162.29.0.0/16
NetName:        WELLSFARGO-162-29-0-0

Are you wells fargo? Why are you using that space? Is it yours? Use rfc1918 10.x.x.x, 192.168.x.x, 172.16-31.x.x there is plenty of space to use..

And yeah that is going to a be a asymmetrical nightmare..., Where to the windows machine and the print point to for their gateway? Do they have specific routes on how to get back cto your 10.10.10 network? Is this mikrotik router natting these IPs?

Its my organizational network strictly isolated from internet.

So you are wellsfargo? If not your IT org are a bunch of freaking idiots!!

Rupesh

@johnpoz yes all routers are natting in here. About the IP addresses for now please consider them to be on class C like 190.xx.xx.xx/24.

johnpoz

Doesn't actually matter from a technical point of view as long as your not advertising them out.. .But it is so freaking BORKED!!! you can not just pull public space out your ass and use it internally ;)

Well if that downstream router is natting, then you would have to do port forwards if you want say that PC to create an unsolicited connection into the 10.x.x.x network.

Rupesh

This post is deleted!

Rupesh

This post is deleted!

Rupesh

This post is deleted!

Rupesh

@johnpoz because that space in not under my control, this is being given to me by organization. I cannot change that. however if we ignore about this space issue.. still this aint working

All i want is if im going to aceess 162.29.149.0/24 then it should be routed through my 10.10.10.150.

I tried to change my gateway and dns on 10.10.10.11 windows computer to 10.10.10.150 from 10.10.10.75 and everything works absolutely fine..

I want to do this automatically from pfsense router. without the need of manually changing gateway and dns every time in each of my computers and loosing connectivity to internet in the process.

Rupesh

This post is deleted!

Rupesh

@johnpoz Though i cant change the actual ip, lets consider it like this for now just to resolve this technical issue corrected one.PNG

kiokoman

you need a static route on the other side like 10.10.10.0/24 with gateway 196.29.149.99 if there isn't already one

Rupesh

@kiokoman do you mean i need to create that static route on my pfsense? or mikrotik? I did try to create a additional gateway on lan interface with ip 10.10.10.150. and setup a static route 196.29.149.0/24 pointing to gateway 10.10.10.150. I added the firewall rule for the same as well.

however if i do "route add 196.29.149.0/24 10.10.10.150" on my windows machine in 10.10.10.0/24 subnet then it works without any problem.

kiokoman

the yellow line is what it's doing now
the red, what it should be

if the gateway for the network is 196.29.149.36 than you have to tell that device to send the traffic back to 196.29.149.99

@Rupesh said in Static Routing on Additional Lan Gateway:

however if i do "route add 196.29.149.0/24 10.10.10.150" on my windows machine in 10.10.10.0/24 subnet then it works without any problem.

of course, you have to define that route inside 196.29.149.36 whatever it is