Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Single IP Subnet on WAN - How?

    Scheduled Pinned Locked Moved NAT
    1 Posts 1 Posters 266 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mattyakel
      last edited by

      I'm trying to replace a Cisco RV325 Dual WAN Gigabit Router with pfSense for a client network. They have a /28 publicly routable IP subnet. The current setup is that there is 1 WAN interface on the Cisco and 1 'DMZ/WAN2' interface.

      Example:
      1.2.3.98/28 (obviously this isn't actually their public IP address. )

      1.2.3.96/28 - Network
      255.255.255.240 - netmask
      1.2.3.111 - broadcast
      1.2.3.97-110 - usable

      1.2.3.98 -- WAN on Cisco/pfSense
      1.2.3.97 -- ISP Gateway
      1.2.3.103 -- PBX (Statically assigned on device, I can't change this one.)

      The Cisco's 'DMZ/WAN2' interface if you turn on DMZ I can just allow 1.2.3.99 - 1.2.3.110 to just be passed through on that port, so any device I have downstream on that interface I can statically assign a public IP in the available range and it just works.

      With pfSense I bridged the WAN & OPT1 interfaces and the PBX can't get out on the internet. I've tried using this page from the docs as a guide but there's something that I'm missing some where.

      https://docs.netgate.com/pfsense/en/latest/book/firewall/methods-of-using-additional-public-ip-addresses.html#single-ip-subnet-on-wan

      alt text

      Do I have to just waste a public IP to assign to the "CARP VIP" I don't understand how that the VIP helps with the box that's connected to OPT1 interface.

      I Also looked at an actual DMZ following Jim's video from the Netgate YT channel. https://youtu.be/QFk5jX-oeSo per his notes on the slides you have to have a separate publicly routable subnet to assign to the DMZ or you have to do 1:1 NAT where your "DMZd" devices have a private IP and then just 1:1 to an available Public IP. I only have a single public subnet.

      Does anyone know how to accomplish this? I feel like there is something that I'm missing, I thought this would be an easier problem to solve. Any help would be greatly appreciated. Thanks.

      1 Reply Last reply Reply Quote 0
      • First post
        Last post
      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.