Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Setup a WAN IP for each physical interface

    Scheduled Pinned Locked Moved Routing and Multi WAN
    15 Posts 3 Posters 1.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      matthewgcampbell
      last edited by

      I have a /29 block of static IPs assigned by my ISP and I'm trying to setup a public WAN IP for multiple each physical interfaces. How do you do something like this?

      N 1 Reply Last reply Reply Quote 0
      • N
        netblues @matthewgcampbell
        last edited by

        @cashew Thats odd. Why you need multiple interfaces on the same subnet?

        M 1 Reply Last reply Reply Quote 0
        • M
          matthewgcampbell
          last edited by

          This post is deleted!
          1 Reply Last reply Reply Quote 0
          • M
            matthewgcampbell @netblues
            last edited by

            @netblues diagram of what i'm trying to do

            1 Reply Last reply Reply Quote 0
            • N
              netblues
              last edited by

              Is the /29 routed "behind" some other wan ip or it is a local subnet, meaning you need 1 ip for the network, one for pf, one for at& gateway and one for broadcast, leaving you with 4 usable ip's?

              If it is not routed, then your only option is to assign them as virtual ip's and do a 1to 1 nat to the required hosts.

              M 1 Reply Last reply Reply Quote 0
              • M
                matthewgcampbell @netblues
                last edited by

                @netblues that is explained here unsure of how AT&T does it but its just attatched to the link or "street" address they give you.

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  If they are actually routing that to you you can either put one /29 interface, two /30 interfaces, or four /31 interfaces on the inside of pfSense. Or one /30 and two /31. Each pfSense interface will use one of the 8 addresses.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  M 1 Reply Last reply Reply Quote 0
                  • M
                    matthewgcampbell @Derelict
                    last edited by matthewgcampbell

                    @Derelict So how would I do something like this? Im having trouble configuring the public IPs to individual interfaces on my SG-5100.

                    DerelictD 1 Reply Last reply Reply Quote 0
                    • DerelictD
                      Derelict LAYER 8 Netgate @matthewgcampbell
                      last edited by

                      @cashew I just told you what you need to do. First step is to determine if they are actually routing them to you.

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      M 1 Reply Last reply Reply Quote 0
                      • M
                        matthewgcampbell @Derelict
                        last edited by

                        @Derelict So how do you determine that? On their Gateway combo thing you needed to manually configure the static IPs on the WAN link. So my understanding is that your connection to them had your "street IP" the 103.22.30.0 and your public IP block in my case the 34.33.48.20/29.

                        1 Reply Last reply Reply Quote 0
                        • DerelictD
                          Derelict LAYER 8 Netgate
                          last edited by

                          I would packet capture on the WAN and ping one of the unused /29 addresses from outside and see if the upstream device ARPs for the address (NOT routed) or just sends the traffic to the MAC address of your WAN (routed).

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          M 1 Reply Last reply Reply Quote 0
                          • M
                            matthewgcampbell @Derelict
                            last edited by

                            @Derelict I figured out that on AT&T's side its just configured to send anything that goes to my static ip block to my "street IP" 34.33.48.20/29 -> 103.22.30.0 basically and the 103.22.30.0 is routed via DHCP.

                            1 Reply Last reply Reply Quote 0
                            • DerelictD
                              Derelict LAYER 8 Netgate
                              last edited by

                              34.33.48.20/29 is not a valid /29 CIDR block. .16 or .24 would be.

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              M 1 Reply Last reply Reply Quote 0
                              • M
                                matthewgcampbell @Derelict
                                last edited by

                                @Derelict thats a example IP mine is 99.xxx.254.40/29

                                1 Reply Last reply Reply Quote 0
                                • DerelictD
                                  Derelict LAYER 8 Netgate
                                  last edited by

                                  Can only operate on the information given.

                                  First step:

                                  Firewall > NAT, Outbound Switch to Hybrid mode. Create a DO NOT NAT rule on WAN for source 99.xxx.254.40/29.

                                  Create a new inside interface. Number it 99.xxx.254.41 /29

                                  Put hosts on that interface on 99.xxx.254.42 - .46 /29 gateway 99.xxx.254.41

                                  Make firewall rules on the interface to pass the desired outbound traffic.

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 1
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.