• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Multiple Subnets on Same LAN Interface

Scheduled Pinned Locked Moved General pfSense Questions
17 Posts 6 Posters 1.9k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • A
    a.simon
    last edited by Oct 12, 2020, 6:55 PM

    I need to route between three networks 10.15.0.0/23, 172.16.1.0/24 and 172.16.3.0/24 that are on the same physical network (please don't ask why...). The firewall pfsense alread was using IP 10.15.1.2 on the LAN IF. I added 172.16.1.1 and 172.16.3.1 as virtual IPs to LAN IF, set up related firewall rules and expected the firewall to route between the three LANs. When traceroute from a client in the 10.15.0.0/23 network to a host in the 172.16.3.0 network, the packages are directly NATed and sent out via the default gateway of the firewall. What's going on here? The routing table looks fine and presents entries for all IPs on LAN interface.

    J 1 Reply Last reply Oct 12, 2020, 8:54 PM Reply Quote 0
    • J
      johnpoz LAYER 8 Global Moderator
      last edited by Oct 12, 2020, 7:08 PM

      @a-simon said in Multiple Subnets on Same LAN Interface:

      hat are on the same physical network (please don't ask why...).

      On the same L2? That is just borked.. Fix it and then you won't have any issues routing traffic.

      If your going to just run them on the same L2, then just put them all on the same L3 network.

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

      1 Reply Last reply Reply Quote 1
      • S
        stephenw10 Netgate Administrator
        last edited by Oct 12, 2020, 7:35 PM

        @a-simon said in Multiple Subnets on Same LAN Interface:

        (please don't ask why...)

        Well if you insist! 😉

        I would guess you have some policy based routing rules forcing that traffic out of the WAN. pfSense will otherwise use the same interface to route between subnets as you expect. You can get some odd asymmetry happening at time. Firewall rules often don't apply as you expect because things like 'LANnet' don't contain the additional subnets. Some services will not listen on those subnets without additional config.

        Do the VIPs you added have the correct subnets on them?

        Steve

        A 1 Reply Last reply Oct 12, 2020, 8:30 PM Reply Quote 1
        • J
          johnpoz LAYER 8 Global Moderator
          last edited by johnpoz Oct 12, 2020, 7:48 PM Oct 12, 2020, 7:45 PM

          Its like helping someone pound in a screw with a hammer ;)

          Sure if the hammer is big enough, and you hit the screw hard enough you can drive it in.. But its not the correct tool for the job.

          Just like trying to run multiple L3 on the same L2 is not how you do it. The OP would be much better off correcting such a borked network, then forcing the square peg into the round hole.

          Or you get other users thinking this

          square-peg-in-round-hole.jpg

          Is fine or a correct way to do things..

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

          1 Reply Last reply Reply Quote 0
          • S
            stephenw10 Netgate Administrator
            last edited by Oct 12, 2020, 7:57 PM

            I'm not disagreeing but sometimes you gotta do what you can with what you've got. 😉

            I've added subnets to interfaces to access some device that was stuck on the wrong subnet more times than I can remember.

            Steve

            1 Reply Last reply Reply Quote 1
            • J
              johnpoz LAYER 8 Global Moderator
              last edited by johnpoz Oct 12, 2020, 8:05 PM Oct 12, 2020, 8:00 PM

              @stephenw10 said in Multiple Subnets on Same LAN Interface:

              I've added subnets to interfaces to access some device that was stuck on the wrong subnet more times than I can remember.

              That is completely different.. That was a quick fix solution to a specific problem, that I am assume you corrected. Or did you just leave that device on the wrong subnet? Once you were able to get to it?

              Is the OP goal to be able to talk to these devices from his machine to change their IPs, set them to dhcp so they get the correct subnet? Sure didn't sound like temp method to fix his broken setup to me.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

              1 Reply Last reply Reply Quote 1
              • S
                stephenw10 Netgate Administrator
                last edited by Oct 12, 2020, 8:21 PM

                @johnpoz said in Multiple Subnets on Same LAN Interface:

                Or did you just leave that device on the wrong subnet? Once you were able to get to it?

                I'm admitting nothing!

                1 Reply Last reply Reply Quote 1
                • A
                  a.simon @stephenw10
                  last edited by Oct 12, 2020, 8:30 PM

                  @stephenw10 "Policy Based Routing" was the key to the solution. I had already solved my problem by adding explicit rules right after writing my post but was not sure why this was necessary. You're absolutely right: There is a rule forcing the outgoing LAN traffic to use one of the WAN interfaces, overriding the routing table. Thanks for your response.

                  1 Reply Last reply Reply Quote 1
                  • J
                    johnpoz LAYER 8 Global Moderator
                    last edited by johnpoz Oct 12, 2020, 8:35 PM Oct 12, 2020, 8:32 PM

                    Lets list off a couple of reasons why this is bad..

                    1. There is no security here, be it you think you created firewall rules to block X from Y or not.. If the devices are on the same L2, they can talk to each other.. All that has to happen is for the user to change their IP or even just create a static arp and there you go they are talking directly to other IP not routing through anything.

                    2. All broadcast/Multicast will be seen by all clients on this L2, doesn't matter what their IPs are..

                    3. Can't run dhcp server in such a setup..

                    4. Did I mention no actual isolation of your devices ;)

                    5. Complicates your setup on your firewall/router - complicated setups lead to mistakes and extra work ;)

                    6. Relates to 1, since all networks are really just the same L2 - any user can just change their IP and off they go hitting firewall rules that they shouldn't be able to, and talking to stuff that is actually on a different network/internet that maybe you don't want them too.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                    1 Reply Last reply Reply Quote 0
                    • J
                      JKnott @a.simon
                      last edited by Oct 12, 2020, 8:54 PM

                      @a-simon

                      When you have multiple subnets on the same interface, you will get ICMP redirects when you try to send traffic to a different network. But you can't do that, because the other network doesn't fit within the first network, as specified by the subnet mask. You can't get there from here. 😉

                      PfSense running on Qotom mini PC
                      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                      UniFi AC-Lite access point

                      I haven't lost my mind. It's around here...somewhere...

                      1 Reply Last reply Reply Quote 0
                      • A
                        AKEGEC
                        last edited by Oct 15, 2020, 9:43 AM

                        @a-simon , are you starting a campaign? Because with this method all your data s are leaking and sharing radios with others 💩 .

                        J 1 Reply Last reply Oct 15, 2020, 10:26 AM Reply Quote 0
                        • J
                          JKnott @AKEGEC
                          last edited by Oct 15, 2020, 10:26 AM

                          @AKEGEC

                          Did he mention WiFi? If he's running multiple APs, then he needs VLANs.

                          PfSense running on Qotom mini PC
                          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                          UniFi AC-Lite access point

                          I haven't lost my mind. It's around here...somewhere...

                          A 1 Reply Last reply Oct 15, 2020, 4:30 PM Reply Quote 0
                          • A
                            AKEGEC @JKnott
                            last edited by Oct 15, 2020, 4:30 PM

                            @JKnott said in Multiple Subnets on Same LAN Interface:

                            @AKEGEC

                            Did he mention WiFi? If he's running multiple APs, then he needs VLANs.

                            It doesn't matter. The problem is he thinks he can get away with that method. Anyway it used to be inequality of available information, but in this case network X knows who network Y is and vice versa. 😜

                            1 Reply Last reply Reply Quote 0
                            • C
                              coffeecup25
                              last edited by coffeecup25 Oct 17, 2020, 7:19 PM Oct 17, 2020, 7:13 PM

                              Been there. Done that. It does not work.

                              Everything on the same switch eliminates the isolation I presume you want. Impossible.

                              My home internet is wired / wireless. I have a smart switch that isolates everything attached to a 2nd switch. Not difficult. Google it.

                              1 Reply Last reply Reply Quote 0
                              • S
                                stephenw10 Netgate Administrator
                                last edited by Oct 17, 2020, 7:49 PM

                                Sometimes you don't need isolation you just need to access both subnets. But doing so in this way should really be a last resort or something temporary.

                                Steve

                                1 Reply Last reply Reply Quote 0
                                • J
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by johnpoz Oct 17, 2020, 7:52 PM Oct 17, 2020, 7:51 PM

                                  @stephenw10 said in Multiple Subnets on Same LAN Interface:

                                  But doing so in this way should really be a last resort or something temporary.

                                  Concur... As in your example where box had the wrong IP for the L2 it was on.. And you didn't have physical access to the box and need to get to it to correct is wrong IP..

                                  A valid use of such methods would be say for example you changed your address range via dhcp change.. And you forgot about some box that was static.. And now your no longer at the office and you need to get to that box to change its IP, or change it to dhcp and reboot it..

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                  1 Reply Last reply Reply Quote 0
                                  • S
                                    stephenw10 Netgate Administrator
                                    last edited by Oct 17, 2020, 7:58 PM

                                    Yes, and knowing how to do that and what it looks like if you're in that situation is a useful skill that may well save your ass!
                                    They other situation I see it in commonly is when a network is switching subnets, because the previous one was too small and couldn't enlarged or it conflicts with a remote subnet over a VPN say. Both subnets may be run for some time during the switch over because there are always some systems that have some issue. Still better to avoid it if you can.

                                    Steve

                                    1 Reply Last reply Reply Quote 0
                                    17 out of 17
                                    • First post
                                      17/17
                                      Last post
                                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                      This community forum collects and processes your personal information.
                                      consent.not_received