Simple routing question pfsense in lan as gateway for vlan
-
Im trying to setup a mixed setup, i have my isp upstream router and added a pfsense to my lan.
Then i setup a vlan on the pfsense and added a client 192.168.2.100 to it.
The vlan client can access the wan over my isp router and also access lan clients.
But my lan clients cant access the vlan client. I added a static route to my isp router and set pfsense as gateway, but it seems im missing something else ? Do i need to nat ?
Firewall is off for now to debug, but later i will restrict access from lan to vlan and vice versa.
-
That would be asymmetrical and problematic at best.. If you want a downstream router, then it needs to be connected via a transit network so your not asymmetrical. I doubt your fritzbox can do that?
For you to get to stuff behind pfsense doing nat you would need to use port forwarding, and access the wan IP of pfsense from devices in the 192.168.1 network.
Or you could do host routing. where 192.168.1.15 has route to 192.168.1.10 to get to 192.168.2/X. If your pfsense is not doing nat. But if its not doing nat - not sure how your fritzbox would nat anything coming from the 192.168.2 network.
-
Thanks for your fast reply, so it seems not to be possible.
-
Just use port forwarding - this works out of the box.. With nothing special to do on anything other than setup the port forward on pfsense.
-
That would be a solution for simple things like exposed services (reverse proxy, etc.)
But I wanted to use pfsense for vlan support and setup multiple vlans that should be able to interact with my lan and vice versa directly. It would not be beneficial to manage port forwarding for this.
Guess my only option is to use pfsense as main gateway and put the fritzbox behind it.
-
Unless your upstream router supports vlans and can create a transit network, and do nat for downstream networks.. Then yeah.
No you can not do big boy networking, with home user toys ;) I do not believe there is even 1 soho router on the market that allows for even basic vlans.. Unless you run 3rd party firmware on it.
-
Sadly the fritzbox doesnt support vlans nor nat, thats why I setup the pfsense in the first place.
I was thinking I could use the pfsense somehow as gateway and thus still keep my wifi on the fritzbox to not spend money on a access point.
Anyway thanks for your support.
-
Just get an AP and put your whole network behind pfsense.. Real networking cost a few bucks - but you can do it on the cheap..
