Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Routing between WAN and LAN

    Scheduled Pinned Locked Moved Routing and Multi WAN
    34 Posts 5 Posters 9.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      brandon-lizard
      last edited by

      Hello,

      Having some trouble connecting to devices on my pfsense LAN (from LAN 1 to LAN 2).

      My goal is to separate my main and secondary network.

      10.47.1.1 (LAN 1) - My main network
      10.47.2.1 (LAN 2) - my secondary network

      My wan interface is connected to LAN 1 and gets and IP of 10.47.1.143
      my lan interface is connected to a switch in LAN 2.

      LAN 2 can communicate with LAN 1

      LAN 1 cannot communicate with LAN 2 > What settings can achieve this?

      Thanks

      KOMK johnpozJ V 3 Replies Last reply Reply Quote 0
      • KOMK
        KOM @brandon-lizard
        last edited by KOM

        @brandon-lizard The firewall rules for LAN1 control what is allowed to pass through that interface. If LAN1 can't talk to LAN2, then the problem is the rules on LAN1.

        B 1 Reply Last reply Reply Quote 0
        • B
          brandon-lizard @KOM
          last edited by

          @kom Is that something I need to change in my linksys router on lan 1? I'm not sure where to look.

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator @brandon-lizard
            last edited by

            @brandon-lizard said in Routing between WAN and LAN:

            LAN 1 cannot communicate with LAN 2

            For your setup if you want lan1 (pfsense wan) to talk to stuff on lan2 (pfsense lan) you would need to setup port forwards on pfsense. And then access pfsense wan IP from your lan1 network on the port you have forwarded to something behind pfsense.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

            1 Reply Last reply Reply Quote 0
            • V
              viragomann @brandon-lizard
              last edited by

              @brandon-lizard said in Routing between WAN and LAN:

              My wan interface is connected to LAN 1 and gets and IP of 10.47.1.143
              my lan interface is connected to a switch in LAN 2.

              It's on you to rename the interfaces accordingly.

              LAN 1 cannot communicate with LAN 2 > What settings can achieve this?

              In the WAN interface settings there is a check to "Block private networks" which is checked by default. Since you need to allow private sources to access on this interface, you have to remove it and add proper firewall rules to allow the access.

              johnpozJ 1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @viragomann
                last edited by johnpoz

                @viragomann said in Routing between WAN and LAN:

                In the WAN interface settings there is a check to "Block private networks"

                Yeah good point, but he will still need port forwards. Not firewall rules only.. He is not just routing.. He is just in a double nat setup.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                V 1 Reply Last reply Reply Quote 0
                • V
                  viragomann @johnpoz
                  last edited by

                  @johnpoz said in Routing between WAN and LAN:

                  but he will still need port forwards

                  Why? As I got him, he would only separate the two LANs. So he could disable NAT and do only firewalling.

                  B johnpozJ 2 Replies Last reply Reply Quote 0
                  • B
                    brandon-lizard @viragomann
                    last edited by brandon-lizard

                    @viragomann

                    I setup a static route on my lan 1 router.

                    Destination network -> 10.47.2.0
                    Mask - > 255.255.255.0
                    Gateway - > 10.47.1.143

                    Result:

                    Ping - > 10.47.2.1 - >>> Reply from 10.47.2.1 (that's good)

                    Now, trying to ping a device on that network.

                    Ping -> 10.47.2.101 - >>> Request timed out

                    What gives, I don't understand?

                    V 1 Reply Last reply Reply Quote 0
                    • V
                      viragomann @brandon-lizard
                      last edited by

                      @brandon-lizard
                      I assume, pfSense is the default gateway on the destination device.

                      So ensure that the ping is not blocked by its own firewall.

                      B 1 Reply Last reply Reply Quote 0
                      • B
                        brandon-lizard @viragomann
                        last edited by

                        @viragomann

                        No, on the destination device (10.47.2.101), the default gateway is 10.47.2.1

                        V 1 Reply Last reply Reply Quote 0
                        • V
                          viragomann @brandon-lizard
                          last edited by

                          @brandon-lizard said in Routing between WAN and LAN:

                          the default gateway is 10.47.2.1

                          So this is the LAN IP of pfSense, as you stated above. So it's ok.

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator @viragomann
                            last edited by johnpoz

                            @viragomann said in Routing between WAN and LAN:

                            So he could disable NAT and do only firewalling.

                            No not really - he would have an asymmetrical nightmare.

                            If he wanted to have pfsense be downstream, then he would need a transit network.. Soho routers not going to allow for such a setup.

                            But yeah sure, you could very easy setup pfsense as a downstream router/firewall if your equipment supported it. But trying to use a transit network between the upstream and downstream with host on it is going to be asymmetrical.

                            In his setup what he is calling lan1 is a transit between 2 routers - you can not have hosts on this network without either host routing or natting at the downstream router without having issues between the devices talking to each other because of the asymmetrical traffic flow.

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                            V 1 Reply Last reply Reply Quote 0
                            • V
                              viragomann @johnpoz
                              last edited by

                              @johnpoz
                              I think, I miss something here, what others see.
                              In the first post the second router wasn't mentioned. And now I still don't know, what its role...

                              A drawing might be helpful.

                              johnpozJ 1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator @viragomann
                                last edited by johnpoz

                                @viragomann

                                He called it out here

                                something I need to change in my linksys router on lan 1

                                But yeah a drawing is always good! What I took from his statements is he has this.

                                this.png

                                That is going to be asymmetrical unless you host route on every device in what he calls his lan1, or nat at pfsense.

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                V 1 Reply Last reply Reply Quote 0
                                • V
                                  viragomann @johnpoz
                                  last edited by

                                  @johnpoz
                                  Ahh, yeah, didn't see it this way before, but absolutely agree.

                                  B 1 Reply Last reply Reply Quote 0
                                  • B
                                    brandon-lizard @viragomann
                                    last edited by

                                    @viragomann img06022021_0001.jpg

                                    B 1 Reply Last reply Reply Quote 0
                                    • B
                                      brandon-lizard @brandon-lizard
                                      last edited by

                                      @brandon-lizard

                                      I'm not too familiar with nat and forwarding/routing stuff. I've been reading up on it, but it confuses me.

                                      Are you saying it's not possible to access the computer at 10.47.2.101 from LAN 1?

                                      bingo600B V 2 Replies Last reply Reply Quote 0
                                      • bingo600B
                                        bingo600 @brandon-lizard
                                        last edited by bingo600

                                        @brandon-lizard

                                        I'm sure @johnpoz will suggest this soon.

                                        What pfSense device do you have ?
                                        Does it have possibility 3 netcards ??

                                        Here is a suggestion , that "keeps your" 10.47.1.x devices, no need to change ip addresses on the devices on that network (well except the linksys).
                                        And introduces a "Pure Transit network" (No user devices on it) behind the Linksys.

                                        Suggestion.png

                                        /Bingo

                                        If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

                                        pfSense+ 23.05.1 (ZFS)

                                        QOTOM-Q355G4 Quad Lan.
                                        CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                                        LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

                                        B 1 Reply Last reply Reply Quote 0
                                        • V
                                          viragomann @brandon-lizard
                                          last edited by

                                          @brandon-lizard
                                          @johnpoz already mentioned all options you have here.

                                          Best practice would be to set up a transit network between the Linksys and pfSense. So your LAN 1 devices simply send their packets to the Linksys and they get forwarded to pfSense.
                                          But I assume, that router isn't capable of handling multiple subnets.

                                          The other options are NAT or adding a static route for LAN 2 to each LAN 1 device you want to enable to communicate with that network.

                                          When doing NAT you have add virtual IPs to pfSense for each device behind you want to access and forwarded the packets to the destination devices.

                                          Both not optimal, I think. Maybe you can exchange the Linksys and pfSense, then you could set up a transit network.

                                          1 Reply Last reply Reply Quote 0
                                          • B
                                            brandon-lizard @bingo600
                                            last edited by

                                            @bingo600

                                            I do have 3 netcards available, yes. My pfsense is actually running in proxmox. I also have a nas and pbx. I'd like those to all be on the 10.47.2.0 network.

                                            johnpozJ bingo600B 3 Replies Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.