Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Multiple Pfsenses talking to each other?

    Scheduled Pinned Locked Moved General pfSense Questions
    15 Posts 3 Posters 1.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      josephchrzempiec
      last edited by

      Hello I have a Pfsense setup working no problems. But i would love to setup a second Pfsense for my brother he would like to have one. I have muiltiple Static IP addresses i can assign to each of them. But i was wondering If it is possible that both Pfsense talk to each other?

      i'm trying to put my brother on his own network for his own 2 servers without talking to my network.

      I have comcast. I setup a second router and for some odd reason they talk to each other. One has a 192.168.1x.XX address and the other has a 192.168.0x.XX address i can ping each other back and forth and see each other. I need to stop that. But concast if both are on the same subnet that is what happens.

      I'm not a programmer and Still new to hosting my own. I'm okay with hosting my own stuff but not others. Can someone help me to figure this out. I'm also slow at understanding and learning. Please forgive me. Also a lot of things from pfsense I don't know or understand yet.

      Joseph

      noplanN stephenw10S 2 Replies Last reply Reply Quote 0
      • noplanN
        noplan @josephchrzempiec
        last edited by noplan

        @josephchrzempiec

        Your brother in the same house?
        Ou got multiple static public IPs?

        If so
        Set up a second Wan with one of your static pub IPs
        Set him up with his own interface (optxxx) and his own ip range
        Deny rule that he can not access the other net
        And on top a limiter that he can only use a amount of your total bandwidth
        Allow rule to allow www traffic and you are good to go

        BrNP

        J 1 Reply Last reply Reply Quote 0
        • J
          josephchrzempiec @noplan
          last edited by

          @noplan Hello, Thank you I will look into this. I'm not sure how to do the whole Deny rule from one Pfsense router box to another pfsense router box. I'm okay with leaving the bandwidth unlimited because we have great internet here and he Pays for half of it and half the power bill.

          Joseph

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator @josephchrzempiec
            last edited by

            @josephchrzempiec said in Multiple Pfsenses talking to each other?:

            One has a 192.168.1x.XX address and the other has a 192.168.0x.XX address i can ping each other back and forth and see each other

            Those two subnets would usually be /24s and separate from each other unless you have routing enabled. They may both be in a larger subnet such as 192.168.0.0/16 in which case they would talk directly.

            Can we see a diagram of how this is connected?

            Steve

            noplanN 1 Reply Last reply Reply Quote 0
            • noplanN
              noplan @stephenw10
              last edited by

              @josephchrzempiec

              As
              @stephenw10 a diagram a painting whatever would be a great help to get u up n running

              Br np

              1 Reply Last reply Reply Quote 0
              • J
                josephchrzempiec
                last edited by josephchrzempiec

                Hello, Here is a image of my setup not the best drawing but I have tried my best. on the my main one is 10.1.151.1 the second router is 1692.168.0.1 Both have same subnetmask 255.255.255.0

                Mysetup

                noplanN 1 Reply Last reply Reply Quote 0
                • noplanN
                  noplan @josephchrzempiec
                  last edited by noplan

                  @josephchrzempiec

                  Hi there try it this way !

                  WAN yellow is whatever comcast serves to you
                  LAN green is your net.
                  OPT1 red is his net.

                  let us know if this helps ...

                  79f8f949-a77e-4b2a-a030-f715204657e6-image.png

                  your original version here:
                  98e42592-0589-40f4-bd39-0dd7fdd4fb79-image.png

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    Yes, using a single pfSense instance with multiple interfaces will give you the most control over the traffic between them. You can pass or block whatever you need.

                    If you want to have a 2nd pfSense and use a static WAN IP in the same subnet as the first pfSense then it will need to be connected the same way. So that will either be directly to the comcast device or via some type of bridged setup through the first one.

                    Steve

                    noplanN 1 Reply Last reply Reply Quote 0
                    • noplanN
                      noplan @stephenw10
                      last edited by

                      @stephenw10

                      start with this one first ;) before runnin down the road with a bridge

                      92940cae-3f2d-4bcc-8f5a-e804342155f2-image.png

                      J 1 Reply Last reply Reply Quote 0
                      • J
                        josephchrzempiec
                        last edited by josephchrzempiec

                        Hello all, Thank you I will try them. But I honestly don't know how to do one pfsense with multiple wan for the static ip addresses. Sorry If I'm Pharsing that wrong Still kind of new to pfsense and still learning. Also I'm not a programmer in any sense. I'm great at hardware. That is what I have been doing for the past 28 years. But I'm very good at following directions as well for help.

                        The second question is ports. Can i do multiple port 80s. Because my brother uses port 80 for his webserver. And I use it as well for mine. I do not know how what would work without using a second pfsense box.

                        Joseph

                        1 Reply Last reply Reply Quote 0
                        • J
                          josephchrzempiec @noplan
                          last edited by

                          @noplan Hello noplan. That is what I'm thinking of doing is to use multiple pfsense boxes.

                          Joseph

                          noplanN 1 Reply Last reply Reply Quote 0
                          • noplanN
                            noplan @josephchrzempiec
                            last edited by

                            Can i do multiple port 80s

                            yes you can but that's another topic, and you'll switch from port 80 to 443 for starters, and after you are runnin with pfS you'll have haProxy set up n runnin with a nice acme let's encrypt automatisation and of course an openVPN server and for an always on vpn on your mobile a fine wireguard. sounds cool ... but are all topics for another day 😁

                            how to do one pfsense with multiple wan for the static ip addresses

                            as a show stopper I dont know what your comcast device serves you (maybe somone here in the forum can help you out)

                            you set up a WAN with static IP
                            the easier way round is when your comcast device hands your public IPs out via DHCP
                            then you connect your OPT 1 (the third interface and not the LAN) again with your comcast device and set this interface up with a static IP as your WAN2.

                            now you have access to internet from lan over WAN1
                            next setp assing your opt3 interface to your LAN2 (the lan for the brother)
                            as you can see you need a box with 4 interfaces
                            assign IP / Mask to this interface and done
                            onward with firewall rules for quick test allow from LAN2 any to any (this will give you internet over WAN1)
                            the next set is routing .. .set a route form LAN2 to WAN2 easy
                            and you are set and done. then the fin starts with doing rules on the firewall to keep the LAN1 seperated form LAN2 (u got an any2any rule and wie have to fix it)

                            hope that helps a little.

                            1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              Yes, it really depends on how comcast are handing you the public IPs.

                              How is your current pfSense WAN configured?

                              I assume you have /29 from Comcast?

                              Steve

                              1 Reply Last reply Reply Quote 0
                              • J
                                josephchrzempiec
                                last edited by

                                Hellom I do not have any Pfsense Setup at the moment on my network. At my fathers house i have one setup. But at home I do not.

                                Here is how i have our network setup at home. Comecast comes in it is a gateway/modem/router. I have a lan port coming from comcast and going to a Tp-Link router wan port. And in the Tp-Link router I have the Second Static ip address information within the Tp-link router. I'm able to do everything from the Tp-link port forwarding on ip addresses and anything else Needed within the router. Basically Only Port forwarding only really that is all. And on the comcast Gatway/modem/router i do all my stuff without effecting my brothers network. Unless i unplug his network wire to the internet LOL

                                But basically he can do whatever he like without effecting my stuff.

                                Joseph

                                1 Reply Last reply Reply Quote 0
                                • stephenw10S
                                  stephenw10 Netgate Administrator
                                  last edited by

                                  Ok, so your public IPs are in the same subnet I assume?

                                  Does the TP-LInk actually get a public IP or is it port forwarded from the Comcast router?

                                  I would still suggest using a single pfSense instance with just a modem in front of it if you can.

                                  Steve

                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.