Issues with second pfSense on Network
-
Hello,
TLDR; Have nested pfsense, computers connected to the nested pfSense can not access the Internet.
I am just starting out with pfSense and am having some issues getting a second pfSense box setup behind the first one.
My primary pfSense box is a 1u supermicro server. My intent is to have three ISPs 'joined' through the server. At the moment I only have it set up with two ISPs, T-Mobile 5G Residential and T-Mobile 5g Business. I will switch over my Comcast when I get the final setup working. One LAN port then feeds to Ubiquiti and I am using a L3 switch to separate some VLANs and keep my IoT devices segregated (to be set up still).
NOTE: I'd rather pay T-Mobile $50 a month than pay comcast an extra $40 for unlimited data when the cap goes into effect next month.
From my primary pfSense I connect an additional pfSense which my home lab will sit behind. The nested pfSense will create a VPN to a VPS to use a static IP for the servers. I intend to have separate VLANs to keep server groups on their own networks. My problem is I can not get my first server to access the Internet.
ISPs>pfSense1>pfSense2>Server1
I've read the forums and made a little progress in getting pfSense2 assigned a IP from pfSense1.
Can anyone point me to some documentation that may help with the configuration issue or suggest an alternative way? Worst case I can stand up pfSense2 separate with its own ISP but then I cant take advantage of that ISP to offload some traffic.
-
@aglarond to the 1st pfsense, the 2nd pfsense would be nothing be a normal client. Do your normal clients behind the 1st pfsense work?
Then your 2nd pfsense and clients behind it would work.
One thing that comes to mind would be your 2nd pfsense having the same network on its wan as its lan could be a problem.
So pfsense 1 lan defaults to 192.168.1/24, so if you hand out 192.168.1.x to pfsense 2 wan, its default lan also being 192.168.1 would be problematic at best.
Change your 2nd pfsense lan to something other than what your using on its wan.
-
"@aglarond to the 1st pfsense, the 2nd pfsense would be nothing be a normal client. Do your normal clients behind the 1st pfsense work?"
-Yes. I only have 1 LAN at this time which goes to my ubiquiti switch, but all clients behind that switch are able to access the Internet and pfSense is using both ISPs that are connected at this time.
"Then your 2nd pfsense and clients behind it would work.
One thing that comes to mind would be your 2nd pfsense having the same network on its wan as its lan could be a problem.
So pfsense 1 lan defaults to 192.168.1/24, so if you hand out 192.168.1.x to pfsense 2 wan, its default lan also being 192.168.1 would be problematic at best."
Change your 2nd pfsense lan to something other than what your using on its wan.-I thought I had it set to 192.168.10.1 but will need to check again. I do know that the second pfSense is unable to connect to the Internet to see if it is up to date, so I want to resolve that part of it first which would be on the pfSense1 configuration or the pfSense2 WAN configuration
-
This is how I have the two LANs configured:
(works) Clients:
-Static IPv4
-Track Interface
-192.168.1.1
-Upstream: None
-IPv6 Interface: Residential_ISP
-Blocks unselected(No Internet) pfSense2:
-Static IPv4
-Track Interface
-IPV4Address 192.168.10/24
-Upstream: None
-IPv6 Interface: Business_ISP
-Blocks unselected -
@aglarond what is the WAN on pfsense 2?
-
pfSense2 WAN:
-IPv4 Config: Static IPv4
-IPv6 Config: DHCP6
-IPv4 Address: 192.168.10.1/24
-Upstream Gateway: None
-Blocks UnselectedWhen I am on the sever connected to the pfSense2 I can access the pfSense2 Web GUI at 192.168.1.1 and the pfSense1 Web GUI at 192.168.10.1; somewhere these are backwards which may be the issue?
-
On a machine connected to pfSense1, both 192.168.1.1 and 192.168.10.1 take me to the web GUI of pfSense1
-
@aglarond said in Issues with second pfSense on Network:
-IPv4 Address: 192.168.10.1/24
-Upstream Gateway: NoneHow would that work? Your pfsense wan needs to be on pfs1 lan..
How would no gateway being set work?? Your gateway on pfsense 2 wan is pfs1 lan.
this is how it could work using pfs1 lan as your transit..
This would be better way to have a downstream pfsense via a transit network and not natting at the 2nd pfsense
-
Thanks for pointing out the area I need to correct. I will try adjusting the mappings to see if I can get it working.
For the second (better) way, if I search the forums for 'transit network' will that point me in the proper way for setting it up?
-
@aglarond You will find many a post by me going over transit networks ;) have to explain it like every other day it seems ;)
Users are always trying to use their normal lan as transit and then wonder why they run into asymmetrical issues.
Here is a good drawing that explains what has to be down with a downstream router.
-
J jimp moved this topic from Problems Installing or Upgrading pfSense Software on
