getting out of IP-addresses

Brian Smit

Hello everyone,

i have quite a lot of devices connected behind my rock solid Pfsense and i wonder if working with VLANs would be the only solution to solve this "problem"

AndyRH

The description is a little thin. VLANs would give you more subnets or change the subnet mask to /23 instead of /24 and pickup another 255 addresses.
250 devices on one network is frequently considered plenty, but there are reasons to go with bigger networks.
I would tend to a 2nd VLAN, but with rules and such it is more work. Changing subnet masks is a fair amount of work, but it is a 1 time thing.

johnpoz

@brian-smit so your in the 200+ range for devices? This is company I take it then?

While segmentation does have advantages, there is a bit of learning curve and requirements that your other infrastructure support them, switches and access points. And work in configuring all of that on your switches and AP, etc.

While moving to a /23 or even a /22 would provide many more address. And if your devices are all dhcp or reservations switching to larger network via just changing the mask could be quite simple..

Now if your all static devices, then changing the mask could be painful..

But lets say you were on 192.168.0/24, moving to 192.168.0/22 would give you 1000 some address to work with, and really nothing to do but change the mask on pfsense. Pfsense IP could still be 192.168.0.1 and your dhcp scope would just need to be adjust to start handing out address in 192.168.1 and .2 and .3, etc..

I personally wouldn't suggest going past /22 if at some future date you plan on having that many IPs.. As you put more and more devices on the same network - broadcast and multicast traffic by chatty devices can get problematic.

JKnott

@brian-smit
What problem?

johnpoz

@jknott running out of IP on his mask, yeah it is not worded great. Subject is the problem ;)

Brian Smit

Thx all for the help and ideas !
I wondered how to handle IF i run out of "free" IP-addresses in the 192.168.0.x range.
The IP-address of my PFsense machine is indeed still 192.168.0.1

I think i will solve it by running the DHCP scope in the 192.168.1.x range and my static addresses are in the 192.168.0.x range

@johnpoz Thank you for the great help!

johnpoz

@brian-smit changing the mask on your pfsense interface would update clients as they renew their lease, or do a dhcp inform, etc.

Where you could run into a bit of an issue, is when you first turn it on.. And say a client gets a 192.168.1.X/23 IP from dhcp, talking between that device that has not yet updated to this /23 mask is prob not going to work..

While the new client 192.168.1.x/23 would know that 192.168.0.x is on its network - the 192.168.0.x device if still on the /24 mask would think that device is on a different network and send its answer to pfsense. This would be asymmetrical and problematic.

But once your old clients have updated to the /23 mask - you would be fine. Or once you have updated any static devices on your /24 to the new /23 they will all be fine.

Once you have made the change - prob best to let everyone know to just reboot. Now if your devices don't actually talk to each other, or you don't have servers they need to talk to - not going to be a problem.. And all of your dhcp clients should be on the new /23 within say 50% of your lease time - which is default of 2 hours. So like in an hour all your clients should really be on the new /23 mask.

bingo600

Another trick is to lower the ~~DNS~~ DHCP lease time to like 5..10min , a few hours before doing the change (more than the current lease time).
Do the subnet expansion , and the clients should learn within the new short dhcp lease time.

After that , restore the desired (old) lease time again.

Used to do that when changing DNS'es in the "Enterprise"

/Bingo

johnpoz

@bingo600 think you got some mixup of dns and dhcp -- but sure you could lower the lease of your dhcp.. So clients would renew faster after you have changed the mask.

And yeah the same trick goes for TTL records on dns, before you change a record, etc.

I get what your saying.. And its a good point..

And yeah that trick can work for any options you want to hand out via dhcp, be it their gateway, their dns, their ntp, domain search, etc. Before your going to make such changes lower the lease to something really low.. And then after you have made the change and your sure everyone has updated change the lease time to what you normally like to run.

bingo600

@johnpoz said in getting out of IP-addresses:

@bingo600 think you got some mixup of dns and dhcp

Yepp -- corrected above.

Offcause i meant DHCP lease

/Bingo

JKnott

@brian-smit

You don't have to do that, just expand your subnet. After the devices have had time to adjust to the new subnet size, you can start adding addresses in the new range. If you don't want to reboot the devices individually, you can just turn the switch off & on, which should cause all the connections to restart. Or you can just let the leases expire & renew.

JKnott

@bingo600 said in getting out of IP-addresses:

Offcause i meant DHCP lease

Yeah, right.