Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Warning about internal IP Range

    General pfSense Questions
    8
    31
    537
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • JKnott
      JKnott @AndyRH last edited by

      @andyrh said in Warning about internal IP Range:

      For the VPNs I always use 172.16 addresses.

      I have a /56 IPv6 prefix, which gives me 256 /64s. I match up the 3rd octet, in 172.16.x.y, with the prefix ID

      PfSense running on Qotom mini PC
      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
      UniFi AC-Lite access point

      I haven't lost my mind. It's around here...somewhere...

      1 Reply Last reply Reply Quote 0
      • K
        Kevin 4 @daduls last edited by Kevin 4

        @daduls
        Very time consuming!! Took all day to convert, but I moved to a 172.16.0.0 address setup.

        D 1 Reply Last reply Reply Quote 0
        • D
          daduls @Kevin 4 last edited by

          @kevin-4 But very rewarding when things work out. Hope your new setup stands the test of time.

          1 Reply Last reply Reply Quote 0
          • K
            Kevin 4 @johnpoz last edited by

            @johnpoz
            Well, everything was working fine overnight with the 172.16.0.0 and then it broke. Currently, I cannot seem to get the internet to pass to the network after the address change. The pfSense diagnostics can ping the internet and all the interfaces show working, but no internet.

            After getting frustrated troubleshooting, I reloaded a config file to reset everything and I was able to connect to the internet again. So I changed a single interface to one of the new address again (172.16.10.1/24) and updated the DHCP pool. I then reconnected to the pfSense via a cable using the new address and the computer won't connect to the internet. When I login to the pfSense using an interface with an old IP setup I can connect to the internet on the computer.

            I have no idea what setting I'm doing wrong...

            1 Reply Last reply Reply Quote 0
            • F
              FSC830 last edited by FSC830

              If you are using 172.16.0.0 and the client uses 172.16.10.1/24, these two will never connect.
              The client needs too a netmask which allows to reach the 172.16.0.0 network, use a /16 (255.255.0.0) and reduce step by step if needed.

              Regards

              K 1 Reply Last reply Reply Quote 1
              • K
                Kevin 4 @FSC830 last edited by Kevin 4

                @fsc830
                Appreciate the input, but that address is just an example. I've changed all the IP's on my switches and routers to the new address so they will connect. Everything was up and running, so I'm not sure if there was a slow setting change or what?

                I did try a /16 instead of the /24, but it was the same deal.

                D 1 Reply Last reply Reply Quote 0
                • D
                  daduls @Kevin 4 last edited by

                  @kevin-4 Have you updated all your firewall rules, aliases and NAT?

                  K 1 Reply Last reply Reply Quote 1
                  • K
                    Kevin 4 @daduls last edited by

                    @daduls
                    As far as firewall rules, I added a new 'allow all' rule to the top of the interface rule set to test it, but I haven't done anything to the aliases, but I'll try disabling them Do the rules need to be recreated when an interface changes IP?

                    When it comes to working with NAT, I wouldn't know what to check, I'm clueless...

                    K 1 Reply Last reply Reply Quote 0
                    • K
                      Kevin 4 @Kevin 4 last edited by

                      @kevin-4
                      I went ahead and deleted the firewall rules and aliases and now only have an allow all for testing. I also looked at the NAT and it shows an automatic entry for the new IP address.

                      D 1 Reply Last reply Reply Quote 0
                      • D
                        daduls @Kevin 4 last edited by

                        @kevin-4
                        First, I'm new to this, what got my vlans seeing traffic instead of the allow all rule was the "443,80,and 53" rules below. Notice I also kept the allow all rule below these though.....

                        firewall.jpg

                        K 1 Reply Last reply Reply Quote 0
                        • K
                          Kevin 4 @daduls last edited by

                          @daduls
                          Well, I couldn’t get it to work correctly so I’ve gone ahead and reinstalled the old configuration just to get back up and running. I’m going to do some research to see if I can figure out what’s going on and maybe try again when I have more time. Thanks to everyone for their input.

                          D 1 Reply Last reply Reply Quote 0
                          • D
                            daduls @Kevin 4 last edited by daduls

                            @kevin-4
                            Are you changing your LAN or adding a vlan? Don't know your setup but since you have the old config backed up you could go through "System-General Setup" if its for your LAN?

                            K 1 Reply Last reply Reply Quote 0
                            • K
                              Kevin 4 @daduls last edited by

                              @daduls
                              I was changing my LAN and VLANS to the 172.16.x.x. As I am studying the proper use of IP address and subnet schemes, I realize I should have used the /16 with a subnet of 255.255.0.0 as FS380 suggested above, instead of the 255.255.255.0 (/24).

                              I'll give it another try next week when I get a chance.

                              johnpoz 1 Reply Last reply Reply Quote 0
                              • stephenw10
                                stephenw10 Netgate Administrator last edited by

                                Using a /24 for a single interface/subnet is typical and shouldn't cause a problem.

                                Firewall and NAT rules would usually not need changing because they use aliases such as 'LANnet' and that would be updated. However if you have rules using specific IPs those obviously would.

                                Steve

                                1 Reply Last reply Reply Quote 1
                                • johnpoz
                                  johnpoz LAYER 8 Global Moderator @Kevin 4 last edited by

                                  @kevin-4 said in Warning about internal IP Range:

                                  I realize I should have used the /16

                                  No that is not a good idea.. /24 is the standard typical size that should be used on most networks, especially a home... It gives you plenty of IPs to work with 254.. Is easy to tell network X from network Y via the 3rd octet, and doesn't waste while large the limited rfc1918 space..

                                  /16 - you have plans of ever coming anywhere close to 65K devices on the network?

                                  Using such a large space also increase possible overlap.. talking to remote network..

                                  LAN and VLANS to the 172.16.x.x

                                  That wouldn't work with a /16 that would be the same network.. if using /24 for example 172.16.100, and 172.16.101/24 would be different networks.

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 23.01 | Lab VMs CE 2.6, 2.7

                                  K 1 Reply Last reply Reply Quote 1
                                  • K
                                    Kevin 4 @johnpoz last edited by

                                    @johnpoz
                                    Well, ok. That you all for that advice. I'm in over my head when it comes to IP's and their relationship to the subnets. (though I'm learning.).

                                    With that said, I'm still confused as to why my Netgate 6100 running pfSense+ stopped feeding the internet to the internal network after I made changes from:
                                    192.168.10.x to 172.16.10.x
                                    192.168.20.x to 172.16.20.x (VLAN)
                                    192.168.30.x to 172.16.30.x (VLAN)
                                    With subnet of 255.255.255.0
                                    All the networks are on the same interface and when I had completed the above changes to all the devices, everything was working fine.

                                    NOTE: I am making all the changes to the network addresses because I want to use something less common on my private network and I thought it would be fun to do so.

                                    Hours later I changed my VPN IP address from 192.168.100.0/24 to 10.11.12.1/24 (Which I did thinking that I'd not see this network very often when if I use the VPN on a public network.). As soon as I made the change, the internal network (which was still working), stopped receiving the internet from the firewall and I couldn't fix it.

                                    Looking back, I should have changed the VPN back to see if that was the cause, but at the time I figured it couldn't be that. After a few hours of troubleshooting I converted back to the old setup via a backup config file.

                                    Is there anything obviously wrong with what I am attempting?

                                    D 1 Reply Last reply Reply Quote 0
                                    • D
                                      daduls @Kevin 4 last edited by

                                      @kevin-4
                                      When I made a change after setting up my VPN I experienced a very similar outcome. I don't think all the additional configurations (VPN) follow the changes to the LAN IP. Where some would think this convenient, security is never convenient and PFSense is designed to be secure.

                                      My solution was to start over. I reinstalled from usb with my new IP, recreated all the vlans and the VPN.

                                      All I can say is it was tedious but it works. I'm much more 'begin with the end in mind now".......

                                      K 1 Reply Last reply Reply Quote 0
                                      • stephenw10
                                        stephenw10 Netgate Administrator last edited by

                                        The subnet changes you made should have been fine. There's nothing wrong with those values.

                                        I would guess that you either lost the default route/gateway for some reason or created a subnet conflict with that VPN subnet.
                                        Its possible your ISP could be using an IP in that subnet for their gateway IP. It would probably have to be a PPPoE WAN for that though. For example my ISP here uses 172.16.13.252 for the gateway and that's inconvenient.

                                        Steve

                                        K 1 Reply Last reply Reply Quote 1
                                        • K
                                          Kevin 4 @daduls last edited by

                                          @daduls
                                          I’ve been thinking the same thing. Do a factory reset and start over using the new configurations. I have learned a lot of cool stuff trying to work on this issue. There is a YouTube channel CertBros that are awesome in their networking fundamental videos. It filled in a lot of gaps in for me.

                                          I appreciate your input @daduls

                                          1 Reply Last reply Reply Quote 0
                                          • K
                                            Kevin 4 @stephenw10 last edited by

                                            @stephenw10
                                            I appreciate the confirmation of the values. I’ll try again soon.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post