single WAN /27 ip block multiple PFSense routers
-
Hi, I have a situation that I need some help with. I have a /27 WAN at a datacenter and a virtual host hosting multiple virtual networks. Each virtual network has a virtual PFSense with it's own public IP address. This has worked fine for some time now but now, the virtual networks need to be able to access a resource on one of the other virtual networks. Since their public IP addresses are on the same block, I can't get them to look at the other networks. in the attached picture, Router1 has a web server behind it that the network behind Router2 needs to access. Is this possible?
-
@jcampbell
You need to add static on both routers.
On each router add the IP of the other as gateway (System > Routing > Gateways).
The add a static route for the network behind the other and state the other router's as gateway. -
@jcampbell so these are all doing nat? And the the devices behind router 2 need to access it via what the public IP that you forward to the web server or will it access it via the rfc1918 address?
-
@johnpoz It needs to be able to see it via the public IP of router1.
-
@jcampbell Well that should just work out of the box..
-
@johnpoz That is what I thought but I can't get it to work. From any of the other networks. And I think it is because they all have the same gateway since they are on the same WAN subnet. But, I am just guessing.
-
@johnpoz actually, after look at the logs from the web server, it did work out of the box and has stopped working. The web server is accessible everyone else, just not from these virtual networks. Strange.
-
@jcampbell Is there something in the virtual switch that is isolating them? If you allow ICMP from the other routers can you ping or traceroute?
-
@steveits I cannot ping the WAN interface on Router1 from any machine in the network of Router2 or Router3 but can from anywhere else outside the virtual environment. The virtual setup is pretty simple. Using Hyper-V with physical port on each WAN virtual switch on each virtual router, then the virtual switch for each LAN is private. Also, from the network behind router1, I cannot ping router2 or 3 so this is blocked in both directions. Not sure what changed other than updating PFSense to 2.6.0 recently.
-
@jcampbell said in single WAN /27 ip block multiple PFSense routers:
Not sure what changed other than updating PFSense to 2.6.0 recently.
That would have zero to do with anything.
If x.x.x.3/27 can not ping x.x.x.1/27 in the same network.. And you have icmp allowed on router1 wan interface the problem is in your network they are a part of.. Do you see the mac address in your arp table router 2 or 3?
-
@johnpoz figured it out. It was as stupid thing I did to try to remember the public IPs I had given the virtual networks. I set them up as virtual IPs and labeled them Do Not Use thinking it would just be a place holder that would not matter unless I created a NAT policy with them. But, apparently it does matter. After I deleted those virtual IPs, all traffic came back and web access resumed.
I'm an idiot. Thanks for your assistance!
