Expanding address space on LAN - What concerns do I have to watch for?
-
I'm using an SG-1100 with pfSense for my firewall. On the WAN side I have a connection from there to a Starlink router and a Starlink dish. On my LAN side, it acts as DHCP and DNS. My current address space for my LAN is 172.16.1.xxx. I'm using a fair number of Raspberry Pis in my workshop to control tools (3D printers, CNC, lights and webcams...) and am dealing with some other issues that mean more systems on my LAN than I ever expected. While it's under 100 systems, I like to allot my address space in blocks, like 0-16 for desktops, laptops, and so on, another range for home automation, another for IoT devices, and so on. It's a lot easier to allot more space than I think I'll ever need. While I really don't HAVE to, I'd like to expand the address space to include 172.16.2.xxx (netmask 255.255.254.0). Also worth noting that while this may not be necessary, everything like this that I do, I also consider a chance to learn more.
I know I would have to change the address range and mask under the DHCP settings. What else do I need to change, in pfSense to make this change work and go smoothly?
Outside of pfSense, on some computers, I figure I may have to change the netmask or range for some computers. For instance, on MacOS, under Ethernet, I need to change my subnet mask from 255.255.255.0 to 255.255.254.0. (Or will that be updated after I make the change in the DHCP server in pfSense and and that info is propagated from the DHCP server through to the systems on my LAN?)
What are other things in pfSense and with systems on the LAN that I might have to change or watch out for?
-
As long as nothing else is already using 172.16.2.0/24 it should be easy to do. You only need to change that on the LAN interface config itself and the DHCP range running on it.
Anything using DHCP will be updated when the lease is renewed.
If you have any statically configured devices those will need to be manually updated in order to reach devices in the new range.
Steve
-
@stephenw10 said in Expanding address space on LAN - What concerns do I have to watch for?:
Anything using DHCP will be updated when the lease is renewed.
If you have any statically configured devices those will need to be manually updated in order to reach devices in the new range.
Note this a good reason to use DHCP reservations instead of static IPs on a large network. :)
-
@SteveITS I would say even on a small network - all of my devices are just reservations..
-
Same here. The only devices that have a static config are my main desktop computer and pfSense. Everything else has has static mapped DHCP.
-
@JKnott said in Expanding address space on LAN - What concerns do I have to watch for?:
Same here. The only devices that have a static config are my main desktop computer and pfSense. Everything else has has static mapped DHCP.
My static IP addresses are all mapped through the DHCP server. I wouldn't even do that, but I've used a few programs here and there that, for some stupid reason, require me using the IP address of the other machine on my LAN to connect. They're not high security apps and, on my LAN (and I suspect most LANs), a hacker with a bit of experience could ghost a MAC address and get the same IP address just like stealing the name. So I really don't see any reason for a program to use an IP address instead of the hostname.
-
I use static mapping for convenience. The host name is just part of the config.
-
Just verifying that I did this as discussed and it worked. All my systems on the LAN use DHCP and any assigned addresses are handled by the DHCP server in pfSense. All I did was go to the General Configuration page and change the mask to 23 bits instead of 24 and saved and applied that. Now I have a 512 address range instead of 256.
-
@TangoOversway said in Expanding address space on LAN - What concerns do I have to watch for?:
Now I have a 512 address range instead of 256.
Wait till you go to IPv6 and have an 18.4 billion, billion (2⁶⁴) address range.
-
Okay - found more trouble with this.
I put one Raspberry Pi in the new address space and it can't reach the internet. When I changed the IP address back to within the old subnet I was using, the Pi could reach the internet. There was no problem, under either setting, with communication on my LAN.
I checked firewall rules and don't see anything that I think would limit traffic to the original address space.
What's going on and what do I need to do so a device in the new address space can reach the internet?
-
@TangoOversway Usually, that means a subnet mask is wrong on the Pi or pfSense, and it can’t talk to the “other” part of the subnet.
-
@SteveITS said in Expanding address space on LAN - What concerns do I have to watch for?:
Usually, that means a subnet mask is wrong on the Pi or pfSense, and it can’t talk to the “other” part of the subnet.
If that were the case on the Pi (which is using DHCP, so it's getting the info from pfSense), then I would think it wouldn't be able to communicate with the rest of my LAN.
So would that narrow it down to a firewall rule on the LAN in pfSense?
-
@TangoOversway well for instance a wrong mask might let a device talk to .1-.255 but not .256-.511.
Firewall rules would apply to Internet traffic but not internal traffic. So yes that could block internet.
-
I checked my firewall rules. I don't remember making these, but there was a time when I was experimenting with various VPNs and it's possible I added some rules at the time, but I don't remember leaving any behind. Here's my firewall LAN rules - are these default rules?
-
@TangoOversway those are just default ones - make sure you check in floating tab for any rules.
-
Okay, looked at NAT, I see some that specify a specific address range:
(Note: I originally was talking about a 172.16.1 subnet, but I'm using 172.16.7 as the original and 172.16.6 as the new one.)
Those last two NAT rules that specify the 172.16.7 subnet - are they default rules? (I'm thinking I may have made those when experimenting with VPNs and may have forgotten to delete them.)
-
Are your outbound NAT rules set to manual? If so you would need to update them.
-
@TangoOversway yeah if you messed with some vpn, most of their shit guides tell you to move to manual nat, when all that is needed is hybrid.
-
Yes, set to manual. So by "update," I take it you mean to specify my new address range in the rule, as opposed to some kind of system update or anything like that, right?
If I'm not running any VPNs or anything fancy, do I need those rules? Are they normal or default pfSense rules?
-
@TangoOversway even if you were running vpn, there is no need to be set to manual for your outbound, you can just use hybrid and create the rule you want to nat to your vpn connection.
I would switch it back to auto, and delete any of those manual nats..
