Two subnets
-
@Antibiotic said in Two subnets:
mini router port forwarding to pfSense.
No... You have this..
If you want to get to 12.100 say on port 666 from 10.100 you would have to port forward on your nat router traffic hitting its 11.2 address to 12.100
Your client on on 10.100 would have to hit the 11.2 address
The cleaner solution is to just use this router as AP/switch and put it on the 11 network, and then create your vpn on pfsense and policy route traffic out your vpn on pfsense. With a bypass of your policy route so if devices on the 11 network want to talk to the 10 network the rule is above your policy route on the 11 interface.
If your rules on 11 allow to talk to 10 then anything on the 12 network would be able to do that, as long as the nat router doesn't force their traffic out the vpn. Because to the 10 device it would just be 11.2 talking to it. because your natting.
-
@johnpoz Aha , will try to do now and test))))
-
@Antibiotic If you want to get to 12.100 say on port 666 from 10.100 you would have to port forward on your nat router traffic hitting its 11.2 address to 12.100
But port number could be any , how you write 666 or should be 80:443 -
@Antibiotic the 666 was just an example port.. You would setup the port forwards you want to use on that nat router.
-
@johnpoz Second question, how to define the same IP for all time. Add static mapping in DHCP lease page?
-
@Antibiotic for what device? Yes for your 2nd nat router you could either set reservation on pfsense dhcp server for that 11 network, or you could just set it static on the router.
For stuff on your 12 network that would be done on that nat router dhcp server, or on the devices themselves behind that router.
Why not just setup the vpn on pfsense and use policy routing to route the stuff you want out this vpn, this could be specific IPs or the whole network.. I just don't see a good reason to complex up the setup like this.
-
@johnpoz But have to put port forward rule for each device, impossible to make one rule for all clients for example behind 192.168.12 to 192.168.10 behind
-
@Antibiotic Yeah you would need to create port forwards for anything you want to access behind this nat router.. Again going to stress that this solution is not very good.. Especially if you want to talk to stuff behind this router.
And no you can not port forward say port 80 to all devices behind, without having a different IP on its wan.
You could turn off its nat, and just use it as a downstream router where your 11 network is the transit, this would be a better solution.. Then you wouldn't need to do any port forwards. And you could access everything behind on the 12 network via its actual IP.
-
@johnpoz But if will switch off NAT on Wireless router working in router mode connected to LAN of pfSense , how clients behind this Wireless router will have internet access or me don't understand something? Like understanding NAT to make 1 IP on WAN for all clients in this network but in this case how will all this work?
-
@Antibiotic yeah your not understanding is my guess.
You can use this 2nd router as just a router, and firewall I would take it.. Not sure what firmware your running on it.
You would just set it up as a downstream router. It just won't nat the IP ranges. Pfsense would nat any traffic from this downstream network, just how its doing now for your 10 and 11 networks.
See the left setup with a downstream router (L3 switch doing routing).. That would be your "nat router"
-
@johnpoz I have Asus merlin firmware RT-AX86U Pro router
-
@johnpoz Asus router have on WAN option Forward local domain queries to upstream DNS. Is it better to keep ON, because have pfBlockerNG on pfSense? or it doesn't matter
-
@johnpoz Thank you for perfect explanation with a schemes , have in mind a lot new! You are the best)))
-
@johnpoz So finally better to switch OFF NAT and firewall on Wireless router and set on pfSense router interface LAN 192.168.11.1/29 not 24. Is it correct?
-
@Antibiotic Invalid DHCP pool 192.168.11.10 - 192.168.11.30 for WIFI subnet 192.168.11.0/29 detected. Please correct the settings in Services, DHCP Server
-
@Antibiotic if you set a /29 on pfsense interface - how would you think you could have a dhcp range of .10 to 30?
You don't have to use the /29 as your transit.. That just a example, you can use any network you want for your transit network.
-
@johnpoz So can leave 192.168.11.1/24?
-
@Antibiotic sure.. keep in mind a transit network shouldn't have any "hosts" on it - so not sure why would would "need" a /24.. but sure you can use it as long as doesn't overlap with other networks. When you put hosts on a transit network your most likely going to run into asymmetrical routing problems.
-
@johnpoz So you mean better do not put any devices in LAN of Wireless router?or what it mean hosts?
-
@Antibiotic yeah a device.. be it a phone or pc or anything that is going to talk to anything.. Ie not a router.. These devices do not belong on a "transit/connector" network..
