Two subnets
-
@Antibiotic for what device? Yes for your 2nd nat router you could either set reservation on pfsense dhcp server for that 11 network, or you could just set it static on the router.
For stuff on your 12 network that would be done on that nat router dhcp server, or on the devices themselves behind that router.
Why not just setup the vpn on pfsense and use policy routing to route the stuff you want out this vpn, this could be specific IPs or the whole network.. I just don't see a good reason to complex up the setup like this.
-
@johnpoz But have to put port forward rule for each device, impossible to make one rule for all clients for example behind 192.168.12 to 192.168.10 behind
-
@Antibiotic Yeah you would need to create port forwards for anything you want to access behind this nat router.. Again going to stress that this solution is not very good.. Especially if you want to talk to stuff behind this router.
And no you can not port forward say port 80 to all devices behind, without having a different IP on its wan.
You could turn off its nat, and just use it as a downstream router where your 11 network is the transit, this would be a better solution.. Then you wouldn't need to do any port forwards. And you could access everything behind on the 12 network via its actual IP.
-
@johnpoz But if will switch off NAT on Wireless router working in router mode connected to LAN of pfSense , how clients behind this Wireless router will have internet access or me don't understand something? Like understanding NAT to make 1 IP on WAN for all clients in this network but in this case how will all this work?
-
@Antibiotic yeah your not understanding is my guess.
You can use this 2nd router as just a router, and firewall I would take it.. Not sure what firmware your running on it.
You would just set it up as a downstream router. It just won't nat the IP ranges. Pfsense would nat any traffic from this downstream network, just how its doing now for your 10 and 11 networks.
See the left setup with a downstream router (L3 switch doing routing).. That would be your "nat router"
-
@johnpoz I have Asus merlin firmware RT-AX86U Pro router
-
@johnpoz Asus router have on WAN option Forward local domain queries to upstream DNS. Is it better to keep ON, because have pfBlockerNG on pfSense? or it doesn't matter
-
@johnpoz Thank you for perfect explanation with a schemes , have in mind a lot new! You are the best)))
-
@johnpoz So finally better to switch OFF NAT and firewall on Wireless router and set on pfSense router interface LAN 192.168.11.1/29 not 24. Is it correct?
-
@Antibiotic Invalid DHCP pool 192.168.11.10 - 192.168.11.30 for WIFI subnet 192.168.11.0/29 detected. Please correct the settings in Services, DHCP Server
-
@Antibiotic if you set a /29 on pfsense interface - how would you think you could have a dhcp range of .10 to 30?
You don't have to use the /29 as your transit.. That just a example, you can use any network you want for your transit network.
-
@johnpoz So can leave 192.168.11.1/24?
-
@Antibiotic sure.. keep in mind a transit network shouldn't have any "hosts" on it - so not sure why would would "need" a /24.. but sure you can use it as long as doesn't overlap with other networks. When you put hosts on a transit network your most likely going to run into asymmetrical routing problems.
-
@johnpoz So you mean better do not put any devices in LAN of Wireless router?or what it mean hosts?
-
@Antibiotic yeah a device.. be it a phone or pc or anything that is going to talk to anything.. Ie not a router.. These devices do not belong on a "transit/connector" network..
-
@johnpoz So , again misunderstanding, I can use LAN of Wireless router to connect devices but this devices should belong to transit network. Is it correct? Should be in network for example 192.168.11.0/24
-
@Antibiotic dude if your going to use your 11 network to connect your router.. Then those should be the only thing on that network pfsense and your downstream router.
Put your stuff on either the 10 network or the 12 network behind your router...
-
@johnpoz So LAN of Wireless router should set for example 192.168.50.1 , Its correct?
-
@Antibiotic what? Yes you can use any network you want, as long as its doesn't overlap with yoru lan (10 network) or your lan 2 (11 network)...
-
@johnpoz Thank you very much)))
