Is this setup possible?

Panja

I want to know if the following setup is possible with pfSense:

2x WAN connections (2x ADSL) to the pfSense box.
1x LAN connection to the switch.
1x Windows Domain Controller connected to the switch.
Multiple employee computers connected to the switch.
Multiple management computers connected to the switch.

The employee computers need to use the ADSL 1 line to go outside.
The management computers need to use the ADSL 2 line to go outside.
So basically what I want is all computers in the same LAN but when someone from management goes online (internet),
they need to go on a different ADSL line than all other employees.

Is that possible?
If the answer is yes, how? ;D

Click on the picture for a bigger version.

Derelict

Sure if you set it up correctly.

The only significant hurdle I see is if both ADSL lines are from the same provider with the same gateway IP address.

Panja

That is correct. Both lines are from the same provider.
Probably they both use the same gateway. Need to double check that to confirm.

How do I set it up (correctly)?
Do you have any pointers?

Derelict

docs.pfsense.org multi-wan & policy routing.

See if they can put each circuit on a different subnet.

phil.davis

And in your DHCP on LAN make static mappings for the client computers - give Management computers LAN IP addresses in one range and Employee computers another range.
Make an Alias for each range.
In your LAN rules:

match the Management alias as source and select the Management ADSL gateway.
match the Employee alias as source and select the Employee ADSL gateway.
do what you like with "anything else", or block it, or…

And pick the slower ADSL for Management:)

Derelict

+1.

Don't make your ranges decimal like 100-150 and 151-200. Make them subnets like 33-62 (/27) and 129-190 (/26).

Panja

Thanks guys, sounds good to me!

Is it really a big problem if both ADSL lines have the same gateway?

@phil.davis:

And pick the slower ADSL for Management:)

Hahaha will do!! :D

Derelict

Yes.

Panja

Ok, I will check with the provider.

phil.davis

You can work around the same upstream gateway problem by leaving 1 or both ADSL modems in routing mode. Give the ADSL modem LAN side some IP/subnet(s):

10.42.1.1/24

10.42.2.1/24

and the pfSense WANs

WAN1 10.42.1.2/24 with gateway 10.42.1.1
WAN2 10.42.2.2/24 with gateway 10.42.2.1

Use 2 different monitor IPs out on the real internet, e.g. 8.8.8.8 8.8.4.4, for pfSense to monitor if the series of hops up to the real internet are functional on each WAN.

Then the ADSL modems can make the upstream connection to the ISP.

Downsides:

Double NAT - pfSense is doing NAT and the ADSL modem does it again.
If you want to provide externally accessible services (road warrior VPN, web server…) then you have to set up the ADSL modems to port forward all incoming through to the pfSense WAN - but that does work for me where I have had to do it.
pfSense is not going to know when the front-end ISP-supplied IP address changes. If you need dynamic DNS then you need to install the Cron package and use it to modify the cron job that checks the public IP address so it runs as regularly as you want to respond to a front-end public IP change.

Panja

Thanks Phil, appreciated!
I want to push the thank you button on your post, but it's not there.
So via this way: thanks! :)

Panja

@Derelict:

+1.

Don't make your ranges decimal like 100-150 and 151-200. Make them subnets like 33-62 (/27) and 129-190 (/26).

Maybe a "dumb" question…?
But why use different subnets?

Derelict

So you can easily make rules covering each application.

They are not different subnets, just ranges of IP addresses easily-covered using one firewall rule.

Panja

Ahhh oke.
I must have misunderstood your reply.

You just mean (for instance):
192.168.1.1 /26
192.168.1.65 /26
192.168.1.129 /26
192.168.1.193 /26

Am I right?

Derelict

Right.

Snailkhan

@phil.davis:

You can work around the same upstream gateway problem by leaving 1 or both ADSL modems in routing mode. Give the ADSL modem LAN side some IP/subnet(s):

10.42.1.1/24

10.42.2.1/24

and the pfSense WANs

WAN1 10.42.1.2/24 with gateway 10.42.1.1
WAN2 10.42.2.2/24 with gateway 10.42.2.1

Use 2 different monitor IPs out on the real internet, e.g. 8.8.8.8 8.8.4.4, for pfSense to monitor if the series of hops up to the real internet are functional on each WAN.

Then the ADSL modems can make the upstream connection to the ISP.

Downsides:

Double NAT - pfSense is doing NAT and the ADSL modem does it again.

If you want to provide externally accessible services (road warrior VPN, web server…) then you have to set up the ADSL modems to port forward all incoming through to the pfSense WAN - but that does work for me where I have had to do it.

pfSense is not going to know when the front-end ISP-supplied IP address changes. If you need dynamic DNS then you need to install the Cron package and use it to modify the cron job that checks the public IP address so it runs as regularly as you want to respond to a front-end public IP change.

for the bold part.
for most adsl modems if you put the lan ip in dmz settings then the adsl modem forwards all traffic to that lan ip..

you can verify it by removing all virtual server / port forwarding entries and then assignging static ip to your system and then assignign it in dmz and then check from itnernet some ports that you can open on your ssytemm.. remember on consumer grade connection certain ports (like 80,25 etc ) are blocked. so try some other ports

phil.davis

for most adsl modems if you put the lan ip in dmz settings then the adsl modem forwards all traffic to that lan ip.

Correct - many consumer-grade devices use the term "DMZ" when they are not making a separate protected network at all, the "DMZ" they make is just a port-forward-all to the specified inside IP address.

Panja

Thanks guys!

Panja

I have checked with the provider, both use the same (external) gateway address.
Putting the modem IP in the exposed host list (DMZ) is not possible, the Fritzbox won't accept that.

If I make the following setup, would that work too?? 8)

Give modem 1 –> 10.42.1.1
Give Modem 2 --> 10.42.2.1

Give pfSense WAN port 1 --> 10.42.1.2
Give pfSense WAN port 2 --> 10.42.2.2

Put IP 10.42.1.2 (for modem 1) on the exposed host list (DMZ).
Put IP 10.42.2.2 (for modem 2) on the exposed host list (DMZ).

Snailkhan

@Panja:

I have checked with the provider, both use the same (external) gateway address.
Putting the modem IP in the exposed host list (DMZ) is not possible, the Fritzbox won't accept that.

If I make the following setup, would that work too?? 8)

Give modem 1 –> 10.42.1.1
Give Modem 2 --> 10.42.2.1

Give pfSense WAN port 1 --> 10.42.1.2
Give pfSense WAN port 2 --> 10.42.2.2

Put IP 10.42.1.2 (for modem 1) on the exposed host list (DMZ).
Put IP 10.42.2.2 (for modem 2) on the exposed host list (DMZ).

yes this sounds good..
you can connect some pc (test machine) to lan of pfsene an open ports from wan to lan (inbound nat on pfsense ) and scan live ip of each modem to see if it is working…