Broken network scenario is broken
-
hello Dears,
i have a small simple network, and i get pfsense to act as simple firewall and traffic monitor
i install it in pc with 2 network interface,the problem that i found, is that if the LAN ip range is the same with WAN ip range, then the pfsense WAN couldn't see the router (gateway)
my network router is 192.168.1.1, and the pfsense WAN ip 192.168.1.4, and the LAN IP 192.168.1.5
if any one test this simple config it will not work with him !!!
i read the Initial pfsense installing doc @ https://doc.pfsense.org/index.php/Installing_pfSense#Assign_Interfaces_on_the_Console but i did't find any mention that this simple setting are not allowed
i want to told you that i am newbie with pfsense ( only 20 hours examination ), but this is not case to prevent the experts and developer here to give attention to me topic, it's seriously may be a bug !
i want to thank the developers, i read the pfsense history :) and i hope they go further and further . .
thank you all . .
-
you can not route identical subnets.
this is not a bug as there might be a scenario where this isn't an issue. (a transparent filtering bridge for example)
So in you case, this can never work. In other cases, this might be intended.
-
thanks for you quick reply, but why not !
a friend test this same scenario but with Microsoft TMG, and it's worked fine !
every interface is separated from the other, the router (192.168.1.1) was attached to WAN (192.168.1.4), and all the network was in one switch with LAN interface, and the TMG work as a gateway for the LAN network with IP 192.168.1.5
the result from this scenario all PC go up to internet with the TMG as a gateway, and no pc can see the outer or ping it, as it's not existed in the LAN network.
So, the question is why pfsense, although every interface must work independent ?
-
a town has 2 streets with the exactly same name & numbering scheme.
it is impossible for guy/girl from the post office to deliver letters/packages to either of the 2 streets, because the addresses are identical.
-
When you come up with a network "design" such as the one mentioned in the OP, the real question here is "should I really maintain my firewall?!"
-
agreed, a reasonable amount of networking/subnet understanding is important. Maybe do some testing/learning first…
a friend test this same scenario but with Microsoft TMG, and it's worked fine !
micro$oft for a firewall lol, as if that's going to end well…
-
On product that support ended back in april to boot..
I don't know what your buddy was/is doing.. But you can not put the same network on 2 sides of a "router/firewall" and expect it to work… This is just networking 101..
-
Indeed what you're describing isn't valid with any router or firewall. It won't work reliably with TMG or any other device on Earth either, you can't have conflicting networks and have things work correctly. Subject corrected accordingly. :)
-
If your pfsense wan is 192.168.1.0/24 then make your lan 192.168.2.0/24 and you will be fine.. .
-
If your pfsense wan is 192.168.1.0/24 then make your lan 192.168.2.0/24 and you will be fine.. .
Yeah …. but this will be a thought one for Mgd_Elislam. cmb just told him that doing so will force him to change planets.
So, your advise will come in very hard ;Dedit: btw: love the new subject line !
-
Well, there's something on the Mars rover running OpenBSD I've been told, and it can't do it either. So won't even work on Mars! :D
It's a location-independent reality of networking. Yeah, use a diff subnet on LAN.
-
edit: btw: love the new subject line !
Noticed that right off and thought: That must mean all is OK, so this thread is not particularly useful - oh wait….... :o
-
How to make your own default gateway out of nothing?
Say, you have a gateway that isn't default. Of course, you can use the checkbox in the gateway settings to set it as default, but that's too easy.
In the 'System: Static Routes' add the following:
Destination network Gateway 0.0.0.0/1 your_gateway 128.0.0.0/1 your_gatewayNow 'your_gateway' is default, no matter what you see in the 'Diagnostics: Routing tables'. Ugly enough? Yes, but this technique is used by "AVAST SecureLine VPN" client, for example, and has stone-hard theoretical grounds.
"The Longest Prefix Always Wins", so, back to the topic, dear Mgd_Elislam, set your WAN IP to 192.168.1.2/30. Set your LAN IP to 192.168.1.4/24, newer use 192.168.1.3. Nowhere! Probably your friend used alike settings in TMG.
-
And that is still a broke setup using /30 on wan and /24 on lan since they STILL Overlap!!!
