WAN and LAN same IP range

Fabioo

Hi,

I'm rehearsing with pfSense on Alix cards, after installing the latest release of pfSense the LAN address is assigned automatically to the address 192.168.1.1/24 LAN. I tried to align the IP range of WAN and LAN so ->

Gateway -> 192.168.0.1 (no DHCP, no client, nothing connected)
WAN -> 192.168.0.2
LAN -> 192.168.0.3

Same subnet

This solution does not work, It does not connect to the internet and can not connect to WebConf. If i leave it as the default 192.168.0.2 WAN and LAN 192.168.1.1 it all works.
It is normal or am I missing something? I should not be able to use the same network range of WAN and LAN?

Thanks

Regards,
Fabio

johnpoz

Really you mean the same network on wan and lan doesn't work??? Must be a bug - ROFL…

Dude come on... Think for 2 freaking seconds..

Fabioo

sarcasm? :D

I thought, and I did not understand why it should not work :D

heper

can't have 2 identical streetnames/numbers in the same town / postal code

johnpoz

"I thought, and I did not understand why it should not work"

You didn't think very hard then… To continue with helper analogy... You have a postman that wants to deliver a package that comes to a fork in the road, and both roads are called ROAD... And they all have house numbers 123, 124... How is the postman how is he suppose to know which road is the right road??

Fabioo

Ok understood :D then i configure the wan on 192.168.1.2 and LAN to 192.168.0.1

Thanks for your help, ;D

Reagrds

johnpoz

Yeah that works, you do understand your double natting now.. Not all that big of deal but can be more difficult for forwarding traffic to stuff behind pfsense. Since the nat device in front of pfsense has to be setup to forward traffic to the pfsense wan IP.

If possible its better to put that device in front of pfsense in bridge/modem mode so pfsense gets a public IP on its wan.

Fabioo

ok now I did not understand ^^

I connected pfsense to modem/router through the LAN interface of it, as if it were a simple client!

into the modem/router i can assign to one of the four NIC a new interface (LAN interface or WAN interface) under wan interface i have xDSL Line (DSL) or Etherne WAN (but I think this type of connection is used for other type of connection) ::)

johnpoz

"I connected pfsense to modem/router through the LAN interface of it"

What???

This is how you would normally use pfsense

internet - public IPs – wan (modem/gateway/router/ispdevice) lan -- 192.168.1.0/24 -- wan pfsense lan --192.168.0.0/24 -- your network

this is how I understood your connection with the IPs you stated where on pfsense wan and lan. this is a double nat for your clients on your network getting to the
internet.

So you don't double nat it would look like this

internet wan (modem/ispdevice) lan -- (public ip) wan Pfsense lan -- 192.168.0.0/24 --- your network.

WAN -> 192.168.0.2
LAN -> 192.168.0.3

This is the same net and inside of that no routing is required, its only layer2 based!

I connected pfsense to modem/router through the LAN interface of it, as if it were a simple client!

Internet –- ISP --- WAN Port of the Modem Router --- pfSense WAN Port

There are two ways you could go.

Set the Router into the so called bridge mode that he is acting now only likes a dump modem!
Create a proper double NAT or router cascade you will loose 3% - 5% of the entire throughput

Modem Router: (as real router)

net: 192.168.2.0/24
IP: 192.168.2.1/24 (of the router)
DHCP: off
DNS1: ISP or 8.8.4.4
DNS2: ISP or 8.8.8.8
if settings to realize it, the MAC Address of the WAN port of the pfSense box must get even the same
IP address again, mostly in AVM Fritz!Box routers given.

pfSense box:
WAN:

WAN net: 192.168.2.0/24
WAN IP: 192.168.2.2/24 (static IP)
Gateway: 192.168.2.1/24
DNS1: 192.168.2.1/24
DNS1: empty

LAN:

LAN net: 192.168.5.0/24
LAN Gateway: 192.168.5.1/24
Gateway: 192.168.2.2/24
DNS1: 192.168.2.2/24
DNS2: empty

Client:

net 192.168.5.0/24
client IP static or via DHCP
Gateway:192.168.5.1/24
DNS1: 192.168.5.1/24
DHCP: off or on likes you want

Fabioo

ok then at this point the question is: How do I create a wan? ;D

on my ispdevice i have
new wan -> IP Encapsulation -> IP over ethernet
PPP over ethernet
pure bridge (no WAN IP)

:o

johnpoz

You don't have to create a new wan… WAN is used to express the port that is connected to the INTERNET your ISP... The lan is the port connected to your network/pfsense wan..

Without know this exact device your talking about, most likely you would set it to

"pure bridge (no WAN IP)"

This should hand off public IP connected to its lan side, ie pfsense wan.. Be that just dhcp or PPPoE sort of connection would depend on your isp.

If you can not get your isp device to give pfsense wan a public IP, then you can work with double nat - you just need to understand that if you want to port forward on pfsense to boxes behind pfsense that you have to forward that traffic first on your isp device. Or put pfsense wan IP into the dmz of that isp device..

It would be better to only have 1 nat (pfsense) but if you can not its not the end of the world..

ok then at this point the question is: How do I create a wan? ;D

on my ispdevice i have

What is your ISP router exactly?
Name, Modell, Modellnumber please?

This kind of set up is only for typing in from here to your device and it works for me
with similar data and for years! Whats wrong with you?

You don´t need to set up a new WAN port on the ISP router with the modem, because the modem Port
is your WAN port.

On the pfSense box the WAN port must be created not more and not less.

vizi0n

@BlueKobold:

DNS1: ISP or 4.4.8.8

DNS2: ISP or 8.8.8.8

May I suggest 8.8.4.4 instead of 4.4.8.8 ? :)

Fabioo

@BlueKobold:

WAN -> 192.168.0.2
LAN -> 192.168.0.3

This is the same net and inside of that no routing is required, its only layer2 based!

I connected pfsense to modem/router through the LAN interface of it, as if it were a simple client!

Internet –- ISP --- WAN Port of the Modem Router --- pfSense WAN Port

There are two ways you could go.

Set the Router into the so called bridge mode that he is acting now only likes a dump modem!

Create a proper double NAT or router cascade you will loose 3% - 5% of the entire throughput

Modem Router: (as real router)

net: 192.168.2.0/24

IP: 192.168.2.1/24 (of the router)

DHCP: off

DNS1: ISP or 4.4.8.8

DNS2: ISP or 8.8.8.8

if settings to realize it, the MAC Address of the WAN port of the pfSense box must get even the same
IP address again, mostly in AVM Fritz!Box routers given.

pfSense box:
WAN:

WAN net: 192.168.2.0/24

WAN IP: 192.168.2.2/24 (static IP)

Gateway: 192.168.2.1/24

DNS1: 192.168.2.1/24

DNS1: empty

LAN:

LAN net: 192.168.5.0/24

LAN Gateway: 192.168.5.1/24

Gateway: 192.168.2.2/24

DNS1: 192.168.2.2/24

DNS2: empty

Client:

net 192.168.5.0/24

client IP static or via DHCP

Gateway:192.168.5.1/24

DNS1: 192.168.5.1/24

DHCP: off or on likes you want

This is the configuration I have now. so we use pfsense it as a client. No?

My isp device is ADB DV2200 It is a VDSL2 Fastweb modem.

robi

Here's how to obtain "pure bridge" setup:
http://www.hwupgrade.it/forum/showpost.php?p=41072511&postcount=30

First, make a backup config, and also disable WiFi on the ISP device.
I would also check for the latest firmware available before proceeding.

This is the configuration I have now.

As shown under the first picture where you you were writing "Test", should be a LAN interface in my eyes.

My isp device is ADB DV2200 It is a VDSL2 Fastweb modem.

It is a router and not only a modem!

May I suggest 8.8.4.4 instead of 4.4.8.8 ?

This was a typo, solved!

so we use pfsense it as a client. No?

Yes, as a LAN client according your headline of this forum thread "WAN and LAN same IP range".
You where creating a double NAT solution, also called bastion host or router cascade and this is
also running for me since years, like this: Internet –- ISP --- Router --- Firewall --- LAN clients
But you are using routing instead of the bridging! So you can easily compare the problems against
and I prefer more the routing.

Routing: (double NAT)

You will loose perhaps 3% - 5% of the entire throughput

Bridging:

port flapping
packet loss
packets drops
unstable connection

Here's how to obtain "pure bridge" setup:

Route if you can, and bridge only if you must.

johnpoz

"Route if you can, and bridge only if you must."

Let me get this right your suggesting that double nat is better than public IP on pfsense directly??

And that if he bridges this device so pfsense gets a public IP - it would/could cause these sorts of issues??

Bridging:

port flapping
packet loss
packets drops
unstable connection

"Route if you can, and bridge only if you must."

Let me get this right your suggesting that double nat is better than public IP on pfsense directly??

No you did not understand it full as I read it right here! If the whole device will be "bridged" to act
only as a pure modem, would be a good idea, but only bridging the port as I was reading it above
isn´t a good idea.

And that if he bridges this device so pfsense gets a public IP - it would/could cause these sorts of issues??

Bridging:

port flapping

packet loss

packets drops

unstable connection

Not the whole device, that this router is acting as a pure modem, but only the port because he was
asking for "being a client of the router". Bridging only one LAN port to the WAN port of the pfSnese
will cause earlier or later this failings.

Fabioo

Hi,

I created the wan on pfsense, thanks to the guide linked by roby.

It works fine, but unfortunately I can't go beyond 20 mbps (i have 100 mbps connection) the CPU load does not exceed 25%

while with the "bastion host" configuration I could use it all :(

PS: PC Engines ALIX 2D3