Two LAN subnets, some IPs not reachable
-
I have two LAN interfaces:
LAN 1 - 10.2.0.0/16
LAN 2 - 10.1.0.0/16And two XEN Hosts
Host 1 in LAN 1 - 10.2.1.1
Host 2 in LAN 2 - 10.1.1.1My goal:
All LAN 1 IPs should be able reach all LAN 2 IPs, and reverse.I just made two firewall rules:
Allow: LAN 1 Net on any port to LAN 2 Net
Allow: LAN 2 Net on any port to LAN 1 NetWhen this configured, I can reach a LAN 2 VM with its IP 10.1.1.101 from LAN 1, so routing between the two subnets/networks works very well.
My NAT Outbound is set to Manual Outbound, and I have not added a new entry for this scenario. In my opinion I don't need NAT here, because I dont want to translate the IPs, means I want to keep my LAN 1 IP when connecting to a LAN 2 machine.
The thing is from LAN 1 I am not able to reach 10.1.1.1 and from LAN 2 I am not able to reach 10.2.1.1, so it seems all VMs are reachable but not the XEN hosts.
Why? What am I doing wrong?
-
Problem solved, had the wrong gateway at 10.1.1.1 and 10.2.1.1.
-
Just Curious - why would you use a /16 mask… Do you have anywhere close to 65K hosts or devices that are going to be on that network? That is going to be one hell of a broadcast domain if you do ;)
Why would you not use /24 or /23 for example -- this would allow for 250 or 500 clients on each segment..
-
Just Curious - why would you use a /16 mask…
Because size does matter… perhaps.... ;D ;D ;D
I'm often curious about reasons behind subneting choices for quite a lot of pfSense / network administrators ;)
-
My guess is just lack of understanding.. Or some mindset that is still stuck in the classes of IP ranges that has been completely meaningless since what the early 90's when cidr came out - just boggles my mind that they still even talk about class in books and school..
You would never in a million years put that many clients on a broadcast domain, the only place I could really see such masks are in route summaries and or allocations of networks to a site, etc.
