Routing between LAN on different subnets

  • Hello Gurus,

    We have internal webservers that must be only accessible from Internet using port-forwarding on pfSense1 via INTERNET A.    As you can see on the image above, all computers on BUILDING-B that are behind network can ping and connect to BUILDING-A computers with gateway pointing to (pfSense0),  but cannot connect to our INTERNAL WEBSERVERS which have gateway (pfSense1).  What I wanted is that the "BLDGB-WORKSATION-1 ( can traverse and connect to our Internal Servers without changing its configurations and without utilizing the port-forwarding feature on pfSense1.  Is it possible? Can you please provide information to do this?

  • I'm not sure to really understand what you mean with the various gateways and network. I'll need to read it again more than 3 time because so far, this is still unclear.

    One point that may help: in order for devices to reach networks that are not behind their default gateway, you need to tell where to go, i.e. what is the gateway that will allow to reach this network.

    e.g., if you want to reach from, you have to tell that gateway for this network is
    Well…. this would have worked if this gateway was within the right subnet. Such IP here is quite surprising. It is on purpose, typo or real mistake ?

    either .250  or not /24  ::)

    hummm, I don't understand how this network works  :-[

  • its correct, you misread it, its on the image.. :)  thank you for your reply… i guess have to use the port-forwarding feature on pfSense1 from pfSense0 via WAN to connect to the internal webserver

  • Oh, reading it again and again, I realize now that you indeed mixed (for some reason still not clear to me) and on same physical network and switch.

    I still don't understand where this port forwarding would occur but you have to deal with routes so that your server known where to go ( in order to reach  (BTW, what a huge number of devices  :o)

    This can be done either adding route on each server you want to reach from or adding route at so that flow is redirected to

  • Yeah, big indeed, have to deal with it since I am the new guy on an old network that uses /16 which will be corrected soon and running DHCP will be my target for easy management.  Well, to answer your question, computers on Building A where used to be connected to GW, but when the new INTERNET-B came in, they wanted Building A Computers should use INTERNET-B to lighten up the Internet bandwidth usage for the INTERNAL WEBSERVERS.  Thats why I have mixed network on the same physical network when they installed a CAT6 backbone from BUILDING A to BUILDING B.  To cut the story short, i have successfully done what i wanted.  I just added a new gateway ( on pfSense0 on the interface facing pfSense1 and statically add outbound NAT rule mapping using the new gateway i defined to each INTERNAL WEBSERVERS ip address. And it works like a charm.

  • LAYER 8 Global Moderator

    your 2950 is only layer 2, it will not do L3 that I am aware of..

    so you have 250 and 251/24 running on the same layer 2 or do you have this setup with vlans using pfsense to route these?

    Why don't you just connect your buildings with a transit network between your pfsense and then you could just use policy based routing for any client in building A to use the internet in B, or you could have B use internet A if you wanted, etc..

    Since you show a client on that 251 segment this is clearly not a transit network.

    If you connected your building correctly, simple routing/firewall rules to allow whatever you want to use whatever wan connection in either location.  You could have multiple networks in each location, etc.

    Done correctly you would never have to change a clients gateway, done correctly you could even leverage the wan in each location for load balancing, nor would you have to do any natting between your rfc1918 address space, etc. etc.

Log in to reply