pfSense Forum

pfSense English Support => Routing and Multi WAN => Topic started by: aciesler on January 09, 2018, 08:36:02 pm

Title: giving secondary gateway access
Post by: aciesler on January 09, 2018, 08:36:02 pm
version of pfsense: latest

WAN: 2 IPs from separate subnets. One is assigned to the WAN interface, the other is a VIP.
LAN 1: using vlan 1, using WAN interface for OUT
LAN 2: using vlan 50, using VIP for OUT
OUT NAT: Hybrid

I have a workstation connected through a switch to vlan 50 on LAN 2 and it's getting a .50.0 address plus the gateway and dns information. My trouble is that my gateway on vlan50 isn't getting internet access and I can't add a second gateway because the GWY for my VIP isn't part of the same subnet and pfsense is giving me an error if I try and add it. How do I complete this set up?
Title: Re: giving secondary gateway access
Post by: Derelict on January 10, 2018, 12:08:51 am
Hybrid outbound NAT. Tell the system to use the desired VIP as the NAT address for the vlan50 source network.

Not possible to provide a more specific answer due to the lack of specifics in the question.
Title: Re: giving secondary gateway access
Post by: aciesler on January 10, 2018, 04:15:40 pm
I have that. My DHCP leases on vlan50 get all the right information but under system > routing > gateways I can't add my VIP gtwy of 24.52.70.41. My WAN gtwy is 24.52.70.233.

If I try and add the other gtwy into the interface I get: The gateway address 24.52.70.41 does not lie within one of the chosen interface's subnets.
Title: Re: giving secondary gateway access
Post by: luke1018 on January 10, 2018, 09:49:45 pm
Hi, I am trying to setup another VLAN to monitor traffic from another subnet, but unfortunately, I can only view the OUT portion only.

Have anyone faced this issue before?
Title: Re: giving secondary gateway access
Post by: Derelict on January 11, 2018, 04:10:47 am
Oh so you have some convoluted ISP scheme with two layer 3 networks on the same interface?

What are both sets of IP addresses, netmasks, and gateways you were given?
Title: Re: giving secondary gateway access
Post by: aciesler on January 12, 2018, 11:38:36 am
IP 1 24.52.70.234 /29 on WAN interface
GTWY 24.52.70.233

IP 2 24.52.70.42 /32 as an "other" VIP
GTWY 24.52.70.41
Title: Re: giving secondary gateway access
Post by: Derelict on January 12, 2018, 01:08:31 pm
As far as I know you cannot do that. There is no way to reach 24.52.70.41 from either 24.52.70.234/29 or 24.52.70.42/32.

Are you SURE that is what they gave you to use?

If you need more addresses they should just route them to 24.52.70.234.
Title: Re: giving secondary gateway access
Post by: aciesler on January 12, 2018, 04:25:58 pm
Can I use my 3rd NIC port as an additional WAN port? Or do all VIP gtwys need to be the same?

We needed another static but there wasn't enough in our range so they slapped this one onto our handoff
Title: Re: giving secondary gateway access
Post by: Derelict on January 12, 2018, 05:28:13 pm
That seems like a silly way to do it.

Yes you can use a separate interface but it won't do you any good with a /32. Did they really give you another /30?

If the latter you could do this:

WAN   24.52.70.234/29 <---> 24.52.70.233 Gateway

WAN2 2 24.52.70.42/30 <---> 24.52.70.41 Gateway

You would set them up like any other multi-wan. You would need an outside switch.

Seems pretty stupid to do that since it only results in one additional address for you at the cost of four addresses plus a router interface on your side. If they just routed 24.52.70.40/30 to 24.52.70.234 you could use all four addresses as VIPs and not have to mess around with multi-wan.