Netgate SG-1000 microFirewall

Author Topic: Route subnet through other (non pfsense) gateway  (Read 164 times)

0 Members and 1 Guest are viewing this topic.

Offline Soyokaze

  • Full Member
  • ***
  • Posts: 176
  • Karma: +20/-2
    • View Profile
Route subnet through other (non pfsense) gateway
« on: December 25, 2017, 03:44:00 am »
Hi.
I have this, pretty obviously non-working, setup, described in attachment.
My task - allow servers to talk to each other, without adding static routes to 192.168.132.0/24 through pfSense on every server in 192.168.0.0/24 subnet.
Any ideas?

Yes, I can add an interface to ISA on .132.0 subnet, and adding sloppy-state workaround I can make TCP work from .100.0 to .132.0,
but not the other way (from .132.0 to .100.0). Also I really want to leave pfsense as default router for .132.0 network.

(yeah, @johnpoz, ISA would be decomissioned ASAP, but till that...)
Need full pfSense in a cloud? PM for details!

Offline johnpoz

  • Hero Member
  • *****
  • Posts: 14811
  • Karma: +1374/-202
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: Route subnet through other (non pfsense) gateway
« Reply #1 on: December 25, 2017, 04:21:11 am »
Connect your ISA to pfsense via a transit vs the asymmetrical mess you currently have..  ISA then routes to pfsense via its transit, pfsense will send the traffic back to isa vs direct since it won't have an interface directly on that 192.168.100 network..
« Last Edit: December 25, 2017, 04:24:29 am by johnpoz »
- An intelligent man is sometimes forced to be drunk to spend time with his fools.
- Please don't PM me for personal help
- if you want to say thanks applaud or https://www.freebsdfoundation.org/donate/
1x SG-2440 2.4.2-RELEASE-p1 (work)
1x SG-4860 2.4.2-RELEASE-p1 (home)

Offline Soyokaze

  • Full Member
  • ***
  • Posts: 176
  • Karma: +20/-2
    • View Profile
Re: Route subnet through other (non pfsense) gateway
« Reply #2 on: December 25, 2017, 06:14:10 am »
I must have an IP on pfSense in .100.0 network. If I didn't needed it, I would be posting this mess here.
Need full pfSense in a cloud? PM for details!

Offline johnpoz

  • Hero Member
  • *****
  • Posts: 14811
  • Karma: +1374/-202
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: Route subnet through other (non pfsense) gateway
« Reply #3 on: December 25, 2017, 07:52:33 am »
No you do not need it.. Why do you need it?  If your going to put pfsense on that network, and the clients use a different gateway to get to get to other networks then that network becomes a transit.. Hosts on transit networks that need to use multiple gateways to get to other networks need to have host routing.. To tell them which gateway to use, if not then you end up with asymmetrical routing..

Why can pfsense not use the new transit network you create from the isa router to pfsense to get to the 192.168.100 network.

If you want to run it the way your running it then you will have to create routes on every host in the 192.168.100 telling them which gateway to use - or you have asymmetrical mess.
- An intelligent man is sometimes forced to be drunk to spend time with his fools.
- Please don't PM me for personal help
- if you want to say thanks applaud or https://www.freebsdfoundation.org/donate/
1x SG-2440 2.4.2-RELEASE-p1 (work)
1x SG-4860 2.4.2-RELEASE-p1 (home)