pfSense Gold Subscription

Author Topic: How to configure pfSense as a router for two internal LAN subnets?  (Read 423 times)

0 Members and 1 Guest are viewing this topic.

Offline johnpoz

  • Hero Member
  • *****
  • Posts: 14767
  • Karma: +1372/-202
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: How to configure pfSense as a router for two internal LAN subnets?
« Reply #15 on: January 01, 2018, 12:32:49 pm »
NO that is NOT the correct way to do it!!!  Create a route to use not a default gateway - arrrgghhh..
- An intelligent man is sometimes forced to be drunk to spend time with his fools.
- Please don't PM me for personal help
- if you want to say thanks applaud or https://www.freebsdfoundation.org/donate/
1x SG-2440 2.4.2-RELEASE-p1 (work)
1x SG-4860 2.4.2-RELEASE-p1 (home)

Offline mewsense

  • Jr. Member
  • **
  • Posts: 65
  • Karma: +2/-0
    • View Profile
Re: How to configure pfSense as a router for two internal LAN subnets?
« Reply #16 on: January 01, 2018, 01:26:10 pm »
You converted your WAN to LAB interface?

You have to disable all outbound NAT.

No I converted LAN to LAB interface and converted WAN to LAN interface. Here are my NAT outbound rules:


Offline mewsense

  • Jr. Member
  • **
  • Posts: 65
  • Karma: +2/-0
    • View Profile
Re: How to configure pfSense as a router for two internal LAN subnets?
« Reply #17 on: January 01, 2018, 01:30:49 pm »
NO that is NOT the correct way to do it!!!  Create a route to use not a default gateway - arrrgghhh..

OK, ok! :)

I've done this now and all good from 10.0.0.3 to 10.0.1.1!



I can also now ping from 10.0.1.1 to 10.0.0.3!!

I do however, have one small issue. I can't ping the netgate router (10.0.0.1) from my LAB network. Any ideas on why?


« Last Edit: January 01, 2018, 01:59:37 pm by mewsense »

Offline mewsense

  • Jr. Member
  • **
  • Posts: 65
  • Karma: +2/-0
    • View Profile
Re: How to configure pfSense as a router for two internal LAN subnets?
« Reply #18 on: January 01, 2018, 05:26:53 pm »
Hi everyone, thanks for reading, I still have an issue where no servers on the LAB domain can access the internet. I can't ping the LAN interface of my Netgate WAN router from the LAB network, but I can ping it from the LAN network. Any ideas?

Offline chpalmer

  • Hero Member
  • *****
  • Posts: 1786
  • Karma: +93/-3
    • View Profile
    • Home of Cablenut
Re: How to configure pfSense as a router for two internal LAN subnets?
« Reply #19 on: January 02, 2018, 01:41:02 pm »
Draw a picture of how you have this set up and talk about your ultimate goals. 

P.S. statements made by me are not necessarily condoned by the management of this fine organization.  http://badmodems.com

Offline mewsense

  • Jr. Member
  • **
  • Posts: 65
  • Karma: +2/-0
    • View Profile
Re: How to configure pfSense as a router for two internal LAN subnets?
« Reply #20 on: January 02, 2018, 02:48:47 pm »
Draw a picture of how you have this set up and talk about your ultimate goals. 

OK. :)

Here's the network diagram.



I want pfSense on beryllium to allow traffic both ways between LAN and LAB networks unhindered. It seems that machines in LAB network can't reach some machines in LAN, but machines in LAN can reach all machines in LAB. Here are the results from a machine on each network.

On cowslip.duck.loc
Cannot ping 10.0.0.1, 10.0.0.8 (timed out)
Can ping 10.0.0.10, 10.0.0.4, 10.0.0.3, 10.0.0.9, 10.0.1.1, 10.0.1.4

On lithium.duck.loc
Can ping everywhere fine

Here are the firewall rules on beryllium.localdomain








Offline mewsense

  • Jr. Member
  • **
  • Posts: 65
  • Karma: +2/-0
    • View Profile
Re: How to configure pfSense as a router for two internal LAN subnets?
« Reply #21 on: January 03, 2018, 07:17:33 am »
All working now, I needed a static route to the LAB network on the SG-1000 router. Thanks for looking everyone!!

Offline johnpoz

  • Hero Member
  • *****
  • Posts: 14767
  • Karma: +1372/-202
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: How to configure pfSense as a router for two internal LAN subnets?
« Reply #22 on: January 03, 2018, 07:21:52 am »
"I needed a static route to the LAB network on the SG-1000 router."

If your network is how you drew it you have asymmetrical setup.. If you want to use use your sg1000 router to get to the internet it should be on a transit network to your downstream router.. You shouldn't be using 10.0.0 as your transit or your going to have to put host routes on all boxes on that network.. 
- An intelligent man is sometimes forced to be drunk to spend time with his fools.
- Please don't PM me for personal help
- if you want to say thanks applaud or https://www.freebsdfoundation.org/donate/
1x SG-2440 2.4.2-RELEASE-p1 (work)
1x SG-4860 2.4.2-RELEASE-p1 (home)

Offline mewsense

  • Jr. Member
  • **
  • Posts: 65
  • Karma: +2/-0
    • View Profile
Re: How to configure pfSense as a router for two internal LAN subnets?
« Reply #23 on: January 03, 2018, 08:43:53 am »
Hmmm...

My SG-1000 only has two interfaces, so how would this work in practise? Would I have to create a VLAN for the transit network?

Offline kpa

  • Hero Member
  • *****
  • Posts: 1199
  • Karma: +133/-6
    • View Profile
Re: How to configure pfSense as a router for two internal LAN subnets?
« Reply #24 on: January 03, 2018, 09:54:49 am »
Using VLANs for that is fine but you must have a VLAN capable switch that can demux the tagged trunk traffic to selected switch ports.