Netgate SG-1000 microFirewall

Author Topic: giving secondary gateway access  (Read 159 times)

0 Members and 1 Guest are viewing this topic.

Offline aciesler

  • Newbie
  • *
  • Posts: 5
  • Karma: +0/-0
    • View Profile
giving secondary gateway access
« on: January 09, 2018, 08:36:02 pm »
version of pfsense: latest

WAN: 2 IPs from separate subnets. One is assigned to the WAN interface, the other is a VIP.
LAN 1: using vlan 1, using WAN interface for OUT
LAN 2: using vlan 50, using VIP for OUT
OUT NAT: Hybrid

I have a workstation connected through a switch to vlan 50 on LAN 2 and it's getting a .50.0 address plus the gateway and dns information. My trouble is that my gateway on vlan50 isn't getting internet access and I can't add a second gateway because the GWY for my VIP isn't part of the same subnet and pfsense is giving me an error if I try and add it. How do I complete this set up?

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 9607
  • Karma: +1090/-309
    • View Profile
Re: giving secondary gateway access
« Reply #1 on: January 10, 2018, 12:08:51 am »
Hybrid outbound NAT. Tell the system to use the desired VIP as the NAT address for the vlan50 source network.

Not possible to provide a more specific answer due to the lack of specifics in the question.
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Offline aciesler

  • Newbie
  • *
  • Posts: 5
  • Karma: +0/-0
    • View Profile
Re: giving secondary gateway access
« Reply #2 on: January 10, 2018, 04:15:40 pm »
I have that. My DHCP leases on vlan50 get all the right information but under system > routing > gateways I can't add my VIP gtwy of 24.52.70.41. My WAN gtwy is 24.52.70.233.

If I try and add the other gtwy into the interface I get: The gateway address 24.52.70.41 does not lie within one of the chosen interface's subnets.

Offline luke1018

  • Jr. Member
  • **
  • Posts: 25
  • Karma: +0/-0
    • View Profile
Re: giving secondary gateway access
« Reply #3 on: January 10, 2018, 09:49:45 pm »
Hi, I am trying to setup another VLAN to monitor traffic from another subnet, but unfortunately, I can only view the OUT portion only.

Have anyone faced this issue before?

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 9607
  • Karma: +1090/-309
    • View Profile
Re: giving secondary gateway access
« Reply #4 on: January 11, 2018, 04:10:47 am »
Oh so you have some convoluted ISP scheme with two layer 3 networks on the same interface?

What are both sets of IP addresses, netmasks, and gateways you were given?
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Offline aciesler

  • Newbie
  • *
  • Posts: 5
  • Karma: +0/-0
    • View Profile
Re: giving secondary gateway access
« Reply #5 on: January 12, 2018, 11:38:36 am »
IP 1 24.52.70.234 /29 on WAN interface
GTWY 24.52.70.233

IP 2 24.52.70.42 /32 as an "other" VIP
GTWY 24.52.70.41

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 9607
  • Karma: +1090/-309
    • View Profile
Re: giving secondary gateway access
« Reply #6 on: January 12, 2018, 01:08:31 pm »
As far as I know you cannot do that. There is no way to reach 24.52.70.41 from either 24.52.70.234/29 or 24.52.70.42/32.

Are you SURE that is what they gave you to use?

If you need more addresses they should just route them to 24.52.70.234.
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Offline aciesler

  • Newbie
  • *
  • Posts: 5
  • Karma: +0/-0
    • View Profile
Re: giving secondary gateway access
« Reply #7 on: January 12, 2018, 04:25:58 pm »
Can I use my 3rd NIC port as an additional WAN port? Or do all VIP gtwys need to be the same?

We needed another static but there wasn't enough in our range so they slapped this one onto our handoff

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 9607
  • Karma: +1090/-309
    • View Profile
Re: giving secondary gateway access
« Reply #8 on: January 12, 2018, 05:28:13 pm »
That seems like a silly way to do it.

Yes you can use a separate interface but it won't do you any good with a /32. Did they really give you another /30?

If the latter you could do this:

WAN   24.52.70.234/29 <---> 24.52.70.233 Gateway

WAN2 2 24.52.70.42/30 <---> 24.52.70.41 Gateway

You would set them up like any other multi-wan. You would need an outside switch.

Seems pretty stupid to do that since it only results in one additional address for you at the cost of four addresses plus a router interface on your side. If they just routed 24.52.70.40/30 to 24.52.70.234 you could use all four addresses as VIPs and not have to mess around with multi-wan.
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM