Hello,
I'm glad you've made some progress. I'd like to help explain private
subnets, and since I don't know how much you already know, please don't be
offended! (I realize at this point I'm not helping you accomplish your task,
but just trying to helpful in general.)
There are three subnets allocated as private (for internal network use):
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
I've listed these in CIDR notation, meaning the "/xx" at the end denotes the
number of bits in the netmask that are "1"s. For example:
/8 means 255.0.0.0 or in binary: 11111111.00000000.00000000.00000000
/12 means 255.240.0.0 or in binary: 11111111.11110000.00000000.00000000
The purpose of the netmask is to determine what bits of an IP address make up
the "network" address, and what bits make up the "host" address (ie,
determining whether the IP is local or if requests should be made through a
router).
A host with an IP of 172.16.0.1 and a netmask of 255.240.0.0 (or /12) would
mean that these IPs would be "local":
172.16-31.xxx.xxx
as shown by comparing the IP to the netmask:
++++++++.++++----.--------.--------
IP: 10101100.00010000.00000000.00000001
netmask: 11111111.11110000.00000000.00000000
1st 2nd 3rd 4th
So there 4 bits in the 2nd octet, 8 bits in the 3rd octet, and 8 bits in the
4th octet that are valid for use as IPs on the "local" subnet (the +'s
represent bits that, if changed, would tell the Transport layer that the IP is
not local... the -'s are bits you can change to give yourself IPs local to your
subnet. Note that they correspond to the 1's and 0's of the netmask).
I hope this is somewhat understandable. Also, keep in mind that these private
subnets are referenced by the greatest possible netmask, but you're not
required to use this as your netmask (in fact, you almost always shouldn't).
So, for your LAN2 subnet, you could use the following:
IP: 172.16.0.1
netmask: 255.255.255.0 (ie, /24)
This will give you 253 IPs available for your hosts (172.16.0.2-254).
As RB said, it's good to get these private subnets right, since accidentally
using a subnet outside of these will cause you to lose access to any hosts on
the internet that use the subnet (your hosts will think the IPs are local, and
won't send their requests to the router to be forwarded).
Feel free to email me off-list if you have any more IP related questions.
Sounds like RB's answered your routing questions.
Enjoy!
-Adrian
----- Original Message -----
From: "Tortise" <[email protected]>
To: [email protected]
Sent: Saturday, February 28, 2009 6:36:01 AM GMT -05:00 US/Canada Eastern
Subject: Re: [pfSense-discussion] WAN LAN1 and LAN2 (OPT1)
I think I've moved this on some.
What I did was avoid the subnet issues which I was clearly running into (and
not fully understanding), I opted to use a
172.10.x.x/16 private range for the 2nd LAN.
I entered the rules as per DarkFoon (Thank you)
Using the rules as suggested are preventing LAN2 access to LAN while allowing
Internet access.
LAN does not yet seem to have LAN2 access yet though, in terms of no pings and
no WINS access, which I was hoping for one way (LAN
to LAN2 only) but perhaps that is just not going to happen in this dual LAN
setup?
Any further guidance would be appreciated please.
Kind regards
David
----- Original Message -----
From: "Tortise" <[email protected]>
To: <[email protected]>
Sent: Saturday, February 28, 2009 8:17 PM
Subject: Re: [pfSense-discussion] WAN LAN1 and LAN2 (OPT1)
Hi Adrian
Thank you so much for your response.
I think those numbers do have something to do with it, as when I enable OPT1 I
loose the webserver's access and have to reset to a
default and start over.... (I hate that!)
I have since tried configuring as:
LAN1: 10.aaa.bbb.ccc/8
LAN2: 10.(aaa+1).bbb.ccc/9
I presume I have still got it wrong.
I want to keep LAN1's IP numbers as it is, as there a number of Static DHCP
assignments all set, for LAN2 I don't really care what
this is, and I can't imagine needing more than 20 addresses on LAN2, which may
be relevant. Can you suggest further? (Of course
they can be changed if necessary....)
Also I assume I will need to do some LAN2 rules to 1) give access to the
Internet
and LAN1 rules to gain access to LAN2 however the devil may be lying in the
detail to do that...
Still as you say we need to get LAN2 working for a start.
Kind regards
David
----- Original Message -----
From: "Adrian Wenzel" <[email protected]>
To: <[email protected]>
Sent: Saturday, February 28, 2009 7:05 PM
Subject: Re: [pfSense-discussion] WAN LAN1 and LAN2 (OPT1)
Hello,
So, it seems you are configuring as such:
LAN1: 10.aaa.bbb.ccc/8
LAN2: 10.xxx.yyy.zzz/8
This is not right, since /8 means a netmask of 255.0.0.0, making the network
portion of each subnet only the first octet... thus the
same subnet. Two devices with configured with the same subnet, and on two
different physical networks will not work.
You should try a netmask of 255.128.0.0, or /9 (assuming you really need all
those IPs on each network). That will correct
differentiate the subnets and allow routing to occur ;)
We can get into separating your LANs to disallow your desired access after this
is working.
Thanks,
Adrian
----- Original Message -----
From: "Tortise" <[email protected]>
To: [email protected]
Sent: Saturday, February 28, 2009 12:05:17 AM GMT -05:00 US/Canada Eastern
Subject: [pfSense-discussion] WAN LAN1 and LAN2 (OPT1)
Hi
I have been trying to setup a WAN and two LAN. (3 NIC's)
I want LAN1 to be able to access LAN2 but not the other way around. The idea
is that LAN1 is less public than LAN2.
i.e. visitors can connect to the "Public" LAN2 and browse the Internet etc
while not having any access to LAN1
LAN 2 will have a LAN printer on it, as an example, which can receive print
jobs from both LAN1 and LAN2.
WAN is a static IP to Cable.
LAN1 is using 10.xxx.yyy.zzz 8 and OPT was intended to use 10.aaa.bbb.ccc 8
however enabling this seems to make it all fall over, ie
I lose Internet connection from LAN things become unresponsive.
As an aside I tried editing /conf/config.xml however it would not save from the
terminal window, does one have rights to edit the
config there? I was using the ee editor.
Has anyone done this sort of thing and what am I missing to get it working?
In anticipation many thanks indeed.
Kind regards
David
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
Commercial support available - https://portal.pfsense.org
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
Commercial support available - https://portal.pfsense.org
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
Commercial support available - https://portal.pfsense.org
