Is a pfSense router w/ a LAN gateway using a /20 bits subnet mask common?

Question

Obviously I'm lacking some networking knowledge, and I wish somebody could help me understand something fishy I found on a pfSense router in an organization yesterday. The pfSense router forces subnet mask of 255.255.240.0 on a LAN gateway like 9.9.192.1. Is this common? It's on ipv4 but it also has a turned off option for ipv6 currently, if that matters.

It's valid, because it works, but the minute you add a new computer or printer to the network and forget about this /20 bits subnet mask quirk, that newly added device acts super wonky and ends up freezing, crashing and/or dropping out of the network. For instance, a printer that had 255.255.255.0 as its subnet mask was receiving only a third of a page to print and would freeze until it's rebooted. I suspect it was receiving more bits and overflowed its RAM or something, hence the freezing. It's not the case of a single cheap printer, it did that to 4 printers out of 5 at this office. Different brands, different models, some 350$ printers, some 80$ printers.

Optional meditation on that gateway:

If a computer AND a printer are both on the 255.255.255.0 subnet mask, they can access the internet, but cannot communicate with each other on the LAN. Computers on 255.255.255.0 can communicate no problem with another computer on the LAN still. Just not computer <--> printer.

If a computer OR a printer has a 255.255.255.0 subnet mask while the other one has a 255.255.240.0 subnet mask, they can communicate to extremely wonky fashion and the printer almost immediately freezes when sent packets, never prints anything more than a third of a page and it crashes/freezes to a point it has to be rebooted (unusable really). Tough, both devices still can access the internet fine.

If both the computer AND a printer have the 255.255.240.0 subnet mask, they communicate super efficiently (instantaneously) without any problem at all, super stable and fast.

Question:

Can anybody explain why a pfSense router's subnet mask wouldn't be all 24 bits (255.255.255.0) like any regular router is? What is the advantage or any reason that could justify this /20 bits subnet mask enforcement? Is it common? Thanks.

Answer 1

9.9.192.1 is an address owned by IBM - so unless they've given it to you, you can't use it on your LAN without causing problems.

A subnet mask of 255.255.240.0 or /20 is completely fine as long as the address range you're using is large enough and either private (192.168.0.0/16, 172.16.0.0/12 or 10.0.0.0/8) or granted to you. Mixing devices with differing network addresses or masks doesn't usually work as you've already noticed.

Usually, your network devices are configured by DHCP, so possibly you just need to correct the scope there. If you're not using DHCP now is a good time to start.

edit 1: You might want to read up on how subnetting works in this good question/answer: How do you calculate the prefix, network, subnet, and host numbers?

edit 2: The subnet mask defines the size of the subnet. Your mask 255.255.240.0 allows for 12 bits = 4,094 host addresses which might be a bit oversized. It doesn't hurt though, except that /24 might be slightly easier to handle.

edit 3: If your can't change the LAN subnet mask on the router just don't do it. Change the mask in the DHCP options and simply don't use the extra 4 bits of host addresses.

edit 4: your screenshot in the other comment - you should add additional details to your question instead - shows the DHCP options. These are most probably inherited from the NIC's network settings which may be the reason why you can't change them. Check the NIC's IP settings and correct the mask there if possible; the DHCP scope is likely to follow.

Answer 2

Can anybody explain why a pfSense router's subnet mask wouldn't be all 24 bits (255.255.255.0) like any regular router is? What is the advantage or any reason that could justify this /24/24/20/24 bits subnet mask enforcement?

Two points:

1. There is nothing special about a 24 bit mask (255.255.255.0). The size of the mask depends on the sizeof the subnet, which in turn is based on the networking requirements. There is no "regular" subnet mask.
2. A subnet mask can be written as dotted decimal (255.255.255.0) or using "slash" notation (/24). They are equivalent. There is no such thing as "/24/24/20/24." That is just jibberish. If you're trying to type that in your router, that may be your problem.

Answer 3

QUESTION: Can anybody explain why a pfSense router's subnet mask wouldn't be all 24 bits (255.255.255.0) like any regular router is? What is the advantage or any reason that could justify this /24/24/20/24 bits subnet mask enforcement? Is it common?

You seem to be very confused. There is no "standard" network size. A router interface has the network size that you configure on it. You should choose a size that matches the network requirements. In this case, it seems that you configured the router with a 20-bit network mask, which will let you have 4094 host addresses on the network.

The hosts on a network need to have their network masks set to be the same size as the network mask is configured, otherwise you can end up with problems.

Answer 4

Personally I prefer to not change anything until I know what is meant to work You seem to have two subnets in the same system - I dont know why (as in what is the functional requirement for two subnets )

There is no restriction to enforce that devices on the same switched network are in the same subnet - they cannot talk to each other , they still need a router and yet they share a layer 2 collision domain - but it still works - just maybe not the way you want. 255.255.240.0 means there are more possible devices in the collision domain at the IP level so there is a possible performance hit if you get to that many devices actually being present in the subnet - it makes no difference if there are not

Being locked at 255.255.240.0 is not an issue but having read all this - I think you are adding a new device and NOT specifying your correct sub-net mask of 255.255.240.0 and thus the new device cannot reach the devices it needs to and so it freezes with network timeouts (This is understandable )or applications crash because of network connectivity issues- (not so understandable - but it could happen) 255.255.240.0 is correct - so typing in a incorrect mask is wrong - if you cant change the router - then accept that's what the mask is and make sure you use that mask - Changing the mask after first implementation means changing the mask on all devices at the same time. (sort of if you know what your doing and understand the sub-nets you can sometimes work around this )

I'd relax - leave the subnet mask the way it is - fix all devices to use the correct subnet mask - and see what is and is not working - document (ie find out) what is meant to talk to what and then decide what to do

Answer 5

Your basic troubles were all here:

Can anybody explain why a router's subnet mask wouldn't be all 24 bits (255.255.255.0)

The answer is exactly in our exchange in comments:

The critical thing is whether any have addresses outside 9.9.192.X ... I > suspect from your description that some do/did. – jonathanjo

Yes, there are/were* on 9.9.193.0 and printers are/were on 9.9.194.0 – that-ben

Because you had some hosts with addresses 9.9.192.X, some with 9.9.193.X and some with 9.9.194.X, for them to be in the same local network, you must use a network mask of /22 or below. (Many find multiples-of-four netmasks easier to deal with, and so /20 isn't that uncommon on private networks. Your predecessor apparently was in this group.)

For 20 hosts, this is all pretty strange.

• /20 is pretty huge (4096 addresses) when you only need 20. (It's surely not possible your predecessor thought /20 meant "space for 20 hosts"?)
• 9.9.X.X is a public address whose real hosts, out in the internet, will be inaccessible to you

Unless your predecessor had constraints you haven't mentioned (segment the hosts in some way to prevent something), it might be worth just renumbering to something more conventional. (To be concrete, you might consider 192.168.0.0/24, with router at .1, servers starting from .32, printers from .48 and laptops/workstations at .128, any switches or odd things at .8)

There are any number of posts here and all over the web on how network masks work, and it's really worth reading up on it. (Mostly they don't explain why it works this way: it's basically because th bitwise logic could be done in a microsecond or so, even on little microprocessors in 1980s.)

Kind regards and hope that's helpful.

PS: "I moved the gateway to 10.10.192.1 so there's no more 9.9.0.0 prefix" is likely to make things worse if there still are any hosts with address like 9.9.x.x. I confess I haven't followed what you've tried and what still is a problem..