Secure connect & access across 2 separate LAN Subnets using PFSense/ Sophos?

Following is an older diagram of a 2+1 level Small Business/ Startup + Co-working space, with recent expansion & need for integration.

2 Suites in a Condo Building

The following changes & information have been outlined:

2 CAT6 Networks/ LANs:

  • Level 3 & 4 LAN is integrated & maps off a Central Area (Green Area); which has the NAS

    • ISP---WR1: Asus RT-N16 N Router w Tomato USB FW + HP ProCurve 24 GigE Managed SW + ... N/W Clients
    • Look at adding a PfSense/ Sophos box around here
  • Level 5 is a separate; a simpler & sparser LAN; recent expansion and sub-let

    • ISP---WR3: D-Link DIR 816 + ... N/W Clients

Each of the above units have their own ISP with their own Data Cap limits

  • The Stuff in Green box to the upper right titled 'Load Balance ISPs' does not exist; It was the original plan that was never implemented

  • We plan to run CAT6 cable between Level 4 & 5, outside the building and maybe add some more cables + terminations, and maybe a Hub/ Switch inside Level 5 - This is open/ flexible for now

  • We need to connect & give access to NAS & maybe MFC/ Printer/ Scanner from Level 6 LAN

2 possible connection & usage scenarios pop up in my head:

  • Option A: Level 5 clients have Limited access purely to NAS & MFC; not be able to use Level 4 ISP Bandwidth
  • Option B: Level 5 & 4 clients be able to share/ switch over/ bond ISPs in some fashion?

Key Question:

With Option A constraints, How can we Connect/ access across separate LAN Subnets in 2 Suites in a building?

  • Network Partitioning
  • Addressing
  • Physical Connections
  • SubNets/ VLANs?
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 7 '17 at 17:35

If I understand your question correctly (I'm not entirely sure I do), you can use routers between the two LANs to share route information, but each LAN could have its own default route to its respective ISP. That way, each LAN has a complete understanding of the networks in the other LAN and will route traffic destined for the other LAN to the other LAN instead of to the ISP on a default route. If you have overlapping addressing, there are NAT solutions to handle that, too.

You probably want to do that on the inside of the LAN firewalls, but you could also firewall between the LANs if they need to be protected from each other.


If, as you say in the comments, you are going to us pfSense running on PCs as your routers, you will need to connect the two routers together (a direct link without a switch in between should work). You can either use static routing on each router to point to the networks on the other router (this doesn't scale, and network changes become more difficult), or you can run a routing protocol, probably OSPF, between the routers so that they share routes automatically.

You can run WAPs to give you the Wi-Fi.

You will need to make sure you have some sort of firewall between each PC running pfSense and the corresponding ISP. This can be a software firewall on the router/PCs, or, better, separate, dedicated firewalls.

This allows devices on each network access to the other network. You can restrict access between the networks with access lists on the router/PCs. Do this if you don't want all devices on each network able to access all devices on the other network.

  • Could you detail out the solution a little more clearly? PS: We can change & customize the addressing schemes. What kind of low cost device / router can we use and how would we "map" the addressing/ NAT? Lets say currently LAN1 is 192.168.10.x LAN2 is 192.168.20.x - With .1 as their LAN address on the existing WRs; WR1 & WR3 connected to ISP and act as gateway to the Net, - What would be easiest/ inexpensive way..? PS: with and without additional hardware between the LANs? – Alex S Jan 6 '16 at 12:06
  • Your questions all seem to depend on the equipment you would choose, but product and resource recommendations are specifically off-topic as are questions involving your existing wireless routers which are consumer-grade equipment. You should suck it up and buy business/enterprise-grade equipment (routers, WAPs, etc.) to replace them. What you seem to be concerned about is really very routine with the proper equipment. – Ron Maupin Jan 6 '16 at 15:08
  • Young Startups cant just suck it up. We have 1. HP ProCurve 24 port Gig E Managed Switch + 2. Tomato USB based Router - Enterprise features at fraction of price. Both can do Vlans. 3. Cat 6 Gig E cabling & 4. Synology NAS. This is pretty sufficient and we're looking at adding a PFsense box in the future. – Alex S Jan 7 '16 at 7:02
  • "Tomato USB based Router - Enterprise features at fraction of price", and off-topic here. Questions about consumer-grade devices should be asked on Super User. – Ron Maupin Jan 7 '16 at 15:05
  • Are you saying questions for a small company or startup are not valid here? - Most consumers dont bridge 2 lans or put in ProCurve switches. Most SMBs & Startups dont spent $$$ on Enterprise range items. Especially in Asia. You are looking at just from your Big Corporate US Dollar perspective. – Alex S Jan 7 '16 at 18:18

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.