0

I tried to get a setup working to make the following scenario work: Access a pc web service hosted in a different IP range/mask than the rest on-site PCs.

Details:
We have a network setup with a local network 192.168.x.0/24 with a local endian firewall acting as gateway with IP 192.168.x.10 and serving DHCP.
Therefore inside the company I can plug in any PC and access any web services hosted there from within the company on any 192.168.x.y hosting PC.

Now I want to prepare a network change. This will include changing the address ranges to 172.31.0.0/16.
To prepare this I created a VM (proxmox) hosting OPNsense. Configured with static IP 172.31.0.1 it shall have later and to prevent it colliding with the existing network. As it will replace the endian. (It could be another endian and I believe the problem would be the same).

I would like to access the web configuration page on the opnsense VM from my work PC which has 192.168.x.y. So in browser I enter 172.31.0.1.
As long as I use a 192.168.x.y address that I statically set in opnsense this works fine. But as soon as I use a 172.31.0.1 address I cannot reach it from my work PC.

I see that from my work PC it (tracert - windows pc) to the internet. So I added a route to endian:
192.168.x.0/24 to 172.31.0.0/16 via static gateway 192.168.x.10 (endian routing rule)
This prevents that the tracert shows that it is routed to the internet but it does not reach the opnsense server.

I did try several other settings in endian like adding a host entry or adding outgoing firewall rules. But I am missing something in understanding. How could I make this work? Or won't this work?

Update: Topology: enter image description here

Update 2:

Netgear is a GS752TPv2. There are no tagged VLAN.
All pcs, opnsense and endian lan interface 1 are all in VLAN Id 1.
Uplink to internet ist VLAN Id 4 and connects endian lan interface 2 to dsl modem.

Endian configuration:

  • dhcp server serving range 192.168.x.11 to 192.168.x.253
  • firewall:no port forwarding, no source NAT, no incoming routed traffic configured zones are only used: red and green.
  • outgoing firewall:many rules all of the form: green to red allowing different ports or protocols.

HERE I added a rule:

  • green to 172.31.0.1 (opnsense) for all - but it did not change anything. I left it in there until I end my tests.
    The other testing configuration:
  • is routing in static routing config of endian (as stated above):
    192.168.x.0/24 to 172.31.0.0/16 with static gateway 192.168.x.10 (endian). this one is also still active

Uplink manager of endian: is configured to connect to the DSL modem on the LAN interface on UPlink VLAN.

That is about all of the configuration for endian and switch.

Improve this question
7
  • Routers route packets between networks, but the routers need to know where the networks are. Please edit your question to give us a good network description or diagram, the network device models, and the network device configurations. We cannot simply guess or speculate.
    – Ron Maupin ♦
    Oct 16, 2019 at 14:22
  • ok. But it is not supposed to route. All is plugged into one switch. I will make a picture and post it.
    – Uwe Hafner
    Oct 16, 2019 at 14:23
  • 1
    To send traffic from one network to another network, you need a router. Routers route packets between networks. Switches (bridges) bridge traffic on the same network. You have two different networks, so you need to route packets between the networks with a router.
    – Ron Maupin ♦
    Oct 16, 2019 at 14:25
  • @RonMaupin I updated the question with the topology. Is this what you were thinking about?
    – Uwe Hafner
    Oct 16, 2019 at 14:43
  • OK, but what are the network device models and configurations?
    – Ron Maupin ♦
    Oct 16, 2019 at 14:44

3 Answers 3

Reset to default
4

You cannot do this the way you are trying to do it.

Your work PC will mask the destination address with its network mask and realize that the destination is on a different network, so it will frame the packet with its configured gateway (router) layer-2 address, and the frame will be sent to the gateway. The gateway doesn't have a route to the network, so it will send the packet to its default route (Internet).

Routers route packets between networks. Your switch doesn't understand layer-3 packets unless you configure routing on it (it seems to be a layer-3 capable switch). You will need to configure VLANs. You will also need to modify the firewall/router configuration so that it has a route to the switch as the route to the new network, and that it can NAT for the new network to the Internet.

No offense, but this all seems to be over your head, and your company should probably hire an expert for a few hours to set this up for you. The expert can explain and document what is done.

Improve this answer
4
  • So if I understand correctly I cannot make it work if the opnsense VM (172... ip) is hosted on a proxmox with 192 ip because I only have one network adapter on the proxmox vm hoster connected to the switch and cannot bring them into 2 different vlans to let the netgear route between the two ?
    – Uwe Hafner
    Oct 16, 2019 at 15:37
  • 1
    As I explained, routers route packets between networks. A host will send packets not destined for its own network to its configured gateway. What goes on inside a host is actually off-topic here. You would need to configure routing inside the VM host, and you would need to configure all the outside hosts to send traffic destined to the network to the host with the VM. You can ask about host/server/VM configurations on Server Fault for a business network. We can help with the network outside the host for on-topic network devices.
    – Ron Maupin ♦
    Oct 16, 2019 at 15:42
  • Just as a side note: Proxmox hosts usually do bridging between the host NIC and the virtual NIC inside the VM. No host routing should be required here unless there is - for example - a dedicated VM network created within proxmox which is isolated from hosts network adapters. But this would be off-topic here and better discussed on Server Fault, as @RonMaupin already said.
    – Sebastian
    Oct 17, 2019 at 10:42
  • Did not get it to work- too many screws I can turn I guess. I believe I was close at some point but then I found a workaround. In opnSense I can configure a Virtual IP. I set it to an ip of my endian network and now I can access the configuration page of opnsense from my work pc. Once I switch the network to opnsense my work pc will be in the new address range from the new dhcp. thanks again. You did give me some insights I was missing but still learning.
    – Uwe Hafner
    Oct 17, 2019 at 12:47
1

In addition to the other two answers, which are correctly pointing out what your overall problem is with understanding of routing and re-addressing, I just want to briefly give you two easy options as a starting point if you really want to connect to the OPNSense system and do it all yourself:

  1. You could set up an IP - Alias with a 192.168.x.N address on your OPNSense VM to connect the VM to your existing LAN.

  2. Or, you can add an additional Interface to your endian in the new 172.32.0.0/16 Subnet and let this device do the routing.

This should point you in a direction where you can achieve your goal of just connection to the OPNSense system from one of your other workstations. Please do your research to understand what this means, how routing works and what side effects this could have!

Improve this answer
1
  • I didn't see your answer in time but stumbled upon the Virtual IP. So that is what I am currently going with. I tried to do the point no. 2 in endian first but couldn't figure out how to add another interface. There are only options for VLAN and uplinks. After killing the internet connections with my vlan settings several times I stopped trying to configure vlan in endian and netgear switch :-).
    – Uwe Hafner
    Oct 17, 2019 at 13:21
0

For renumbering a network there are different strategies:

Run in parallel

(may be tricky with DNS / require an additional, temporary DNS server)

  1. add new IP address as secondary to all servers and services (routers etc)
  2. change all other nodes (clients) one by one
  3. remove old IP address from servers and services, make secondary IP primary

Use router assistance

(least disruptive but the most time-consuming)

  1. set up a router with IP addresses from both ranges on the LAN interface (may require explicit 'hairpinning' support)
  2. make that router default to all nodes or add static route to old/new network
  3. change nodes one by one

All at once

(disruptive but quick)

  1. make sure all services use DHCP
  2. reduce the DHCP lease time to a few minutes
  3. wait for older/longer leases to renew
  4. change all IPs on the DHCP server & the few ones w/o DHCP
  5. reconfigure DHCP lease time to more sane value
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.