LGFL IP Allocation Through PFSence

[kyle141]

A partner school of ours is looking to move to LGFL broadband. I understand this will entail setting up a new IP range for the site on the 10.X.X.X rangeThey currently use the below range set by the current LA

Name	Subnet	Start	End	Mask
Servers / Switching	172.19.195.0	172.19.195.1	172.19.195.254	255.255.255.0
Voice	172.28.72.0	172.28.72.1	172.28.72.254	255.255.255.0
staff	172.28.73.0	172.28.73.1	172.28.73.254	255.255.255.0
Students	172.28.75.0	172.28.75.1	172.28.75.254	255.255.255.0
Printing	172.28.77.0	172.28.77.1	172.28.77.126	255.255.255.128

Has anyone used a local PFSence to keep their previous server ranges intact and utilise the new range provided by LGFL for their staff / student DHCP pool ?Thanks

[psydii]

Yes it works fine. *

 

 

We have one of the LGfL 10.x.x.x. ips on the outside of our pfsense, and our own ip range on the inside. Internally everything routes through the core switch and this has the internal IP of the pfsense as the default gateway. The pfsense box has its default gateway set to be the gateway address of the LGFL subnet. We have multiple IP addresses assigned to the external interface of PFSENSE, and NAT rules on the PFSENSE to direct traffic through these 'external' IPs depending on the source subnet/ip. This way we can apply webscreen rules to our subnets or even (if we statically assign and IP to a user's device) individuals.

 

 

*I can feel @PaddyNewman giving me the side eye from here.

Edited March 31, 2023 by psydii

[Koldov]

We had a bit of a mixed bag changing over to an LGfL I.P. subnet...

 

Initially my knee-jerk reaction was no (as it would cost us an extra 3rd part support fee to get all the switches and VLANS reconfigured), but was told there was no other option.

 

Then there was some discussion about double NAT (or something), then it turned out it might have been possible to keep our existing ranges ANYWAY...

 

Unfortunately we had already 'bit the bullet' agreed the change and contracted the support.

 

YMMV but if you are supporting the school, see if the school can link you to LGfL/Adept/Atomwide (whatever they're called now) so you can get on board with the discussions.

[Davit2005]

Double NAT should not be an issue, it jus gets a bit convoluted if you have to allow ports inbound.

[PaddyNewman]

VoIP and double NAT can be a fun one.

 

It will work as long as you set it up correctly however it's probably just as quick to re-IP. If you really want to use those, just choose a small pool of lgfl 10.x IPs, use them as NAT for the individual 172 subnets (for firewall rule processing, its a 1 to 1 NAT on our side for things that need exposing) and put your staff/students outside of the pfsense, use the core to route them correctly, should be fine.

 

Personally, I'd ditch that and just move the IP range because internal NAT is just another trip hazard in your day to day life.

 

No side eye @psydii - you do you, as long as the service works and you are aware of the usual 'its your network and we can't see that far, you'll need to investigate' as Koldov said, might be good to call and see if they can do anything or advise?

Edited April 1, 2023 by PaddyNewman