1

Let's say a colo assigns me an IP range 111.222.1.0/26. 111.222.1.1 is the gateway for my usable IP range 111.222.1.2 - 111.222.1.62.

I'm using pfSense firewall and have configured its external interface as 111.222.1.2/26.

I would like to have couple of IPs usable outside of the router/firewall in order to connect a remote console access device and a remote power switch outside of the pfSense appliance for the best chance of recovering from error conditions remotely (including, if necessary, restart of and console access to the pfSense appliance).

I would like to know if it's possible to use, for example, the IPs 111.222.1.61 and 111.222.1.62 of the given IP range outside of the firewall's external interface (split by a switch outside of the firewall's WAN interface), assuming I've configured those two IPs to be blocked in the router?

Would I get collisions? Would this work reliably? If this doesn't work, I'll have to request the smallest available IP segment to be used with the 'external' devices, and not include it in the firewall's configuration.

Thanks for any advice!

Ville
  • 267
  • 2
  • 11
  • Not related to your question directly, but (while I empathize with your desire for resiliency / recovery), I would recommend against placing a console and power controls outside of your protected network from a security perspective. – Slartibartfast May 12 '11 at 05:53
  • @Slartibartfast .. both devices have fairly good security of their own; they can be set, for example, to authenticate with a RSA key only. In this specific configuration the benefit from the potential speedy remote recovery may outweigh the slightly added risk of placing them out in the open. – Ville May 12 '11 at 14:44

1 Answers1

2

As long as the pfSense machine isn't answering for those IPs you're find to use them on other devices on its external side. You've got the right subnet mask specified on its external interface such that it will ARP for any IP not assigned to it in that subnet if it needs to communicate with them.

When you say "collisions" I suspect you're referring to IP address conflicts rather than actual layer 2 collisions (which aren't going to happen in a switched medium). Don't configure more than one device to answer for the same IP address and you won't have problems.

Evan Anderson
  • 141,881
  • 20
  • 196
  • 331
  • Thanks for the answer! You're right, I meant IP address conflicts. I'll proceed with testing this setup as planned. – Ville May 12 '11 at 14:47