Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Let's say a colo assigns me an IP range 111.222.1.0/26. 111.222.1.1 is the gateway for my usable IP range 111.222.1.2 - 111.222.1.62.

I'm using pfSense firewall and have configured its external interface as 111.222.1.2/26.

I would like to have couple of IPs usable outside of the router/firewall in order to connect a remote console access device and a remote power switch outside of the pfSense appliance for the best chance of recovering from error conditions remotely (including, if necessary, restart of and console access to the pfSense appliance).

I would like to know if it's possible to use, for example, the IPs 111.222.1.61 and 111.222.1.62 of the given IP range outside of the firewall's external interface (split by a switch outside of the firewall's WAN interface), assuming I've configured those two IPs to be blocked in the router?

Would I get collisions? Would this work reliably? If this doesn't work, I'll have to request the smallest available IP segment to be used with the 'external' devices, and not include it in the firewall's configuration.

Thanks for any advice!

share|improve this question
    
Not related to your question directly, but (while I empathize with your desire for resiliency / recovery), I would recommend against placing a console and power controls outside of your protected network from a security perspective. –  Slartibartfast May 12 '11 at 5:53
    
@Slartibartfast .. both devices have fairly good security of their own; they can be set, for example, to authenticate with a RSA key only. In this specific configuration the benefit from the potential speedy remote recovery may outweigh the slightly added risk of placing them out in the open. –  Ville May 12 '11 at 14:44

1 Answer 1

up vote 2 down vote accepted

As long as the pfSense machine isn't answering for those IPs you're find to use them on other devices on its external side. You've got the right subnet mask specified on its external interface such that it will ARP for any IP not assigned to it in that subnet if it needs to communicate with them.

When you say "collisions" I suspect you're referring to IP address conflicts rather than actual layer 2 collisions (which aren't going to happen in a switched medium). Don't configure more than one device to answer for the same IP address and you won't have problems.

share|improve this answer
    
Thanks for the answer! You're right, I meant IP address conflicts. I'll proceed with testing this setup as planned. –  Ville May 12 '11 at 14:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.