Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to migrate a linux machine to some kind of router distribution, I've chosen pfSense for this. The problem is that the WAN configuration used on the linux machine is really crappy, however this can't be changed right now. Current configuration:

auto eth2
iface eth2 inet static
up route add -host eth2 || true
up route add default gw eth2

The crappy thing on this is that it routes from eth0 to eth2, eth0 is a subnet and eth2 uses, so an IP out of the subnet of eth0, as next hop. I tried getting this configuration to work using pfSense, therefore:

// pfSense WAN configuration
static IP:

This seems to work, however I had to use a /24 net, while on the original linux configuration, there is a /32 on the WAN side. Is this any problem? What's the practical difference between this? I couldn't use /32 on the pfSense WAN, as pfSense expects the gateway to be in the subnet of the WAN IP.


My current configuration now looks like this:

// pfSense WAN configuration
static IP: 123.456.789.1/29
gateway:   123.456.789.4

// pfSense LAN configuration
static IP: 123.456.789.1/24

- NAT is disabled

When using this configuration I can't access the web interface anymore, it works again when I reset the WAN IP - anyone knows how to get the routing working / access the webinterafce with this configuration? I know this config sucks, but as WAN and LAN are different interfaces, shouldn't pfSense be able to distinguish between them?

share|improve this question
From what IP are you accessing the webinterface? Are you coming from tha LAN? And why the hell is all this setting like it is? Why don't you use a private net on your LAN? Is that /24 assigned to you by your provider? How are you supposed to configure your WAN link by your provider? What net should be one the WAN link? – Michuelnik Oct 29 '12 at 10:01

You need to use whatever the real mask of that subnet is, as provided by your ISP. It won't be /32. /24 may be too big of a subnet depending, in which case you'll break connectivity to other customers of your ISP.

share|improve this answer

You can use a, thats the minimal supernet that contains .1 and .4.

Problems exist only, if you want to reach other hosts within this network that lie outside this layer2. Basically you have to deal with the "longest prefix matches" way routing works.

How did you configure eth2 on the pfSense Box?

share|improve this answer
sorry for the late reply and thank you! I updated my configuration, please see my original post. Still would need some help \: – Oct 27 '12 at 19:28 what is your exact problem ATM? Just not reaching the webinterface? – Michuelnik Oct 29 '12 at 10:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.