Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

TL;DR What technology should I use to translate an internal address (192.168.1.10) to another internal address (192.168.1.11)? So that when I access the first I get redirected to the other?

Long Story I have a pbx box that I need to move from one location to another. The ip of the pbx box is 192.168.1.160 and all the phones points to that address. When the pbx box is moved it will reside at 192.168.2.160. As it is now the two different subnets are connected by a site-to-site connection which means that you can access 192.168.2.0/24 from within 192.168.1.0/24 no problem. (That is why I mentioned them earlier to both be internal)

My problem is that the move will take some time, and I will have to manually configure all the phones for the new location 192.168.2.160. Hence I need to split this task up in two.

  • day one/ move server, nat(or what not) from address a to address b.
  • day two/ configure phones manually one by one, then remove natting(or what not)

In this way as I see it no one will ever be affected by the move

But my question is: is it a nat rule that i need to apply.

The setup:

192.168.2.0/24 -> pfsense -> WAN(site-to-site) <-pfsense <- 192.168.1.0/24

share|improve this question
    
Are you saying the phones will stay on the 192.168.1.0/24, but the PBX box alone will be moved to 192.168.2.0/24? Is the site-to-site a VPN, MPLS, or similar? Or are both pfsense boxes on public WAN IPs? –  jlehtinen Nov 14 '13 at 16:10
    
Yes, the phones will remain on 192.168.1.0/24. It is a site-to-site vpn with public wan addresses. The site-to-site connection is configured and working well –  JohanBot Nov 14 '13 at 16:26

1 Answer 1

Assuming:

pbx -> 192.168.2.0/24 -> pfsense1 -> WAN(site-to-site) <-pfsense2 <- 192.168.1.0/24 <- phones

Here's one way you could do this.

Prep:

  • Add route in pfsense1 for 192.168.1.0/24 using either pfsense2 WAN IP or VPN tunnel for gateway.
  • Add firewall rule in pfsense1 to allow necessary incoming ports FROM 192.168.1.0/24
  • Add route in pfsense2 for 192.168.2.0/24 using either pfsense1 WAN IP or VPN tunnel for gateway.
  • Add firewall rule in pfsense2 to allow necessary incoming ports FROM 192.168.2.0/24

Changeover:

  • Change config on phones to look for PBX on 192.168.2.160.
  • Change config on phones to use pfsense2 as default gateway.
  • Change pbx to ip 192.168.2.160.
  • Change pbx default gateway to pfsense1.

Keep in mind that you need to know what ports the phones use, and you have to unblock those in the firewalls. Also keep in mind that depending on your hardware you may lose some functionality in the phones when working across VPN tunnels / WAN links. For example, 3com NBX's use multicast for time updates, status lights, and paging. Some hardware will simply not support multicast forwarding across a VPN channel - which means these features won't work on remote phones.

I would recommend setting up some kind of computer at the remote site, and then setting up the configs in the firewalls. Verify site-to-site routing/connectivity before continuing with the phones.

share|improve this answer
    
Thanks for the answer. You can say that the preparation step you mention is completed since the two sites are completely visible to each other. All traffic floats freely between the two sites. in your changeover it get a little confused. Because I can't change the phones to look for 192.168.2.160 in first go. That has to come later. The phones can later be changed to point at 192.168.2.160, but for now I just want to "redirct" traffic to 192.168.1.160 to 192.168.2.160 Otherwise I don't understand –  JohanBot Nov 14 '13 at 16:33
    
So you want to put the PBX box on the 192.168.2.x subnet, while it's still connected the network hosting the 192.168.1.x subnet? This might just be my opinion, but IMO scheduling a maintenance window and having a few hours of downtime would be less work than configuring (and later tearing down) the configuration you're suggesting. –  jlehtinen Nov 14 '13 at 16:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.