[Technical] Problems with second network

@Neliommiosch84

According to two other threads of yours, you have been experimentally working on several special solutions in your network area over the last few months.

If anyone wants to join in the discussion on the new questions, I think it’s relevant to read through the previous threads beforehand, so I’ll link them here:

[https://community.swisscom.ch/t5/sicherheit-im-Internet/DMZ-Firewall-und-WLAN/td-p/791751](https://community.swisscom.ch/t5/sicherheit-im- Internet/DMZ-Firewall-and-WLAN/td-p/791751)

and also:

[https://community.swisscom.ch/t5/Internet-general/DNS-Server-aus-anderem-Subnetz/m-p/815635#M71908](https://community.swisscom.ch/t5/Internet-general/ DNS-server-from-another-subnet/m-p/815635#M71908)

I don’t feel able to do this myself at the moment, as I have no idea whether you are working with strictly separate networks or with a hybrid network including a static route, what kind of DNS construct is currently active, and in which network There are actually the clients that are currently causing problems 🙂

@Neliommiosch84

As already mentioned earlier, my own approach would be to avoid “mishmash” in networks and the resulting unnecessarily increasing complexity as early as possible by design.

So my solution would still be:

- all clients (except perhaps the blue TV boxes) directly into the network behind the pfSense

- Delete static route between IB and cascaded network for clear network separation and increased security

This means that you would no longer have any possible side effects of the combined operation, because DHCP and DNS would then be centralized for everything on the pfSense.

By the way, I’m happy to let @r00t judge your current problems with the hybrid approach, because unlike me, he actually has a pfSense network in operation at the moment.

---

@Neliommiosch84 wrote:

[…] Unfortunately, I no longer have access to all http/https services in the opnsense subnet every day, the opnsense appears as online in the router, but access to my homelab is no longer possible, direct IP access usually works completely, only http/https doesn’t work at all.

What exactly do you mean by “direct IP access works most of the time”? Ping? And from where does http and https not work; from externally (Internet) or from the home network?

Another question about your server network: how big is it? /24 or /16 or something in between?

I briefly read through the other two (long) threads and summarized the most important things from my point of view (correct me if I misunderstood something):

- On the opnsense (or is it a pfsense according to some of your posts?!?) NAT is disabled

- The opnsense is configured as a DMZ host on the Internet box

- A static route for the server network via opnsense is set up on the Internet box

- The DHCP server in the home network is the IB, whereby you let the clients use their own DNS resolver in the server network (or does it run in the client network?) using option 6

- The DNS server is located in your server network, with opnsense (pfsense?) configured as a DNS proxy

- Clients (LAN/WLAN) all run directly on the IB and not in the server network, so there is no longer an IGMP proxy on the opnsense

It’s permissible to remark that you’ve already put together a pretty complex construct of potential sources of error…

@Neliommiosch84

Why would you have to place the OpenSense appliance directly next to the Internet box for a truly separate network?

Where it is now, it is probably connected to a LAN cable and this can be up to 100 meters long.

Do you also have an additional physical LAN cabling problem?

@Neliommiosch84

And as a general addendum on the topic of the number of possible clients directly in the network of an Internet box:

In the past, there have been repeated user reports about problems with Internet boxes when dealing with a very large number of clients in the home network.

It is somewhat unclear where the specific size limits are, but based on various practical experiences it has become clear that anything with more than 60-80 clients can be a problem repeatedly.

By the way, the maximum limits in the WLAN area are clearer, because depending on the WLAN drivers used, they are 32 or 64 WLAN clients per WLAN band, depending on the specific model.

Long story short, Internet boxes are purely SOHO devices for run-of-the-mill users, and usage that deviates greatly from the usual user profile always leads into unexplored territory, as it lies outside of any of the commonly used test scenarios.

---

@Neliommiosch84 wrote:

[…] I would therefore like to try to solve the other problems of the current situation.

---

The only thing I understand from your initial post is the following

• Sporadically problems occur with access to http and https services in your server network that is disconnected via opnsense
• The error condition disappears for approx. one day after rebooting the Internet box

In order to solve a problem, it is always helpful to first understand it as precisely as possible 😀

And in order to achieve exactly this, you should leave the error state as it is next time and then test what still works and what doesn’t. So for example:

• Does ping go from the user network to the Internet?
• Does ping go from the user network to the internal server network?
• Does ping go from the internal server network to the user network?
• Does ping go from the internal server network to the Internet?
• Is DNS possible in the user network (if necessary, don’t use your own DNS server, but rather the IB’s)?
• Does DNS work in the internal server network?
• Does http/https access come from the Internet?
• Does http/https access come from the user network?
• Does http/https access come from a client within the internal server network?
• Does it really only affect http/https services, or others too?
• etc. etc.

So next time, don’t restart the IB straight away, but rather systematically test one thing at a time and narrow down the error. Divide and conquer.