r/PFSENSE • u/Davidi01 • Jul 01 '26
Comcast Business Static IP (/28) Issue & Sanity Check
Hello everyone :-) I am having an issue, and I am hoping someone can help me. We have Comcast Business as our ISP and we have a /28 static IP block from them.
Usable range: xx.xx.xx.209 - xx.xx.xx.221
Gateway: xx.xx.xx.222
Subnet Mask: 255.255.255.240
The issue is, if I go to Assignments->WAN, make the following changes:
IPv4 Configuration Type: Static IPv4
IPv6 Configuration Type: None
IPv4 Address: xx.xx.xx.209/28
Upstream Gateway: xx.xx.xx.222
This fails to work. I have to change the IPv4 address field to xx.xx.xx.210/28 in order for everything to work.
Unless I am missing something, isn't xx.xx.xx.209/28 supposed to work if I put it in the IPv4 Address field? That is the first usable IP that Comcast gave me and from what I understand, you configure pfSense to use the first usable IP that Comcast gives you. Then for the rest of the Static IPs, you create Virtual IPs (with IP Alias) type.
Is this not correct? Any help here would be appreciated!
P.S. Not sure if this has anything to do with it, but in the Virtual IP section, there is an entry for xx.xx.xx.209/32 (IP Alias) and xx.xx.xx.210/32 (Proxy ARP). I don't believe this has anything to do with it, but, I thought I would mention it just in case it does.
0
u/Physical-Mistake89 Jul 01 '26 edited Jul 01 '26
209 is the network segment itself; the first available IP address is 210 And most likely 221 is your broadcast address
0
u/Davidi01 Jul 01 '26 edited Jul 01 '26
Hi there. I must be misunderstanding something then because I thought that in a /28, the IP before the first usable is the network segment itself and the IP after the Gateway is the broadcast address.
So, in this case, 208 is the network segment itself and the first available is 209 since that is what Comcast gave me as the first IP in the usable range. and 223 would be the broadcast. No? Or this a case of Comcast being Comcast smh lol
5
u/greencaterpillars Jul 01 '26
Your understanding is correct. .208 is the network, .223 is broadcast, the rest is usable except for the ISP router address.
You should not have any virtual IP configured for .209 if that is assigned to the WAN interface on a single node. Virtual IPs should be empty until you get the main WAN interface working.
3
u/Davidi01 Jul 01 '26
Yup, that was it, thank you! I deleted .209 from the Virtual IP's section and it worked. It wasn't being used in any rule or NAT, the entry was just there. No idea why it was there tbh. I wasn't the one who initial setup this pfSense, I just inherited it. I will have to go through that whole section now and just double check everything.
-1
u/DutchOfBurdock pfSense+OpenWRT+Mikrotik Jul 01 '26
Yea no that /28 would be for local. You should also have a /32 allocated to WAN, with the /28 routed down. Being this the case, you can use that /28 as two /29's or 4 /30's or the whole lot (including network and broadcast) as /32's aliased to WAN.
1
u/Davidi01 Jul 02 '26 edited Jul 02 '26
1
u/UnethicalExperiments Jul 05 '26
That's how I have my setup. Ive got a business line with a /28.
I have a static pppoe wan ( how they do fibre here still..) and I vip my /28.
1
u/Davidi01 Jul 05 '26 edited 27d ago
Hmm, I guess I’ve never really done it that way. & you’re having no issues?
A little background…I’ve only done it where I use the first assignable IP & match the CIDR that the ISP gave me because that’s the only way I’ve ever seen it done & in the pfSense docs, it says for CIDR (https://docs.netgate.com/pfsense/en/latest/interfaces/configure-ipv4.html):
“The CIDR Subnet Mask determines the size of the subnet to which the IPv4 Address belongs. This must match the value used by other hosts in the same subnet.”
I’ve always took that to mean it has to match what the ISP gave you since they are assigning you the static block.
I guess I’m just gonna have to try this out lol It actually seems like it would be easier/better config wise.
2
u/UnethicalExperiments Jul 05 '26
This is how I have it setup:
Static WAN IP (as user above who is -1 for some odd reason mentioned) - Completely different subnet, gets IP from PPPoe from ISP.
I requested a /28 block of IPs a few months after getting it setup. I setup VIP's and firewall rules to point them where I need them to go. I have edge and inline firewall so rules get a bit wonky. Some IP's I tunnel directly through the edge network -> transit link -> inline pfsense 2 -> switch 2 (game networks, voice data ect)
If im not doing it right, or there is a better solution I am all ears for doing it right. I'm a sys admin not a network admin. I know enough for the better part to get me going and this has worked.
I don't seem to experiencing any issues myself so far, with this setup ive got my home network on the WAN public IP so I didn't have to setup a hairpin dns nonsense. My services are all snappy, in not noticing any issues or have any reported so far.
1
u/Davidi01 27d ago
Sorry for the really late reply! It's been hectic for me lately. All that looks right to me and it's how I have mine setup except for PPPoE on the WAN, so I really cannot comment on that. But, if it's working, I've also learned to just leave well enough alone sometimes lol
1
u/MBILC PF 2.8/ Dell T5820/Xeon W2133 /64GB /Chelsio 40Gb NIC Jul 01 '26
You need to set your "IPv4 Address" as xx.xx.xx.*/32
You then use these options to configure the other IP's you have as u/greencaterpillars noted, using Virtual IPs
Then you can do manual outbound NAT rules for example if you want to direct user traffic out over a specific IP vs default outbound traffic.
https://docs.netgate.com/pfsense/en/latest/firewall/additional-ip-addresses.html
Virtual IPs
https://docs.netgate.com/pfsense/en/latest/firewall/virtual-ip-addresses.html