1

I’m working with someone who inherited a network with little documentation. They had to replace the firewall after the old one died, so we can’t pull up the old config. The old firewall was whitebox Untangle. The issue I’m seeing is IPs on some subnets are not able to get to the internet, but others are able to get out.

Here’s an example:

Device at 172.16.87.10/22 with gateway of 172.16.87.254: This device can get to internet

Device at 172.16.88.10/22 with the same gateway of 172.16.87.254. This device, no internet.

What’s confusing is the 172.16.88.10 device even with a /22 subnet mask is not on the same subnet as the gateway it has set (172.16.87.254). The only thing that changed was the firewall replacement. The firewall has the IP address 172.16.87.254/22. Is it possible the old firewall had a different subnet mask, like if we change the firewall to a /20 then it will encompass the other networks, but I’m not sure if that’s viable. As far as we know there are no L3 devices, and all of the computers that can’t get out have the same gateway of 172.16.87.254 on a different subnet.

I know we are sort of grasping at straws here but if anything rings a bell as to how the old firewall might have been configured I’d appreciate any input.

5 Spice ups
2

Gateway should be on the same subnet as the device. What is the subnet mask used on the devices?

1 Spice up
3

Devices are all /22. The on-site guy mentioned something about in the DHCP settings on their domain controller it said something about supernet, but I don’t have access to that server at the moment.

4

Supernets are just a way to group subnets together in DHCP. If the default gateway is on a different subnet than the computer, the computer has no way to get to its default gateway… that’s the point of the default gateway. It doesn’t work any other way unless there is another system on the network serving as a default gateway for certain systems.

2 Spice ups
5

Can you look at your DHCP configs and see if the Gateway is a typo in the configs?

6

If the firewall is truly the only change then logically there are only a few things it could be. Off the top of my head I’d think it was some kind of wacky NAT rule, the X.X.88.X/22 network is on a different VLAN, or port configuration on the old firewall was set up for different subnets. Any chance the switch ports on the old firewall were in use? If you’ve got any smart switches I’d start looking at port VLAN membership. If you have a saved config file for the old firewall (fingers crossed) you may end up having to buy or otherwise procure another Untangle and load the settings to see what you’re actually working with. Alternatively you can also rebuild the logical half of your network. I doubt you’re going to find a quick fix either way though, good luck.

7

So I ended up just adding one of the routed interfaces on the firewall with an IP in the other subnet and updating the default gateway in DHCP and we are in business. Not sure how exactly the Untangle install was configured. Thanks everyone for your input!