Issues with Subnet behind UDM Pro
-
@misinthe said in Issues with Subnet behind UDM Pro:
I don't know why it being a VM would've changed anything?
Because the hypervisor comes into play and may take affect on the networking.
But yes, there should be no need to have 2 firewalls normally, but it should be possible though.
-
@viragomann Well, my VM Host has 3 x 4Ports NIC Cards, so what I did was assign 3 physical ports to the pfSense, one for each WAN, LAN, and Opt1. That way it didn't use the virtual NIC.
-
@misinthe
I see. So the hypervisor should do nothing on the NICs assigned to pfSense VM. -
@viragomann
Right, they're just bridges. Anyways, I guess we can close this for now, I don't know if I'll try again in the future or not. -
@viragomann said in Issues with Subnet behind UDM Pro:
So no idea, why this should not work, just some networking
IT DIDN'T WORK, BECAUSE HE HAD DOUBLE ROUTING UNDER NAT AND DID NOT EVEN EXPLAIN THAT HE USED VM.
LACK OF INFORMATION IS ALWAYS THE CAUSE OF THE PROBLEM.
-
@silence said in Issues with Subnet behind UDM Pro:
@viragomann said in Issues with Subnet behind UDM Pro:
So no idea, why this should not work, just some networking
IT DIDN'T WORK, BECAUSE HE HAD DOUBLE ROUTING UNDER NAT AND DID NOT EVEN EXPLAIN THAT HE USED VM.
LACK OF INFORMATION IS ALWAYS THE CAUSE OF THE PROBLEM.
Why are you yelling? I appreciate everyone's time and effort, like we specified, it being a VM had nothing to do with the issue, so that piece of information didn't matter. And even if it was double NAT, the static routing should've fixed that issue.
-
The one test I don't see mentioned here and what I would have done first is to try to ping the UDM LAN IP from an OpenVPN client or from pfSense using the OpenVPN server IP as source.
That IP (I'd guess it's 10.10.0.1) should always respond as long as firewall rules allow it.
Really in that situation you are using the UDM as a router only, which you would expect to work.
Whether or not pfSense has/had a private WAN IP would only be an issue if it conflicted with one of the internal subnets which is unlikely given their numbering. Since OpenVPN clients were able to connect it probably wasn't.
Steve
-
@stephenw10 I did test that from the pfSense using LAN and it couldn't reach 10.10.0.1. I didn't mentioned it because no one asked, but it was one of the pings I tried, and yeah. In theory the pfSense is only doing firewall and the UDM Pro is routing, and all the UDM Pro networks work fine reaching the internet and everything, so the setup was working. It was just the internal networks on the pfSense weren't able to go through the UDMP.
-
Then it was almost certainly a config issue in the UDM.
Outbound connections would work without any special config in the UDM but it's probably still outbound NATing traffic which you don't really want. It should just be routing traffic and not NATing in either direction with pfSense handling outbound NAT for 10.10.0.0/24.That shouldn't prevent it routing inbound traffic but clearly it wasn't doing that for some reason.
Steve
-
@misinthe said in Issues with Subnet behind UDM Pro:
It was just the internal networks on the pfSense weren't able to go through the UDMP.
Most likely because the UDMP was still natting, and to get behind you would have had to setup port forwarding on the UDMP, etc.
If your going to use the pfsense LAN as transit network to downstream router, please do not put any devices on this network - or your going to run into asymmetrical traffic flow. Whenever you connect 2 or more routers together, especially if they can firewall devices on this "transit" network between routers are going to have asymmetrical flow unless you route on each of these hosts to which router to go to get to specific networks..
If the downstream router does not nat you will most likely see the problem with downstream network trying to talk to devices on the transit..
You run into this problem..
Pfsense never saw the SYN, so a SYN,ACK going to be block.. If your going to setup routers that talk to each other and route between networks they are attached to.. Setup a transit network.. See this diagram.
