Providing Public IP to a VM interface
-
Hello!
I've got a scenario where I'm upgrading a pfSense box from 2.2.x to 2.3.x and I've cropped up an issue between the configurations.
The WAN interface carries a /27 direct from the DC. Lets just call this .97/27 from now on.
There is also a VLAN interface attached to a second interface, which has an IP address of .112/29 (Sat within the .97/27 range). This seems to be acceptable on version 2.2.4, but not on 2.3.x
When trying to apply the VLAN IP configuration on version 2.3, the error comes up saying that .112/29 overlaps with WAN .97/27
The requirement is that the system we use on the VM has to have a public IP on it, no other solution.
Here is a quick overview of the topology
DC Switch -> PfSense WAN .97/27 (bge0) -> VLAN 200 on igb1, configured with .112/29 -> XenServer nic1 -> VLAN 200 -> VM .113/29
I appreciate this probably isn't the best solution, but it seemed to work on the older version, how would you recommend this be configured within pfSense 2.3?
Just to clarify, there isn't a switch behind pfSense - This is currently not an option for the solution. The pfSense box has 8 network ports, 1x WAN + 7 others
The only devices behind the pfSense box are two XenServers, with two ports being used by each, one for management and one for trunk/VLAN.
Thanks in advance.
-
So your DC gave you a /27 to use for your hosts. They did not route this /27 to you. You can not just subnet that down, why exactly does your stuff behind have to be on public? Why can they not be rfc1918?
Why do you have pfsense? So you can firewall? When since you have a /27 that you can not break down just bridge so that you put this network on both sides of pfsense..
If you want to use this /27 broken up into smaller networks behind pfsense, then have your DC route that network to you vs just hanging that network off their device and letting you use IPs in it.
-
Hello Johnpoz
Thank you for the reply.
It is just a single VM which requires the public IP address, everything else is public via NAT to a private IP address.
I believe it's the way the system has been coded which will only work with a direct public IP address.
So in theory, we'd only really need a single Public IP address to be assigned to the VM,
Would it work if a VLAN was bridged with the WAN?
We could then add this VLAN to the XenServer host, and then configure the VM interface with the desired public IP address?
Would this mean, for this individual machine, that firewalling would be done locally, rather than on the pfSense firewall?
EDIT:
I've set up a test firewall in a similar scenario, and I have created a filtered bridge with the WAN interface, to a VLAN interface and been able to perform what I've needed to.
