Use public IP for pfsense thats behind a pfsense?
-
I hope this is the right channel for this question, if not please let me know and I will move it.
I have a netgate 7100 (pfsense1) using IX0 for its WAN connection (I have a /29 public IP block) and am trying to get another netgate 7100 (pfsense2) working behind it using one of the other available public IP addresses. They are connected via the available SFP+ ports on each box. The diagram shown in this portion of the documentation is pretty close to what I am attempting to do.
https://docs.netgate.com/pfsense/en/latest/firewall/additional-ip-addresses.html#single-ip-subnet-on-wan
I cannot get pfsense2 access to the internet though. Here is what I have done so far.
- Enable IX1 on pfsense 1
- Bridge IX1 and WAN on pfsense 1
- Add new "Bridge0" interface and enable it with no IP address info on pfsense 1
- Configure WAN on pfsense2 with appropriate IP information.
Is there something glaringly obvious I am missing?
-
@wmw509 Why put 2 behind 1?
Put a switch in front of both and connect both to it. -
@jarhead my hope was to do this without adding additional hardware, although that might be my only option if I can't get this working in a day or so. Originally I thought I could get multiple independent uplinks from my ISP, but was just told that's not possible. I'm on site now and just trying to get internet up on pfsense2 asap
-
@wmw509 said in Use public IP for pfsense thats behind a pfsense?:
Enable IX1 on pfsense 1
Did you also add a firewall rule here to allow upstream access?
Did you state the gateway in the WAN settings on pfSense2?
-
@wmw509 why do you want/need a 2nd pfsense? This could just be done with 1 pfsense, you can create vips for your other IPs out of the /29
-
@viragomann I added an allow any to any rule on that interface, and on pfsense2 I defined the wan with the same gateway used on pfsense1
-
@wmw509
Do you have only this one /29 public IP block from the ISP or is this routed to a primary public IP? -
@viragomann only the single /29
-
@johnpoz this could be done with a single pfsense, but I want to keep these 2 areas with their own pfsense if possible. They might move / not be right next to each other in the future and need to have their own standalone network.
-
@wmw509
If you have proper rules on pfSense 1 on the interface or bridge you should at least be able to ping its WAN IPs and the upstream gateway. -
@viragomann any advice on how those rules should look? I did a basic any-to-any rule but I am still not getting anything
-
@wmw509 I wouldn't bridge through pfsense 1.. Why would you not just put a switch between your isp and your pfsense so you can connect both of them.. This is by far the simplest solution for sure!
Doesn't really need to be anything fancy to be honest.. Any 10ge dumb switch should be fine.
https://mikrotik.com/product/crs305_1g_4s_in
Runs like $150, 4 sfp+ ports which would be 1 from your isp, 1 each for your pfsense boxes and then an extra you could use for something else or another pfsense even ;)
-
@johnpoz yeah I was looking at that exact one haha. I will probably end up doing that, I was just hoping to find a solution when I'm on site. In the mean time I got it working by just double nat'ing pfsense 2 and using a virtual IP on a port forward so my VPN/remote access works.
I'll have to revisit to get it set up in a more correct way, but for now at least pfsense2 has internet
-
@wmw509 double nat works - and to be honest simpler solution than the whole bridge thing..
to me the switch is the "correct" way to do it.. Do you have another 10ge switch on site you pipe the connection through?
-
@johnpoz Unfortunately no, but I ordered that mikrotik switch. Looking at compatible transceivers now as well. I'll be back on site before too long and can switch things over.
