Use public IP for pfsense thats behind a pfsense?
-
@wmw509 why do you want/need a 2nd pfsense? This could just be done with 1 pfsense, you can create vips for your other IPs out of the /29
-
@viragomann I added an allow any to any rule on that interface, and on pfsense2 I defined the wan with the same gateway used on pfsense1
-
@wmw509
Do you have only this one /29 public IP block from the ISP or is this routed to a primary public IP? -
@viragomann only the single /29
-
@johnpoz this could be done with a single pfsense, but I want to keep these 2 areas with their own pfsense if possible. They might move / not be right next to each other in the future and need to have their own standalone network.
-
@wmw509
If you have proper rules on pfSense 1 on the interface or bridge you should at least be able to ping its WAN IPs and the upstream gateway. -
@viragomann any advice on how those rules should look? I did a basic any-to-any rule but I am still not getting anything
-
@wmw509 I wouldn't bridge through pfsense 1.. Why would you not just put a switch between your isp and your pfsense so you can connect both of them.. This is by far the simplest solution for sure!
Doesn't really need to be anything fancy to be honest.. Any 10ge dumb switch should be fine.
https://mikrotik.com/product/crs305_1g_4s_in
Runs like $150, 4 sfp+ ports which would be 1 from your isp, 1 each for your pfsense boxes and then an extra you could use for something else or another pfsense even ;)
-
@johnpoz yeah I was looking at that exact one haha. I will probably end up doing that, I was just hoping to find a solution when I'm on site. In the mean time I got it working by just double nat'ing pfsense 2 and using a virtual IP on a port forward so my VPN/remote access works.
I'll have to revisit to get it set up in a more correct way, but for now at least pfsense2 has internet
-
@wmw509 double nat works - and to be honest simpler solution than the whole bridge thing..
to me the switch is the "correct" way to do it.. Do you have another 10ge switch on site you pipe the connection through?
-
@johnpoz Unfortunately no, but I ordered that mikrotik switch. Looking at compatible transceivers now as well. I'll be back on site before too long and can switch things over.
