pfSense firewall in GCP for Internet ingress and egress
-
Hi,
We have built a GCP Hub and Spoke environment and we are hosting a pfSense FW in the Hub (trusted). We have a windows test vm in the same vac (different subnet) and when we set the pfSense FW as the next hop for 0.0.0.0/0 the vm is not able to egress out. We have set up some basic VPC FW rules and also any/any on the pfSense FW to ensure nothing is blocked.
At a bit of a loss as I expected this to work put of the box.
Any pointers for pfSense as a FW in GCP in particular please?
-
@aqeahmed1 Give some specifics.
IP's?
Ping?
Firewall rules? -
@jarhead said in pfSense firewall in GCP for Internet ingress and egress:
IP's?
Ping?
Firewall rules?Good Morning.
1 VPC, 2 Subnets.
pfsense Subnet is 10.0.0.0/23
Windows machine subnet is 10.0.2.0/23
I can ping from the windows server to the pfsense and get to its WEBGUI.
On the pfsense fw for now I have an any/any rule
The pfsense server CAN ping internet and is getting updates etc.
Not sure if I need anything else over and above this? -
@jarhead just to add, on the VPC firewall we also have any-any egress and any-any ingress rules. The reason for any any at this point is I wanted a quick way to prove this will work.
The end product will be multiple pfsense FW's in numerous hub and spoke environments in GCP.
We would require ingress/egress through pfsense fw's (in hub) for the services in the spokes. We will also want 3 interfaces on pfsense, LAN, WAN and TRANSIT.
But for now, I can't get this to work with a single interface so for the purpose of this test wanted to stick to a single interface to test and build up from there. -
This post is deleted! -
@Jarhead Any thoughts on this please or do you need more detail?