Physical host unable to ping virtual host through virtual pfSense firewall
-
Hey guys,
I'm fairly new to virtualization and have begun the process of virtualizing a firewall using dedicated hardware in Proxmox. I've got everything up and running but I'm having some issues. Currently I have a WAN interface, a physical LAN interface and a virtual OPT1 interface for my virtual servers. I have allow any rules on the LAN and OPT1 interface for testing. LAN is a 10.10.10.1/24 interface and OPT1 is a 10.10.20.1/24 interface. I have a virtual server 2022 sitting at 10.10.20.5 and a physical laptop at 10.10.10.10. From both devices I have outbound Internet connectivity as expected. Both are unable to ping one another. Checking firewall logs I can see the traffic being allowed but traceroutes show it not going pass the firewalls interface. Pinging from the firewall to either of these addresses results in 100% transmission lost. Routes are shown for each network. From each device I can ping the gateway of each interface. I created another virtual interface on the LAN subnet on a separate VM and can ping from the OPT1 2022 VM to the LAN VM.
Not sure what's causing the issue but I suspect it's likely something to do with the virtualization of the physical hardware. Any assistance would be hugely beneficial.
-
@dingodoggo69 You need to show us your firewall rules.
-
@nollipfsense sorry, I should've said I just have any any rules on all interfaces but the WAN.
-
@dingodoggo69 “any” rules allow ICMP not just TCP? Is the firewall on the target set to allow ICMP from outside its subnet?
-
@steveits given its set set to pass any traffic on both interfaces I would think any protocol would be accepted between subnets, unless I'm mistaken?
-
@dingodoggo69 The rule needs to say protocol “IPv4 *” not the default TCP. It happens a decent amount here on the forums and I’ve done it myself, so just asking.
-
@steveits yep I see what you mean, set to IPv4 and any protocol so shouldn't be that.
-
I am now facing this issue but the other way around...I can ping pfSense LAN from a Mac Pro connected Proxmox management port but cannot ping the physical host from pfSense LAN...keep getting host is down. I would like to get pfSense dashboard on the tab next to the tab with Proxmox management.
-
@nollipfsense have you checked host firewall settings? I fixed this by disabling the firewall on the host, ensuring NAT was setup for the LANs and setting a gateway within the DHCP servers.
-
@dingodoggo69 I had not configured firewall on Proxmox and is using whatever is set by default. I did setup firewall rule on pfSense to allow connections to and from Proxmox management port. Can I see your configuration?
-
Now, I got it right without the need to disable any firewall...my mistake was to move default gateway to pfSense. The default gateway is just for Proxmox management port to update itself and need to remain on the port originally assigned. Then, I made pfSense LAN that IP. Both accessible by my Mac Pro on the same browser tabs next to each other.