Firewall and routing for my LAN
-
@viragomann Alright, initially my plan was to get rid of the static routes that i created on each machine except the 5g machine for security simulation purposes, and let pfsense handle all the routing. Maybe this isn't possible, although it should be i assume?
Regardless, im not able to control the traffic on the firewall (i want to allow/block ftp access from user machine) even with these static routes on each machine. I am only able to monitor the connections in the packet captures, but no access control
Any recommendations on how I can do this ?
-
@kramnoraa said in Firewall and routing for my LAN:
@viragomann Alright, initially my plan was to get rid of the static routes that i created on each machine except the 5g machine for security simulation purposes, and let pfsense handle all the routing. Maybe this isn't possible, although it should be i assume?
As I implied above, just put the FTP into another network segment. It's a virtual machine and a virtual network, so this wouldn't be a big deal.
-
@viragomann Thank you for your prompt replies.
Okay i see, sorry i'm just a bit confused as to why putting the FTP into another network segment other than the .56.0/24 subnet would change things, bit lost as to how this would help me have access control using pfsense
right now the user machine is using 10.45.0.3 and 192.168.56.115
the ftp is on 192.168.56.121so if i move the ftp to 192.168.57.121, how would this change let me have control over the traffic flow ?
-
@kramnoraa said in Firewall and routing for my LAN:
Okay i see, sorry i'm just a bit confused as to why putting the FTP into another network segment other than the .56.0/24 subnet would change things, bit lost as to how this would help me have access control using pfsense
This doesn't help to control the access, but to get rid of static routes.
If the traffic passes pfSense anyhow, but not tunneled, you should be able to monitor and control it.
However, the pfSense IP in the tunnel subnet might be pretty useless for this, as mentioned above already.Since you don't clarify, how the 5g work, I can only make assumptions on this.
I guess, that the 5g uses 192.168.56.3 as default gateway and do masquerading on upstream traffic. All already mentioned.
This would mean, that when you access the FTP from the user machine (with routes), pfSense is seeing FTP access from the 5g with the source IP 192.168.56.116.
Don't you see this traffic? -
Hmm, this is a confusing thread!
Unclear exactly what you're trying to do here.
Whatever it is I'd be amazed if you're not hitting some asymmetric routing issues. I agree it would be much beter to have the FTP server in a different subnet so you can correct route to it and filter traffic.
-
@stephenw10 said in Firewall and routing for my LAN:
Hmm, this is a confusing thread!
Yes, I guess, this is since no one here knows, what the 5g stuff really does.
And the TO sadly does enlighten us. -
@stephenw10 @viragomann Understood, will try that now!
What im trying to do is:
I am trying to simulate a 5g network with a user equipment connecting into the network and the user equipment using the ftp server as a service through the 5g network.
The 5g network VM has an IP of 192.168.56.116/24, when the network is ran it creates a tunnel 'ogstun' that has an IP of 10.45.0.1/16. VBOX adapters (Bridged adapter and host only).
The user equipment machine has an IP of 192.168.56.115, when the user equipment is built, it creates a tunnel 'uesimtun0' that has an IP of 10.45.0.2/32. VBOX adapters (host only)
The ftp machine has an IP of 192.168.56.121/24 . VBOX adapters (host only)
The pfSense machine has the IP 192.168.56.3/24 for its LAN interfaceI created two interfaces on pfsense web gui, LAN (192.168.56.3/24) and LAN2 (10.45.0.3/16). The firewall rules i added on LAN: any protocol, source (LAN net), destination (LAN1 net).
The rules i added on LAN2:- any protocol, source (LAN1 net), destination (LAN net) and also another rule
- any protocol, source (LAN net), destination (LAN1 net)
With these rules and the ip routes configured on the individual machines, i am able to monitor all the necessary connections but unable to control traffic which is what I want.
The 5g tunnel ogstun is responsible for handling all traffic flow in and out of the network, the uesimtun0 tunnel is responsible for handling all user equipment traffic flow. When i connect to the ftp server using the uesimtun0 on the user machine and do a tcpdump on the 5g machine for the ogstun interface, the traffic is being flown correctly, so i'm thinking the traffic is going to the 5g network and then to the ftp machine
I am trying to demonstrate a bit of added security in this local 5g network which is why i wanted to use a firewall in the first place, so that i am able to monitor all traffic flow and consequently filter traffic. Sorry for confusing you guys! as i am even more confused myself :D
-
@kramnoraa From a quick glance at your drawing, yeah I would be with @stephenw10 this screams asymmetrical to me.. So that device you have listed with 10.45.0.2/32 is multihomed - that is a asymmetrical waiting to happen for sure.
Why exactly do you have interfaces in a bridge in pfsense? And they are using 2 different L3 networks?
-
@kramnoraa said in Firewall and routing for my LAN:
The 5g network VM has an IP of 192.168.56.116/24, when the network is ran it creates a tunnel 'ogstun' that has an IP of 10.45.0.1/16. VBOX adapters (Bridged adapter and host only).
The user equipment machine has an IP of 192.168.56.115, when the user equipment is built, it creates a tunnel 'uesimtun0' that has an IP of 10.45.0.2/32. VBOX adapters (host only)
I created two interfaces on pfsense web gui, LAN (192.168.56.3/24) and LAN2 (10.45.0.3/16).This part is not clear to me. I appealed above already.
How should pfSense get a leg into the tunnel between the 5g and the user equipment, even it has an IP?When i connect to the ftp server using the uesimtun0 on the user machine and do a tcpdump on the 5g machine for the ogstun interface, the traffic is being flown correctly, so i'm thinking the traffic is going to the 5g network and then to the ftp machine
What do you see on on the enp0s3 adapter with the IP 192.168.56.3 in this case?
I expect, that the traffic to the FTP goes out there. But it goes directly to the FTP, since it's within the same network segment.Multiple times mentioned: Put the FTP server into another network segment, then you will be able to control access to it.
If the 5g machine masquerades the traffic with 192.168.56.3 the routing should work though. -
How is the pfSense LAN2 interface connected to the '5G tunnel' subnet? It seems like that would only exist for devices with tunnel adapters.
Is this all inside Virtual Box?
But, yes, you are starting from a position of having the client device, the 5G VM and the FTP server all inside the same subnet. So you are having to force the traffic flow to make it go via the tunnel subnet.
If you had separate subnets with pfSense routing between them this would be much easier. -
I'm guessing that the idea with the "tunnel" IP's (10.145.0.1, .2) is to simulate a mobile network? So the UE will need to have the 5G RAN Simulator as it's gateway and pretty much "forget about" the 192. network that the VM was running on.
And I'm thinking that the RAN SIM needs to have pfsense as it's default gateway (for example on 192.168.1.1). And the FTP server on a different network segment so that the requests that come in from the UE on the simulated network, are ROUTED to the 192.168.56.0 network where the FTP is located.
This means that the FTP server is on a different network segment than the SIM VM's. Then you can set up a rule in pfsense that allows or blocks access to the FTP server from the 5G SIM.
-
@Gblenn @stephenw10 @johnpoz @viragomann @SteveITS
I have changed up the network architecture a bit to hopefully make it a bit easier.
I am using internal network as my adapters on virtual box for all machines.My 5G vm still has the same address - 10.45.0.1/16
I have one user equipment machine the virtual interface 'uesimtun0' - IP 10.45.0.2/32
I have another user equipment running on the ftp machine, so that it also has the virtual 'uesimtun0' interface - IP 10.45.0.3/32
Pfsense virtual machine has the IP 192.168.56.1Communication flow
user 1 (uesimtun0) > (ogstun) 5g network (ogstun) > (uesimtun0) user equipment 2 and then ftp accessI have the gateway defined in pfsense webgui as 192.168.56.1
Problem:
When i ping any from one user to another user address, the traffic is being sent correctly through the virtual tunnels mentioned above, this is confirmed with a tcpdump on the 5g machines virtual interface, ogstun. When i ping the pfsense IP from a user machine using the virtual tunnel and do a tcpdump on the 5g networks virtual interface, i only see ICMP requests and no replies, but when i do a tcpdump on the enp0s8 adapter, there are requests and replies.How can i forward the traffic correctly so that it reaches the virtual tunnel rather than the virtual box adapter? or if the issue is not that, what is going wrong ?
When i ping either the user machines or access the ftp server from the pfsense shell itself, the traffic is being routed properly, confirmed with a tcpdump on the 5g network virtual interface
-
@kramnoraa said in Firewall and routing for my LAN:
When i ping the pfsense IP from a user machine using the virtual tunnel
Which IP are you pinging?
and do a tcpdump on the 5g networks virtual interface, i only see ICMP requests and no replies, but when i do a tcpdump on the enp0s8 adapter, there are requests and replies.
Assuming you ping 192.168.56.1, the packet will never go out on ogstun. It will rather turn around and go out on enp0s8.
-
Still unclear to me exactly what the "5G" VM is?
I would expect it to have several interfaces in different subnets and route traffic if it's supposed to be simulating a cell network.
-
I have configured a gateway on pfSense, 192.168.56.116 (this is the IP of the 5g machine).
I have configured a static route with the above gateway, and the destination network is 10.45.0.0/16
I have configured a firewall rule for the LAN that allows traffic from the source 10.45.0.0/16
I have configured the default gateway on the 5g VM (192.168.56.116) to point to pfsense IP (192.168.56.1)With these configs, when i do a ping on the (10.45.0.2) user machine 'ping -I uesimtun0 192.168.56.1', i can capture the 10.45.0.2 machine pinging pfSense and i can also block traffic to this pfsense IP in the firewall rules
But i am unable to capture the traffic from the 10.45.0.0/16 subnet itself (10.45.0.2 > 10.45.0.4), when i ping .2 to .4 or ftp from .2 to .4
I do a tcpdump on the ogstun interface on the 5g vm (as it captures all the 5g network traffic), and i can only see ICMP requests and no repliesNot sure what gateways or interface or static routes to configure
-
@stephenw10 it has one virtual interface 'ogstun' that handles the traffic between user and 5g network and user to user, the nat adapter and the internal network adapter
-
@kramnoraa said in Firewall and routing for my LAN:
With these configs, when i do a ping on the (10.45.0.2) user machine 'ping -I uesimtun0 192.168.56.1', i can capture the 10.45.0.2 machine pinging pfSense
Where can you capture this?
I don't expect, that you see a source IP out of 10.45.0.0/16 on pfSense.But i am unable to capture the traffic from the 10.45.0.0/16 subnet itself (10.45.0.2 > 10.45.0.4), when i ping .2 to .4 or ftp from .2 to .4
10.45.0.4 is new IP in play. To which device does it belong to?
-
@viragomann in the pfsense packet capture, i can see 10.45.0.2 pinging 192.168.56.1
10.45.0.4 is the new 10.45.0.3 as when i restart the user equipment it increments the IP, but its on the ftp machine
-
Hmm. It's a difficult simulation because in a real 5G network none of the clients or end servers could connect directly.
A better setup might be to have each client in it's own virtual network with just the client NIC and a NIC from the 5G VM. That way each client could only ever connect to the 5G network and would be required to connect to it to reach anything else. You may be limited by VBox as to how many networks you can have.
Though it depends exactly what you're trying to simulate here.
-
@stephenw10 I'm basically trying to simulate access controls with the use of the firewall, just want one user (10.45.0.2) to have have a rule configured that allows access to the ftp server and blocks access to the ftp server.
