Firewall and routing for my LAN
-
@kramnoraa From a quick glance at your drawing, yeah I would be with @stephenw10 this screams asymmetrical to me.. So that device you have listed with 10.45.0.2/32 is multihomed - that is a asymmetrical waiting to happen for sure.
Why exactly do you have interfaces in a bridge in pfsense? And they are using 2 different L3 networks?
-
@kramnoraa said in Firewall and routing for my LAN:
The 5g network VM has an IP of 192.168.56.116/24, when the network is ran it creates a tunnel 'ogstun' that has an IP of 10.45.0.1/16. VBOX adapters (Bridged adapter and host only).
The user equipment machine has an IP of 192.168.56.115, when the user equipment is built, it creates a tunnel 'uesimtun0' that has an IP of 10.45.0.2/32. VBOX adapters (host only)
I created two interfaces on pfsense web gui, LAN (192.168.56.3/24) and LAN2 (10.45.0.3/16).This part is not clear to me. I appealed above already.
How should pfSense get a leg into the tunnel between the 5g and the user equipment, even it has an IP?When i connect to the ftp server using the uesimtun0 on the user machine and do a tcpdump on the 5g machine for the ogstun interface, the traffic is being flown correctly, so i'm thinking the traffic is going to the 5g network and then to the ftp machine
What do you see on on the enp0s3 adapter with the IP 192.168.56.3 in this case?
I expect, that the traffic to the FTP goes out there. But it goes directly to the FTP, since it's within the same network segment.Multiple times mentioned: Put the FTP server into another network segment, then you will be able to control access to it.
If the 5g machine masquerades the traffic with 192.168.56.3 the routing should work though. -
How is the pfSense LAN2 interface connected to the '5G tunnel' subnet? It seems like that would only exist for devices with tunnel adapters.
Is this all inside Virtual Box?
But, yes, you are starting from a position of having the client device, the 5G VM and the FTP server all inside the same subnet. So you are having to force the traffic flow to make it go via the tunnel subnet.
If you had separate subnets with pfSense routing between them this would be much easier. -
I'm guessing that the idea with the "tunnel" IP's (10.145.0.1, .2) is to simulate a mobile network? So the UE will need to have the 5G RAN Simulator as it's gateway and pretty much "forget about" the 192. network that the VM was running on.
And I'm thinking that the RAN SIM needs to have pfsense as it's default gateway (for example on 192.168.1.1). And the FTP server on a different network segment so that the requests that come in from the UE on the simulated network, are ROUTED to the 192.168.56.0 network where the FTP is located.
This means that the FTP server is on a different network segment than the SIM VM's. Then you can set up a rule in pfsense that allows or blocks access to the FTP server from the 5G SIM.
-
@Gblenn @stephenw10 @johnpoz @viragomann @SteveITS
I have changed up the network architecture a bit to hopefully make it a bit easier.
I am using internal network as my adapters on virtual box for all machines.My 5G vm still has the same address - 10.45.0.1/16
I have one user equipment machine the virtual interface 'uesimtun0' - IP 10.45.0.2/32
I have another user equipment running on the ftp machine, so that it also has the virtual 'uesimtun0' interface - IP 10.45.0.3/32
Pfsense virtual machine has the IP 192.168.56.1Communication flow
user 1 (uesimtun0) > (ogstun) 5g network (ogstun) > (uesimtun0) user equipment 2 and then ftp accessI have the gateway defined in pfsense webgui as 192.168.56.1
Problem:
When i ping any from one user to another user address, the traffic is being sent correctly through the virtual tunnels mentioned above, this is confirmed with a tcpdump on the 5g machines virtual interface, ogstun. When i ping the pfsense IP from a user machine using the virtual tunnel and do a tcpdump on the 5g networks virtual interface, i only see ICMP requests and no replies, but when i do a tcpdump on the enp0s8 adapter, there are requests and replies.How can i forward the traffic correctly so that it reaches the virtual tunnel rather than the virtual box adapter? or if the issue is not that, what is going wrong ?
When i ping either the user machines or access the ftp server from the pfsense shell itself, the traffic is being routed properly, confirmed with a tcpdump on the 5g network virtual interface
-
@kramnoraa said in Firewall and routing for my LAN:
When i ping the pfsense IP from a user machine using the virtual tunnel
Which IP are you pinging?
and do a tcpdump on the 5g networks virtual interface, i only see ICMP requests and no replies, but when i do a tcpdump on the enp0s8 adapter, there are requests and replies.
Assuming you ping 192.168.56.1, the packet will never go out on ogstun. It will rather turn around and go out on enp0s8.
-
Still unclear to me exactly what the "5G" VM is?
I would expect it to have several interfaces in different subnets and route traffic if it's supposed to be simulating a cell network.
-
I have configured a gateway on pfSense, 192.168.56.116 (this is the IP of the 5g machine).
I have configured a static route with the above gateway, and the destination network is 10.45.0.0/16
I have configured a firewall rule for the LAN that allows traffic from the source 10.45.0.0/16
I have configured the default gateway on the 5g VM (192.168.56.116) to point to pfsense IP (192.168.56.1)With these configs, when i do a ping on the (10.45.0.2) user machine 'ping -I uesimtun0 192.168.56.1', i can capture the 10.45.0.2 machine pinging pfSense and i can also block traffic to this pfsense IP in the firewall rules
But i am unable to capture the traffic from the 10.45.0.0/16 subnet itself (10.45.0.2 > 10.45.0.4), when i ping .2 to .4 or ftp from .2 to .4
I do a tcpdump on the ogstun interface on the 5g vm (as it captures all the 5g network traffic), and i can only see ICMP requests and no repliesNot sure what gateways or interface or static routes to configure
-
@stephenw10 it has one virtual interface 'ogstun' that handles the traffic between user and 5g network and user to user, the nat adapter and the internal network adapter
-
@kramnoraa said in Firewall and routing for my LAN:
With these configs, when i do a ping on the (10.45.0.2) user machine 'ping -I uesimtun0 192.168.56.1', i can capture the 10.45.0.2 machine pinging pfSense
Where can you capture this?
I don't expect, that you see a source IP out of 10.45.0.0/16 on pfSense.But i am unable to capture the traffic from the 10.45.0.0/16 subnet itself (10.45.0.2 > 10.45.0.4), when i ping .2 to .4 or ftp from .2 to .4
10.45.0.4 is new IP in play. To which device does it belong to?
-
@viragomann in the pfsense packet capture, i can see 10.45.0.2 pinging 192.168.56.1
10.45.0.4 is the new 10.45.0.3 as when i restart the user equipment it increments the IP, but its on the ftp machine
-
Hmm. It's a difficult simulation because in a real 5G network none of the clients or end servers could connect directly.
A better setup might be to have each client in it's own virtual network with just the client NIC and a NIC from the 5G VM. That way each client could only ever connect to the 5G network and would be required to connect to it to reach anything else. You may be limited by VBox as to how many networks you can have.
Though it depends exactly what you're trying to simulate here.
-
@stephenw10 I'm basically trying to simulate access controls with the use of the firewall, just want one user (10.45.0.2) to have have a rule configured that allows access to the ftp server and blocks access to the ftp server.
-
@kramnoraa said in Firewall and routing for my LAN:
in the pfsense packet capture, i can see 10.45.0.2 pinging 192.168.56.1
And this is coming from the 5g machine? So you should also see the packets on its enp0s3, I think?
But i am unable to capture the traffic from the 10.45.0.0/16 subnet itself (10.45.0.2 > 10.45.0.4), when i ping .2 to .4 or ftp from .2 to .4
Do you mean on pfSense here as well?
I do a tcpdump on the ogstun interface on the 5g vm (as it captures all the 5g network traffic), and i can only see ICMP requests and no replies
Did you already remove the 10.45.0.0/16 IP from pfSense?
-
So in the real setup the firewall would be at the client or in the 5G network?
