Firewall and routing for my LAN
-
@kramnoraa said in Firewall and routing for my LAN:
When i ping the pfsense IP from a user machine using the virtual tunnel
Which IP are you pinging?
and do a tcpdump on the 5g networks virtual interface, i only see ICMP requests and no replies, but when i do a tcpdump on the enp0s8 adapter, there are requests and replies.
Assuming you ping 192.168.56.1, the packet will never go out on ogstun. It will rather turn around and go out on enp0s8.
-
Still unclear to me exactly what the "5G" VM is?
I would expect it to have several interfaces in different subnets and route traffic if it's supposed to be simulating a cell network.
-
I have configured a gateway on pfSense, 192.168.56.116 (this is the IP of the 5g machine).
I have configured a static route with the above gateway, and the destination network is 10.45.0.0/16
I have configured a firewall rule for the LAN that allows traffic from the source 10.45.0.0/16
I have configured the default gateway on the 5g VM (192.168.56.116) to point to pfsense IP (192.168.56.1)With these configs, when i do a ping on the (10.45.0.2) user machine 'ping -I uesimtun0 192.168.56.1', i can capture the 10.45.0.2 machine pinging pfSense and i can also block traffic to this pfsense IP in the firewall rules
But i am unable to capture the traffic from the 10.45.0.0/16 subnet itself (10.45.0.2 > 10.45.0.4), when i ping .2 to .4 or ftp from .2 to .4
I do a tcpdump on the ogstun interface on the 5g vm (as it captures all the 5g network traffic), and i can only see ICMP requests and no repliesNot sure what gateways or interface or static routes to configure
-
@stephenw10 it has one virtual interface 'ogstun' that handles the traffic between user and 5g network and user to user, the nat adapter and the internal network adapter
-
@kramnoraa said in Firewall and routing for my LAN:
With these configs, when i do a ping on the (10.45.0.2) user machine 'ping -I uesimtun0 192.168.56.1', i can capture the 10.45.0.2 machine pinging pfSense
Where can you capture this?
I don't expect, that you see a source IP out of 10.45.0.0/16 on pfSense.But i am unable to capture the traffic from the 10.45.0.0/16 subnet itself (10.45.0.2 > 10.45.0.4), when i ping .2 to .4 or ftp from .2 to .4
10.45.0.4 is new IP in play. To which device does it belong to?
-
@viragomann in the pfsense packet capture, i can see 10.45.0.2 pinging 192.168.56.1
10.45.0.4 is the new 10.45.0.3 as when i restart the user equipment it increments the IP, but its on the ftp machine
-
Hmm. It's a difficult simulation because in a real 5G network none of the clients or end servers could connect directly.
A better setup might be to have each client in it's own virtual network with just the client NIC and a NIC from the 5G VM. That way each client could only ever connect to the 5G network and would be required to connect to it to reach anything else. You may be limited by VBox as to how many networks you can have.
Though it depends exactly what you're trying to simulate here.
-
@stephenw10 I'm basically trying to simulate access controls with the use of the firewall, just want one user (10.45.0.2) to have have a rule configured that allows access to the ftp server and blocks access to the ftp server.
-
@kramnoraa said in Firewall and routing for my LAN:
in the pfsense packet capture, i can see 10.45.0.2 pinging 192.168.56.1
And this is coming from the 5g machine? So you should also see the packets on its enp0s3, I think?
But i am unable to capture the traffic from the 10.45.0.0/16 subnet itself (10.45.0.2 > 10.45.0.4), when i ping .2 to .4 or ftp from .2 to .4
Do you mean on pfSense here as well?
I do a tcpdump on the ogstun interface on the 5g vm (as it captures all the 5g network traffic), and i can only see ICMP requests and no replies
Did you already remove the 10.45.0.0/16 IP from pfSense?
-
So in the real setup the firewall would be at the client or in the 5G network?
