Bridge + NAT
-
For now … set and any protocol any source, to any destination and any port on all interfaces till you know bridging it working correctly ...
-
Done, no luck… :-(
Dos there need to be any gateway on pfsense?
-
Only for local services and anything on the LAN.
-
So no GW for WAN or DMZ?
Only GW set on the server, if the PFsense is x.x.x.18 and the ISP GW is x.x.x.17 witch do i set on the server?
-
If i
-
It would be x.x.x.17 as the gateway on the server in a bridge.
-
If i
You can, but don't expect an answer right away … I only have very small amounts of time each day to look at that type of stuff.
-
Ofcource, no problem.
I send you a PM allready asking one thing, did yoou se that?
-
It looks like you are missing rules on OPT1 outbound. Have you created any WAN rules to allow certain ports inbound?
-
OPT1 is the DMZport, (the 3. NIC addet and renamed DMZport)
DMZport is the NIC for DMZ bridge.Do i need same roules on DMZ and DMZport?
-
Scrn. dmp
-
The rules
-
Funny thing… i can ping all public IP´s on the pfsense box (x.x.x.18 WAN IP) (x.x.x.19 Inside IP on the DMZ) but not the ISP GW x.x.x.17
-
Sorry, in the XML you sent there is only the rules for LAN and opt2. This is why I asked. The rules you posted are correct. Did you trace yet with tcpdump at each interface to see where the traffic is getting? Did you change the gateway on the servers to x.x.x.17? You cannot ping because you are not making is across the bridge. Can you ping in the LAN?
-
Don´t be.
I think i send you the wrong one, from an erlier state of the setup… my bad.no i haven´t done that yet, going to do that now.
The test server on the inside (DMZ) was allready using x.x.x.17 as GW
No, getting reply from (server IP x.x.x.22) Destination host unreachable when pining 192.168.1.100 (Pfsense LAN IP)
-
- <pfsense><version>8.0</version>
<lastchange><theme>pfsense_ng</theme> - <sysctl>- - <descr>- ]]></descr>
<tunable>debug.pfftpproxy</tunable>
<value>default</value> -
- <descr>- ]]></descr>
<tunable>vfs.read_max</tunable>
<value>default</value>
- <descr>- ]]></descr>
-
- <descr>- ]]></descr>
<tunable>net.inet.ip.portrange.first</tunable>
<value>default</value>
- <descr>- ]]></descr>
-
- <descr>- ]]></descr>
<tunable>net.inet.tcp.blackhole</tunable>
<value>default</value>
- <descr>- ]]></descr>
-
- <descr>- ]]></descr>
<tunable>net.inet.udp.blackhole</tunable>
<value>default</value>
- <descr>- ]]></descr>
-
- <descr>- ]]></descr>
<tunable>net.inet.ip.random_id</tunable>
<value>default</value>
- <descr>- ]]></descr>
-
- <descr>- ]]></descr>
<tunable>net.inet.tcp.drop_synfin</tunable>
<value>default</value>
- <descr>- ]]></descr>
-
- <descr>- ]]></descr>
<tunable>net.inet.ip.redirect</tunable>
<value>default</value>
- <descr>- ]]></descr>
-
- <descr>- ]]></descr>
<tunable>net.inet6.ip6.redirect</tunable>
<value>default</value>
- <descr>- ]]></descr>
-
- <descr>- ]]></descr>
<tunable>net.inet.tcp.syncookies</tunable>
<value>default</value>
- <descr>- ]]></descr>
-
- <descr>- ]]></descr>
<tunable>net.inet.tcp.recvspace</tunable>
<value>default</value>
- <descr>- ]]></descr>
-
- <descr>- ]]></descr>
<tunable>net.inet.tcp.sendspace</tunable>
<value>default</value>
- <descr>- ]]></descr>
-
- <descr>- ]]></descr>
<tunable>net.inet.ip.fastforwarding</tunable>
<value>default</value>
- <descr>- ]]></descr>
-
- <descr>- ]]></descr>
<tunable>net.inet.tcp.delayed_ack</tunable>
<value>default</value>
- <descr>- ]]></descr>
-
- <descr>- ]]></descr>
<tunable>net.inet.udp.maxdgram</tunable>
<value>default</value>
- <descr>- ]]></descr>
-
- <descr>- ]]></descr>
<tunable>net.link.bridge.pfil_onlyip</tunable>
<value>default</value>
- <descr>- ]]></descr>
-
- <descr>- ]]></descr>
<tunable>net.link.bridge.pfil_member</tunable>
<value>default</value>
- <descr>- ]]></descr>
- <tunable>net.link.bridge.pfil_bridge</tunable>
<value>1</value> - <descr>- ]]></descr>
-
- <descr>- ]]></descr>
<tunable>net.link.tap.user_open</tunable>
<value>default</value>
- <descr>- ]]></descr>
-
- <descr>- ]]></descr>
<tunable>kern.randompid</tunable>
<value>default</value>
- <descr>- ]]></descr>
-
- <descr>- ]]></descr>
<tunable>net.inet.ip.intr_queue_maxlen</tunable>
<value>default</value>
- <descr>- ]]></descr>
-
- <descr>- ]]></descr>
<tunable>hw.syscons.kbd_reboot</tunable>
<value>default</value>
- <descr>- ]]></descr>
-
- <descr>- ]]></descr>
<tunable>net.inet.tcp.inflight.enable</tunable>
<value>default</value>
- <descr>- ]]></descr>
-
- <descr>- ]]></descr>
<tunable>net.inet.tcp.log_debug</tunable>
<value>default</value>
- <descr>- ]]></descr>
-
- <descr>- ]]></descr>
<tunable>net.inet.icmp.icmplim</tunable>
<value>default</value>
- <descr>- ]]></descr>
-
- <descr>- ]]></descr>
<tunable>net.inet.tcp.tso</tunable>
<value>default</value>
- <descr>- ]]></descr>
-
- <descr>- ]]></descr>
<tunable>kern.ipc.maxsockbuf</tunable>
<value>default</value></sysctl>
- <descr>- ]]></descr>
- <system><optimization>normal</optimization>
<hostname>pfSense</hostname>
<domain>localdomain</domain>
<dnsserver>194.239.134.83</dnsserver>
<dnsserver>194.255.56.78</dnsserver>
<dnsallowoverride>on</dnsallowoverride> - <group><name>all</name>
- <description>- ]]></description>
<scope>system</scope>
<gid>1998</gid>
<member>0</member></group> - <group><name>admins</name>
- <description>- ]]></description>
<scope>system</scope>
<gid>1999</gid>
<member>0</member>
<priv>page-all</priv></group> - <user><name>admin</name>
- <descr>- ]]></descr>
<scope>system</scope>
<groupname>admins</groupname>
<password>$1$fYQa/XXXXXXXXXXXXXXXXXXXXXX/0</password>
<uid>0</uid>
<priv>user-shell-access</priv>
<md5-hash>XXXXXXXXXXXXXXXXXXXXXX</md5-hash>
<nt-hash>XXXXXXXXXXXXXXXXXXXX</nt-hash></user>
<nextuid>2000</nextuid>
<nextgid>2000</nextgid>
<timezone>Europe/Copenhagen</timezone>
<time-update-interval>300</time-update-interval>
<timeservers>0.pfsense.pool.ntp.org</timeservers> - <webgui><protocol>http</protocol>
<ssl-certref>503790c6435d6</ssl-certref></webgui>
<disablenatreflection>yes</disablenatreflection>
<disablesegmentationoffloading><disablelargereceiveoffloading></disablelargereceiveoffloading></disablesegmentationoffloading></system> - <interfaces>- <wan><enable><if>em0</if>
<blockpriv><blockbogons>- <descr>- ]]></descr>
<spoofmac><ipaddr>83.XX:XX.18</ipaddr>
<subnet>28</subnet>
<gateway>WANGW</gateway></spoofmac></blockbogons></blockpriv></enable></wan> - <lan><enable><if>em1</if>
<ipaddr>192.168.1.100</ipaddr>
<subnet>24</subnet>
<media><mediaopt>- <descr>- ]]></descr></mediaopt></media></enable></lan> - <opt1>- <descr>- ]]></descr>
<if>em2</if>
<enable><spoofmac></spoofmac></enable></opt1> - <opt2>- <descr>- ]]></descr>
<if>bridge0</if>
<enable><ipaddr>83.XX:XX.19</ipaddr>
<subnet>28</subnet>
<spoofmac></spoofmac></enable></opt2></interfaces>
<staticroutes>- <dhcpd>- <lan>- <range><from>192.168.1.10</from>
<to>192.168.1.245</to></range></lan></dhcpd> - <pptpd><mode><redir><localip></localip></redir></mode></pptpd>
- <dnsmasq><enable></enable></dnsmasq>
- <snmpd><syslocation><syscontact><rocommunity>public</rocommunity></syscontact></syslocation></snmpd>
- <diag>- <ipv6nat><ipaddr></ipaddr></ipv6nat></diag>
<bridge><syslog>- <nat>- <ipsecpassthru><enable></enable></ipsecpassthru> - <advancedoutbound>- <rule>- <source>
<network>192.168.1.0/24</network>
<dstport>500</dstport>
- <descr>- ]]></descr>
<target><interface>wan</interface> - <destination><any></any></destination>
<staticnatport></staticnatport></target></rule> - <rule>- <source>
<network>192.168.1.0/24</network>
<sourceport>- <descr>- ]]></descr>
<target><interface>wan</interface>- <destination><any></any></destination>
<natport></natport></target></sourceport></rule> - <rule>- <source>
<network>127.0.0.0/8</network>
<dstport>- <descr>- ]]></descr>
<target><interface>wan</interface>-
<destination><any></any></destination>
<natport>1024:65535</natport></target></dstport></rule>
<enable></enable></advancedoutbound></nat> -
<filter>- <rule><id><type>pass</type>
<interface>wan</interface>
<tag><tagged><max><max-src-nodes><max-src-conn><max-src-states><statetimeout><statetype>keep state</statetype>
<os>- <source>
<any>- <destination><any></any></destination></any></os></statetimeout></max-src-states></max-src-conn></max-src-nodes></max></tagged></tag></id></rule> -
<rule><type>pass</type>
-
<descr>- ]]></descr>
<interface>lan</interface> -
<source>
<network>lan</network> -
<destination><any></any></destination></rule>
-
<rule><id><type>pass</type>
<interface>opt1</interface>
<tag><tagged><max><max-src-nodes><max-src-conn><max-src-states><statetimeout><statetype>keep state</statetype>
<os>- <source>
<any>- <destination><any></any></destination></any></os></statetimeout></max-src-states></max-src-conn></max-src-nodes></max></tagged></tag></id></rule> -
<rule><id><type>pass</type>
<interface>opt2</interface>
<tag><tagged><max><max-src-nodes><max-src-conn><max-src-states><statetimeout><statetype>keep state</statetype>
<os>- <source>
<any>- <destination><any></any></destination></any></os></statetimeout></max-src-states></max-src-conn></max-src-nodes></max></tagged></tag></id></rule></filter>
<shaper>- <ipsec><preferoldsa></preferoldsa></ipsec>
<aliases><proxyarp>- <cron>- <minute>0</minute>
<hour></hour>
<mday></mday>
<month></month>
<wday></wday>
<who>root</who>
<command></command>/usr/bin/nice -n20 newsyslog -
<minute>1,31</minute>
<hour>0-5</hour>
<mday></mday>
<month></month>
<wday>*</wday>
<who>root</who>
<command></command>/usr/bin/nice -n20 adjkerntz -a -
<minute>1</minute>
<hour>3</hour>
<mday>1</mday>
<month></month>
<wday></wday>
<who>root</who>
<command></command>/usr/bin/nice -n20 /etc/rc.update_bogons.sh -
<minute>/60</minute>
<hour></hour>
<mday></mday>
<month></month>
<wday>*</wday>
<who>root</who>
<command></command>/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 sshlockout -
<minute>1</minute>
<hour>1</hour>
<mday></mday>
<month></month>
<wday>*</wday>
<who>root</who>
<command></command>/usr/bin/nice -n20 /etc/rc.dyndns.update -
<minute>/60</minute>
<hour></hour>
<mday></mday>
<month></month>
<wday>*</wday>
<who>root</who>
<command></command>/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 virusprot -
<minute>30</minute>
<hour>12</hour>
<mday></mday>
<month></month>
<wday>*</wday>
<who>root</who>
<command></command>/usr/bin/nice -n20 /etc/rc.update_urltables</cron>
<wol>- <rrd><enable></enable></rrd> -
<load_balancer>- <monitor_type><name>ICMP</name>
<type>icmp</type> -
<descr>- ]]></descr></monitor_type>
-
<monitor_type><name>TCP</name>
<type>tcp</type> -
<descr>- ]]></descr></monitor_type>
-
<monitor_type><name>HTTP</name>
<type>http</type> -
<descr>- ]]></descr>
-
<options><path>/</path>
<host>200
</host></options></monitor_type> -
<monitor_type><name>HTTPS</name>
<type>https</type> -
<descr>- ]]></descr>
-
<options><path>/</path>
<host>200
</host></options></monitor_type> -
<monitor_type><name>SMTP</name>
<type>send</type> -
<descr>- ]]></descr>
-
<options><send><expect>220 *</expect></send></options></monitor_type></load_balancer>
-
<widgets><sequence>system_information-container:col1:show,captive_portal_status-container:col1:close,carp_status-container:col1:close,cpu_graphs-container:col1:close,gateways-container:col1:close,gmirror_status-container:col1:close,installed_packages-container:col1:close,interface_statistics-container:col1:close,interfaces-container:col2:show,ipsec-container:col2:close,load_balancer_status-container:col2:close,log-container:col2:close,picture-container:col2:close,rss-container:col2:close,services_status-container:col2:close,traffic_graphs-container:col2:close</sequence></widgets>
-
<revision><time>1345843007</time>
-
<description>- ]]></description>
<username>admin@192.168.1.101</username></revision>
<openvpn>- <l7shaper><container></container></l7shaper>
<dnshaper>- <cert><refid>503790c6435d6</refid> -
<descr>- ]]></descr>
<crt>LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVLRENDQTVHZ0F3SUJBZ0lKQU1sZ0hCbnF5ZFRKTUEwR0NTcUdTSWIzRFFFQkJRVUFNSUcvTVFzd0NRWUQKVlFRR0V3SlZVekVTTUJBR0ExVUVDQk1KVTI5dFpYZG9aWEpsTVJFd0R3WURWUVFIRXdoVGIyMWxZMmwwZVRFVQpNQklHQTFVRUNoTUxRMjl0Y0dGdWVVNWhiV1V4THpBdEJnTlZCQXNUSms5eVoyRnVhWHBoZEdsdmJtRnNJRlZ1CmFYUWdUbUZ0WlNBb1pXY3NJSE5sWTNScGIyNHBNU1F3SWdZRFZRUURFeHREYjIxdGIyNGdUbUZ0WlNBb1pXY3MKSUZsUFZWSWdibUZ0WlNreEhEQWFCZ2txaGtpRzl3MEJDUUVXRFVWdFlXbHNJRUZrWkhKbGMzTXdIaGNOTVRJdwpPREkwTVRRek16UXlXaGNOTVRnd01qRTBNVFF6TXpReVdqQ0J2ekVMTUFrR0ExVUVCaE1DVlZNeEVqQVFCZ05WCkJBZ1RDVk52YldWM2FHVnlaVEVSTUE4R0ExVUVCeE1JVTI5dFpXTnBkSGt4RkRBU0JnTlZCQW9UQzBOdmJYQmgKYm5sT1lXMWxNUzh3TFFZRFZRUUxFeVpQY21kaGJtbDZZWFJwYjI1aGJDQlZibWwwSUU1aGJXVWdLR1ZuTENCegpaV04wYVc5dUtURWtNQ0lHQTFVRUF4TWJRMjl0Ylc5dUlFNWhiV1VnS0dWbkxDQlpUMVZTSUc1aGJXVXBNUnd3CkdnWUpLb1pJaHZjTkFRa0JGZzFGYldGcGJDQkJaR1J5WlhOek1JR2ZNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0R04KQURDQmlRS0JnUUMzeGs0alBDOVdpUSswajdHbVBFWkdKVm93Mm1kSERCek9kRFBzZ0x1YnhiS1BvUzFQTjBiMgoydnZxemZrejhoUG9DdzZiQ0dkUC94eDIyOWlrMXJpeStjQnF3aWdzeXBETml6QkpSNU9MODE0MGhybGFjSDd4CkpQZFNja3NJV1dtcVFvS3YwWENvRTdPb0RvdWNxUk90RU5ITWxGUW45SkZLTjVRM1ZzRFpjUUlEQVFBQm80SUIKS0RDQ0FTUXdIUVlEVlIwT0JCWUVGRWxoa1REUDNabGowUFNOWjBVZlFoWE9lVk5kTUlIMEJnTlZIU01FZ2V3dwpnZW1BRkVsaGtURFAzWmxqMFBTTlowVWZRaFhPZVZOZG9ZSEZwSUhDTUlHL01Rc3dDUVlEVlFRR0V3SlZVekVTCk1CQUdBMVVFQ0JNSlUyOXRaWGRvWlhKbE1SRXdEd1lEVlFRSEV3aFRiMjFsWTJsMGVURVVNQklHQTFVRUNoTUwKUTI5dGNHRnVlVTVoYldVeEx6QXRCZ05WQkFzVEprOXlaMkZ1YVhwaGRHbHZibUZzSUZWdWFYUWdUbUZ0WlNBbwpaV2NzSUhObFkzUnBiMjRwTVNRd0lnWURWUVFERXh0RGIyMXRiMjRnVG1GdFpTQW9aV2NzSUZsUFZWSWdibUZ0ClpTa3hIREFhQmdrcWhraUc5dzBCQ1FFV0RVVnRZV2xzSUVGa1pISmxjM09DQ1FESllCd1o2c25VeVRBTUJnTlYKSFJNRUJUQURBUUgvTUEwR0NTcUdTSWIzRFFFQkJRVUFBNEdCQUpUdGorNlVhZmg0MHdyRE90Z3JDamw5Mk5kUQpyNVNiWDVVWmRtWFhRcXRwV3lkUTBpVWIrWDhrdHdCeW03dW93S0p0bjUyOWhxc0tNclZLVVVsWlA0Tm01T2JTCk9iYlA4TTMxV3VmMHd5UTF1REdWbXpiNHlRdEVNQjg3VWVUVEx1cU0vR2dwR2tSc0U3SGE0LzdjTGxKdVJXYVcKd1hUOEl0Ky91YXhSMEZtNgotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==</crt>
<prv>R2VuZXJhdGluZyBSU0EgcHJpdmF0ZSBrZXksIDEwMjQgYml0IGxvbmcgbW9kdWx1cwouLi4uLi4uLi4uLi4uKysrKysrCi4uKysrKysrCnVuYWJsZSB0byB3cml0ZSAncmFuZG9tIHN0YXRlJwplIGlzIDY1NTM3ICgweDEwMDAxKQotLS0tLUJFR0lOIFJTQSBQUklWQVRFIEtFWS0tLS0tCk1JSUNYQUlCQUFLQmdRQzN4azRqUEM5V2lRKzBqN0dtUEVaR0pWb3cybWRIREJ6T2REUHNnTHVieGJLUG9TMVAKTjBiMjJ2dnF6Zmt6OGhQb0N3NmJDR2RQL3h4MjI5aWsxcml5K2NCcXdpZ3N5cEROaXpCSlI1T0w4MTQwaHJsYQpjSDd4SlBkU2Nrc0lXV21xUW9LdjBYQ29FN09vRG91Y3FST3RFTkhNbEZRbjlKRktONVEzVnNEWmNRSURBUUFCCkFvR0FEdnJORjdZcUxhV1NjQ2RlVmF5SUZlT3BqRjNoR1R0MWhhYVhMT241WU9NbWdPcWtaTmFlcERTSllFUlYKMGRRanAwQnZlbGVmQkRoSk82OEQ0N3ZVNWk1Q21GMGd6bHdYOUVyMStSSUV4ejA5OUxUNERYdXVOV1h5R2hFLwo2dzJzclN2RmhTNjBiYUw2ZlN6ZXg2RXp6WVNHVzI0eldQbmJRelovOW52TW1pRUNRUUR4RTN2Ymk1Q2dWdTFLCjVxQWdOcW9sZ2tjK25aUmxHdi9WeW01UE5WOXAvM2NPQWNJUTB1WnVnZDdsQ3lkaG5SajAvbnlqWTdGN1Yrc3IKTzFabEpSWTlBa0VBd3lhNHFvNmtMRGxJUzB3T0xJdXdpZ280MjhTaEtFRVpkZXVlMzJ0VWhCVU13QVVOWHNjbApFSEFzUzdob1BzVEF3YVJaeVZGL0l6MkpoTVJlYWxIM1JRSkFKYk5mVmtrd04vTUFMd3Q4RlMyWFZFQllkZkZjCnlLYjlSV2pmOFdFdVo3dzgyU0xyUDRoTDR4SktVbFY1TmluRVFtUWVCOHRLY1RpaG5XUXRNYW9vSFFKQU1wd0UKSUJkRjlFSVd3WkJEek1HZFV1ODd0NkxTdUlISmZJOVNjRmFCWUkrazh0ZGNsRXZKRE81S1RvalFZQmJlZGxtTQovMnluTUJoeFpZRVhpek1la1FKQkFJOXFjcUJYTk11clpnQ0FMWEJkU001V2N3UWVhR1FXWC9Za3c1N0lmTXhoCkF2L2U2dEZtekUxSGR1QjlEZjJzQlBoNFkwRUp6TWlBU2l4LzBPRm01azg9Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==</prv></cert>
<ppps>- <gateways>- <gateway_item><interface>wan</interface>
<gateway>83.XX:XX.17</gateway>
<name>WANGW</name>
<weight>1</weight> -
<descr>- ]]></descr>
<defaultgw></defaultgw></gateway_item></gateways> -
<bridges>- <bridged><members>wan,opt1</members>
-
<descr>- ]]></descr>
<maxaddr><timeout><maxage><fwdelay><hellotime><priority><proto>rstp</proto>
<holdcount><ifpriority><ifpathcost><bridgeif>bridge0</bridgeif></ifpathcost></ifpriority></holdcount></priority></hellotime></fwdelay></maxage></timeout></maxaddr></bridged></bridges> -
<wizardtemp>- <system><hostname>pfSense</hostname>
<domain>localdomain</domain></system>
<wangateway>83.xx.xx.17</wangateway></wizardtemp></ppps></dnshaper></openvpn></wol></proxyarp></aliases></shaper></syslog></bridge></staticroutes></lastchange></pfsense>
- <pfsense><version>8.0</version>
-
I see now that i have forgot to write that the Pfsense is on a Vsphere 5 (ESX)
-
Funny thing….
If i move a server from DMZ to the WAN swict it all works inet in and out and if i move same server back to WAN it works for 2-5 min then it stops.. -
I see now that i have forgot to write that the Pfsense is on a Vsphere 5 (ESX)
Yeah, I don't know how a bridge in ESX will behave. It could work perfectly and there is a minor thing we are overlooking, or it is just not stable. I don't have much experience with bridges in ESX. Have you tried permiscious mode on the WAN and OPT vswitches. that is not ideal, but just to test should not hurt.
-
I see now that i have forgot to write that the Pfsense is on a Vsphere 5 (ESX)
Yeah, I don't know how a bridge in ESX will behave. It could work perfectly and there is a minor thing we are overlooking, or it is just not stable. I don't have much experience with bridges in ESX. Have you tried permiscious mode on the WAN and OPT vswitches. that is not ideal, but just to test should not hurt.
I have NO trobble to get the servers to work when i put them on the WAN NIC, but as soon they are put back on DMZ the stop having access to the internet. (sucks)
a 1000 thanks for your effort trying to help, its very appreciated :-)