Router only, no internet on OPT1

luna_s

Then I think I'll be better off turning the firewall off, but then I'm back to square one not being able to access the Active Directory from the wan unless there's a WAN rule that can fix that ?

doktornotor

You can have no WAN (or any other interface) rules when you turn the packet filter off. If you do not want NAT, then disable NAT and not the packet filter. It is even written in the GUI notes next to the checkbox where you can disable the pf.

johnpoz

^ exactly the way to use pfsense as router is disable nat and create any any rules.

luna_s

Thanks, I'll test it out - feel like I've been going round in circles these past few days!

KOM

You can have no WAN (or any other interface) rules when you turn the packet filter off.

^ exactly the way to use pfsense as router is disable nat and create any any rules.

Well, which is it? No rules or Any:Any rules? Or did you mean there must be no rules when the filter is disabled but then after you need to add Any:Any rules???

johnpoz

Those are 2 different people saying things that you put into 1 quote.

How I would use pfsense as router would be turn off nat and then any any. You could then log traffic if you wanted in your any any rules, etc. Or create rules just for logging even better. You could still use the limiters, etc.

If you just going to turn off filtering and route - might as well just put in a L3 switch.

KOM

Those are 2 different people saying things that you put into 1 quote.

Yes, I know, was done for brevity. But you agreed with dok after saying something completely opposite. He says no rules, you say any:any.

luna_s

Wish I could just put a L3 switch in would save me the problems, as it is it's cheaper for me to use a pfsense as a router instead

johnpoz

No he clearly stated

"If you do not want NAT, then disable NAT and not the packet filter."

Which I agreed with.. If you don't turn off the packet filter than you need rules.. I just said it in slightly different way with emphasis that you would need any any rules if the filter is on if you want it to act like a router.

KOM

You can have no WAN (or any other interface) rules when you turn the packet filter off.

This threw me off. I know there are a lot of non-native English speakers here and sometimes the Euro flair can be read differently. I read it to mean that you MUST remove the WAN rules if you are to disable the packet filter.

luna_s

So from what I've learned

Enable Firewall

Disable Outbound NAT

Add Any Any Rules to each interface on the firewall e.g.

IPv4* * * * * * none

This should do all my routing to and from the smoothwall box

Derelict

This should do all my routing to and from the smoothwall box

Whatever a "smoothwall box" is it will have to have routes for all the networks behind pfSense with the pfSense IP address as the routes' next hop.

luna_s

The Smoothwall box is a transparent proxy / UTM, I work in a school and we need filtering enabled for students. Currently we rely on the Smoothwall box for routing between subnets (for wifi over vlans) for MDns, problem is we rely too much on it e.g

LAN –-> SMOOTHWALL ---> WAN

We don't have any layer 3 switching as the budget is restrictive, only layer 2 that serves the VLANS so swapping out the SMOOTHWALL utm for another vendor is difficult as most other vendors don't have routing / radius / dhcp etc. built in

So I'm trying to utilise old hardware so the topology looks like this :-

PFSense Router -----> PROXY -----> PFSense firewall, so I can slot any vendors filtering hardware in place of the proxy

The only problem I've faced is getting Smoothwall talking back to active directory for authentication purposes, if I know the PFSense configuration is correct then I know any problems lies within Smoothwall.

luna_s

I made a new box and kept it as simple as possible

Enable Firewall

Disable Outbound NAT

Add Any Any Rules to each interface on the firewall e.g.

IPv4* * * * * * none

But it's still not working, the traceroute from the wan to the LAN seems to bounce around the WAN ip and the gateway

Here's an album of images
http://imgur.com/a/1X55p

johnpoz

dude smoothwall needs to know how to get to the networks behind pfsense - it has to have a route that talks to pfsense want to get to segments behind pfsense.

This is normally done with a transit network so you don't run into asymmetrical routing.

luna_s

Cheers, So is this a Smoothwall thing or a pfsense thing I need to look at ?

johnpoz

pfsense knows by default how to route to any network connected to it that it has an interface in. Your smoothwall doesn't know about the networks behind pfsense unless you tell it, or you are running some routing protocol between smoothwall and pfsense so they can share their routes.

And if boxes behind pfsense are going to talk to devices on the wan side directly and not just the gateway for stuff outside smoothwall you can run into a asymmetrical route issue where pfsense oh I am directly connected to that network wills end the traffic direct to that IP.. That devices says hmm where is that IP, its not on my network - I need to send it to my gateway your smoothwall. So that is asymmetrical and you have issues with stateful firewalls in that scenario.

luna_s

So what's the fix ? I can add another NIC in the smoothwall box and bridge the interfaces but it kind've defeats what I'm trying to achieve - I'm trying to move away from bridging on smoothwall

johnpoz

The fix is to have the correct routing.. Why would you need another nic you could just vlan. And who said anything about bridging?

If you want to use another nic for your transit network - sure, or could just be a vlan. Will ips behind pfsense be accessing ips on the wan of pfsense, or will clients just be going to the smoothwall? But smoothwall needs to know how to get back to networks behind pfsense.

example - see attached.

So you have devices on 192.168.1.0/24 that want to go to the internet, lets say domainx.com at 1.2.3.4, he sends that traffic to pfsense, pfsense I don't any networks that holds that IP.. So send to my gateway (smoothwall at 192.168.0.1) Traffic comes back to smoothwall.. Smooth says I need to send this to 192.168.1.x – he needs to know that he needs to send that to 192.168.0.2

So on your smoothwall you need routes
192.168.1.0/24 192.168.0.2
192.168.2.0/24 192.168.0.2

This works fine as long as you don't have box on 192.168.1.x talking to 192.168.0.x This is where you run into possible asymmetrical route problem.

lets say 192.168.1.14 wants to talk to 192.168.0.28, he again sends it to pfsense on his segment. Pfsense says oh I have that 192.168.0.0/24 network directly attached so will just put that traffic on the wire to 192.168.0.28.. 192.168.0.28 says oh 192.168.1.14 wants to talk to me - that is not on my network so send it to smoothwall. Smooth once you put in the routes says oh send that to 192.168.0.2, if pfsense is firewalling this would be out of state traffic depending.. Either way it is an asymmetrical and normally something you want to avoid.

How you fix asymmetrical is with a transit network - see 2nd attachment, on the right side.

One thing for sure is you need smoothwall having routes to those networks behind pfsense - unless pfsense was natting this traffic. If pfsense was natting then you would only see traffic from pfsense interface in that 192.168.0.0/24 network.

You will also need to make sure any rules be it firewall or proxy on your smoothwall allow for traffic from these 2 new networks 192.168.1.0/24 and 192.168.2.0/24

networksbehindpfsense.jpg_thumb

2nddrawing.png_thumb

luna_s

Thank you :) Things are clearer now - what I've done in the end and got it working was to add another nic to smoothwall gave it an IP on the lan range and pointed dynamic DNS to the DC - I now have authentication working

Thanks again for your patience - can be quite frustrating to fix these things at times