DMZ host has not Internet connection

meridio

Hello,
I have a pf sense with 3 interfaces (LAN,DMZ and WAN).
From DMZ hosts I can ping the WanGW address (private IP of ADSL router) but I can't go out.
I have modified a lot of rules of Firewall but without solution.

Anyone can suggest me where modify?

Thanks

KOM

My suggestion is to fix the thing that is wrong. I can't be more specific since you have provided no details at all about your NIC details and firewall rules. Maybe this will help:

https://doc.pfsense.org/index.php/Firewall_Rule_Troubleshooting

viragomann

Is the default gateway at the DMZ host set to pfSenses DMZ interface address?

meridio

Thank you KOM and viragomann.

The default GW at DMZ host is the DMZ address interface.

I've solved temporarily using a rule (in DMZ interface) from dmz host to All without restrictions and so work on.

But if I put as a destination WAN address or WAN net doesn't work, this I can't understand why.

I'd like to open only to Active Directory and LDAP services from DMZ to LAN.

How Can I do?

thanks

Derelict

But if I put as a destination WAN address or WAN net doesn't work, this I can't understand why.

Because WAN net is the subnet of your WAN interface, not the internet

Because WAN address is the address of your WAN interface, not the internet.

To forward traffic to the internet, the destination must be any.

For a DMZ you want to create rules that:

Specifically pass the LOCAL assets you want the DMZ to access (DNS, AD DC, Email, etc)
Less-specifically reject the LOCAL traffic you don't want the DMZ to access (such as DMZ to LAN net and DMZ to This firewall (self))
Pass everything else (the internet, aka any)

meridio

Thank you Derelict,

Does exist a way to open such port to certain services on demand?
For example, an internal Domain controller that have to syncronize some datas
with the host in DMZ, daily.

Derelict

You can use schedules on rules, but why not just open the ports? Sounds like you're over-thinking it.

I don't get the "on demand" part. If the firewall just opens the port when it receives a connection, it's an open port.

In general LAN has much greater permission to open connections to DMZ. The point is to restrict the connections DMZ can open into LAN to the minimum necessary.

meridio

Not radically at every request the firewall should open but
at every, setted, specifical request I want.
Obviously it shouldn't be a firewall in the radical case.

Thank you derelict.

Derelict

Huh?

Example: If your DMZ host needs to access an LDAP server in LAN, you pass traffic from DMZ to the LDAP server on tcp/389 and/or tcp/636 + udp on the same if necessary. Nothing more (the following rule blocks all traffic from DMZ to LAN).

meridio

OK