Route traffic to subnet through specific NIC?

Blade1 · Dec 6, 2015, 11:52 PM

Hi,

I have a PFSense firewall in my corp LAN and likewise in my DMZ. The DMZ PFSense has WAN, DMZ and LAN NICs.

The DMZ subnet (192.168.0.x) needs to be able to ping the corporate LAN (10.0.0.x/8).

What's the best way to do this? I've added an additional NIC to the DMZ PFSense VM for the LAN, do I need to set an additional route to tell the traffic to go through? What's the most secure config for this?

Thanks

KOM · Dec 7, 2015, 12:26 AM

As long as your DMZ pfSense LAN is on the same network as corp LAN, it should take just one firewall rule on DMZ to allow ICMP to LAN network. Do you really need any host in DMZ to be able to ping any host in LAN? Only give broad access if you absolutely have to. Otherwise, just tighten the rules by using aliases to define 2 groups of hosts that are allowed to talk and then use those aliases in your one firewall rule.

johnpoz · Dec 7, 2015, 1:02 PM

really that is kind not really a dmz then ;) I could see lan pinging dmz..

So you have 2 pfsense setup? Can you please draw this network, and so turned off nat on your dmz pfsense?

Are you using a transit network to connect these 2 pfsense? What is 2nd pfsense wan connected too?

Blade1 · Dec 7, 2015, 7:58 PM

Hi

This setup is needed because of my ADFS proxies which need to talk to ADFS in the LAN, so there needs to be some two communication.

The network is:

INTERNET >>>> DMZ PFSENSE >>>> DMZ >>>>>> LAN PFSENSE >>>> LAN

The DMZ PFSense has three NICs:

WAN (Public IP)
DMZ (Private IP)
LAN (Private IP on same subnet as the LAN subnet)

LAN PFSense has the following NICs:

WAN (Public IP)
LAN

I don't have a transit network in place no, I thought this should work with the above setup?

By turning off NAT, do you mean outbound NAT?

johnpoz · Dec 7, 2015, 9:05 PM

huh???

How does lan pfsense have a public IP on its wan? Is its wan int he dmz as you show, where dmz you state is a private IP..

Take a crayon and draw this on a napkin and post of picture if you have too.. Or use something like gliffy.. But your "drawing" makes NO sense..

Where is this this 3rd nic in your dmz pfsense shown? You state "LAN (Private IP on same subnet as the LAN subnet)" So they share the same layer 2 network?