PfSense on ESXI - only one way traffic???
-
Hi
i love your diagrams!!!
what want to achieve is to simulate the combining of two "separate" networks together.
one network is the 192.168 network and the other is the 10.0 network.
the current topology allows me create these networks with my two routers,
but the 192.168 will have to be "the top level" network since only this network is connected to the internet.
(by the way, wifi is off on both routers, i dont use wifi at all)this requirement "forces" me to enable all vm's in the 10.0 network to some how use 192.168 address as their default gateway.
when i install pfsense i have to chose which network is my wan and which lan. so naturally i am choosing 192.168 as wan and 10.0 as lan.my desired result:
two lan networks (192.168 + 10.0) that are allowing communication between networks.my current result:
two networks that only have a one way communication (10.0 vm's can connect to 192.168 but not the other way around)did i explain my use case better?
again, thank you so much for your time! -
John, what are you using to make your diagrams?
-
i'm guessing microsoft visio
i use it too
-
Sounds like then my 2nd lab1 drawing is what your after. You can have vms on your 10 network, and any other networks you want that are purely VMs.. If you want other networks in the physical world without more interfaces for esxi host you would need switch that does vlans.
You have Vms and physical hardware on your 10 network via vswitch connected to that phy nic. You can bring up as many other networks as you would want to put vms on and just create a new vswitch for that network and new nic for pfsense tied to that vswitch.
As to gateway with your 10 devices, this would be pfsense interface in the 10 network. Since all your networks both your 10 and anything else you would bring up on esxi host are all lan interfaces to pfsense then all you have to do is allow the traffic you want, there will be no natting between them.. Only nat will be when you go what amounts to a transit network (192.168) to get to the internet out the pfsense wan.
This is pretty close to my own setup, but I have more phy interfaces in my esxi host (4) so I have 2 physical lan with 1 having some vlans on it, and then 1 interface in the host just for vmkern (sharing this with a normal vswitch takes a performance hit on the vmkern moving files to and from the datastore) so since I had a port I broke it out on its own. And then 1 that is just wan and tied directly to my cable modem, so pfsense gets public on its wan interface.
Here is my esxi networking. See attached.
So you notice my pfsense (pf22 has interface in every vswitch. The wlan vswitch you will also see is set to 4095 which trunk so that is the pfsense interface that I have pfsense vlans on that correspond to the physical network through to my phy switch, etc..
Your setup since you only have 2 nics one is tied to your internet router that is doing nat, would be nice to just have pfsense do the nat vs double nat but can work with. Then your other phy nic would have your normal physical network and your vmkern, and then you can create as many other vswitches as you would want for other vms - see my dmz vswitch as example.
Yeah use visio for the drawings..
-
Hi
i will try to do it the way you suggested.
thank you so much for your effort! -
Yeah use visio for the drawings..
Hmm, was hoping it was FOSS and not Microsoft.
-
I wish it was foss as well, but have yet to find one that is good as visio. I have tried quite a few of them dia, yEd, pencil project, gliffy is free online one I point to use that post us something like crayons on a napkin ;)
When you use it pretty much everyday at work, its what you get use to.. And if I sent someone a drawing in a different format are they going to be able to read it? etc..
But always on the lookout for a good foss tool that can replace it.. So if you find one please post about it! ;)
-
Continuing to hijack the thread…
yED looks nice. What didn't you like about it? LibreOffice Draw with network shapes from VRT Systems looks promising as well.
I've used Visio in the past but found some of how it operated to be frustrating, especially when it came to aligning lines and connectors. Maybe it's improved since, but I don't want to spend the money to find out.
-
yEd is very nice - should prob spend some more time with it to be honest, but bad habits die hard so I find myself always going back to visio.
As to auto align and connectors there are some free stuff you can add to visio to help with that. The big one for me when doing actual work diagrams is labels on the connectors for the interfaces on each end.. Here is a great free addon
http://www.squaremilesystems.com/products/sms-visio-utils/
My fav part is the network connector
http://www.squaremilesystems.com/products/sms-visio-utils/network-connector/
If you just want the vss of the connector stencil, just send me a pm ;) That way you don't have to fill out their form, etc..
-
Thanks but I'll keep playing with the other two for now. LibreOffice Draw is already on my home box and it seems to do the job. Getting decent network image templates was the stickler, and the VRT stuff seems good enough to me.
-
@KOM:
Thanks but I'll keep playing with the other two for now. LibreOffice Draw is already on my home box and it seems to do the job. Getting decent network image templates was the stickler, and the VRT stuff seems good enough to me.
LibreOffice Draw + VRT is what I use for the diagrams in the pfSense book (now, as I'm updating it), and other places like the Hangouts. Not sure if I've moved any over on the Wiki yet. They are nice shapes with a permissive license so there are no concerns with using them in published diagrams, too.
LibreOffice Draw has lots of room for improvement but it's not too bad these days.
