NAT Issues
-
I've got a Pfsense firewall sitting between my WAN subnet on interface (x.x.x.200) and my DMZ subnet on interface (y.y.y.1). That DMZ is then connected via another pfsense router (ip address y.y.y.2) back to my corporate environment. I've set up a 1:1 NAT and configured the virtual IP and have set a rule in the firewall that allows all ICMP traffic to my webserver (y.y.y.203) which it does nicely. I can ping my heart away. However when I setup another rule(s) trying to allow http & https traffic to this machine I get the following in the system logs which I've attached. At first I thought it was a problem with asymmetric routing that was sending the return traffic back through my corporate environment but I can verify with a traceroute that the server is routing traffic out the correct interface.
I'm also getting CLOSED:SYN_SENT in the states table for the rule I created.
 -
Well apparently it was asymmetric routing. I had the machine pointing to y.y.y.2 as the default gateway so traffic was coming in hitting the machine from y.y.y.1 and then leaving by going to y.y.y.2 and then back to y.y.y.1. After I changed it the Internet traffic (http,https) successfully routed. The only problem is now I have the exact problem with traffic originating from my corporate side. I'm getting TCP S errors and nothing TCP is connecting. I was able to fool it with a static route y.y.y.128/25 pointing to y.y.y.1 but that eliminates half my subnet and just seems from a network design standpoint…....wrong.
So I guess I'm asking in the following situation how should I setup routing? What gateways on the two PFsense firewalls should be default?
+
|
|
|
|x.x.x.200
+----------+
| |
| |
| |PFSense Edge Firewall
| |
| |
+----------+
|y.y.y.1
|
|
|
|
|
|
|
|y.y.y.203
+---------------+
| |
| |
| Web Server
| |
| |
| |
+-------+-------+
|
|
|
|
|
|
|
|
+-----------------------+ |y.y.y.2
| | +------------------+
| | | |
| | | |
| | | |
| | | PFSense Trust Firewall
| Corporate Network+----------------+w.w.w.7 |
| | | |
| | | |
| | | |
| | +------------------+
+-----------------------+ -
What gateways on the two PFsense firewalls should be default?
Zzzzz.wwwwww.uuuuu.1 gggg-wwww-pppp.2 bbb.aaa.kkk.lll
-
What gateways on the two PFsense firewalls should be default?
Zzzzz.wwwwww.uuuuu.1 gggg-wwww-pppp.2 bbb.aaa.kkk.lll
Sorry, I haven't had my 2nd cup of coffee this morning. Can you elaborate a little more please?
-
https://tools.ietf.org/html/rfc5737
IOW, you are censoring information in a way that makes the information to get lost and any advise impossible.
-
https://tools.ietf.org/html/rfc5737
IOW, you are censoring information in a way that makes the information to get lost and any advise impossible.
Ahhh, gotcha. OK, the DMZ is on a 192.168.200.x/24 subnet. I'm restricted by corporate policy in giving out the other subnet information. Let me know if this helps.
+
|
|
|
|x.x.x.200
+–--------+
| |
| |
| |PFSense Edge Firewall
| |
| |
+----------+
|192.168.200.1
|
|
|
|
|
|
|
|192.168.200.203
+---------------+
| |
| |
| Web Server
| |
| |
| |
+-------+-------+
|
|
|
|
|
|
|
|
+-----------------------+ | 192.168.200.2
| | +------------------+
| | | |
| | | |
| | | |
| | | PFSense Trust Firewall
|Corporate Network +----------------+ |
| | | |
| | | |
| | | |
| | +------------------+
+-----------------------+ -
BTW, moderators….I understand that this is probably no longer a NAT issue. Please feel free to move to an appropriate routing board.
-
What happened to the w.w.w.7 thing?
-
That is the LAN interface IP address that I neglected to put back in the schematic. It's on my corporate network, on a totally different network than my DMZ network and the last octet is .7
-J -
bump
-
So your web server is what amounts to your transit network?
If you need a downstream router from your edge, then that needs to have a transit.
-
Correct, the entire 192.168.200 subnet is a transit network. I don't understand your point about the downstream router. There is indeed a upstream and downstream network on either side of the Edge Firewall and on my Corporate Network. My question is specifically about the web server in the 192 subnet. If I make the default gateway on that box point toward the PFsense at 192.168.200.2 I can poll the server internally but not externally through the 1:1 NAT I've setup on the Edge PFsense. If I point the webserver toward the PFSense at 192.168.200.1 I can access the server through the 1:1 NAT on the Edge PFsense but can't access anything on that box from the Trust Firewall. Everytime the logs are littered with TCP:S which leads me to believe….I don't know what to believe at this point.
-
hosts do not sit on a transit!!! If they do they need to have host routing that tells them where to go to get to what.. But in general there should really never be a host on a transit network..
Hang your webserver off a different segment than your transit network off your edge router/firewall.
-
Maybe I misunderstood what you were saying about a transit network. Are you saying I can't setup a design like this on my network?
-
bump
