Setting up firewall for public networks
-
John, thanks for your detailed response. I honestly have no experience in the inner workings of a datacenter network outside of our cabinet so please mind my ignorance on the matter. We have a single CAT6 cable coming into our cabinet and from there we plug into our switch and can setup our hosts / VM's with any of the IP's in the subnet, using the gateway IP for that selected subnet to connect to the internet.
For sake of presentation we have the following networks:
1. 10.0.0.0/24 (for our private network
2. 196.21.151.0/26 with gateway IP 196.21.151.1, 196.21.152.0/26 with gateway IP 196.21.152.1, 196.21.162.0/26 with gateway IP 196.21.162.1 (3 public subnets routed to our cabinet)Once the firewall is setup, our network has the above mentioned cat6 cable first coming into our pfsense router (WAN) and lan interface then goes to our managed switch which then distributes the remainder of the hosts. I have setup the pfsense host WAN as a static IP with one of the IP's used from one of the blocks (say 196.21.151.3 for sake of argument using that IP gateway 196.21.151.1) which is giving the pfsense server access to the internet.
I was simply just not sure if I had to configure anything inside of pfsense to let it know that there are those networks. I don't want to undergo the excercise of creating the rules upfront for all of the hosts / VM's to later find out I had to first add a network for the firewall to be able to properly control that incoming traffic but furthermore route it to the LAN interface so that it ultimately can reach the managed switch.
-
2. 196.21.151.0/26 with gateway IP 196.21.151.1, 196.21.152.0/26 with gateway IP 196.21.152.1, 196.21.162.0/26 with gateway IP 196.21.162.1 (3 public subnets routed to our cabinet)
That is still confusing. They are either routed to you or they are some convoluted setup with multiple layer 3 networks on the same interface. If they are actually routed it makes no sense to specify what is used as the gateway address.
Generally you will be provided with one interface subnet and a gateway to route to, then the provider will route the remaining networks to an address on that network which you must set as the interface address or a VIP.
For instance, they would give you:
Network: 196.21.151.0/26
Gateway: 196.21.151.1
Usable: 196.21.151.2 - 196.21.151.62You would set the interface address to 196.21.151.2/26 and the default gateway to 196.21.151.1. the other addresses on that network could be used on the WAN interface as VIPs, etc.
They would then do the equivalent of this on their router:
ip route 196.21.152.0 255.255.255.192 196.21.151.2
ip route 196.21.162.0 255.255.255.192 192.21.151.2You could use those on inside interfaces or route them or use them as VIPs on WAN or really anything you want.
I would not want a /26 on WAN unless you absolutely need the addresses on WAN. Even then it is probably better to have a smaller subnet such as a /29 on the WAN interface and have them route all three /26 networks to that. You can still use them as VIPs on WAN if you so desire. Or use them on the inside, or route them or whatever.
-
I believe it's confusing because I'm not explaining my concerns properly. Please ignore all previous posts, let me explain what my problem is.
Firstly, I have NO idea whether the IP blocks are "routed" to me. As mentioned, our rack has a cable which we plug into our switch and from there on forth we have access. Let's forget for a moment that we have multiple IP blocks and focus on a single IP block.
The datacenter gave us the following:
Network: 196.21.151.0/26
Gateway: 196.21.151.1
Usable: 196.21.151.2 - 196.21.151.62WITHOUT PFSENSE, if I wanted one of our hosts to get access to the internet (and to make use of the static IP address), I would setup that host with one of the usable IP addresses and used the gateway as described above. That would give that host a static IP address of say 196.21.151.10 and also access to the internet.
Now, our pfsense server will have the cable plugged into the WAN port and another cable to our switch, effectively letting ALL internet traffic to our rack first go through the pfsense server before it will be sent to the switch and ultimately to the individual hosts and hosted VM's. The pfsense WAN interface will have a single IP address setup for WAN from one of the usable IP addresses in the static block (for argument, let's say 196.21.151.2) which gives the pfsense server access to the internet.
Now let's say I have a host which uses 196.21.151.3 which is now behind the pfsense firewall. It uses the gateway 196.21.151.1 (as provided by the datacenter). It can obviously make outgoing internet connections because the LAN interface in pfsense by default allows traffic outbound (or so I believe). My concern is INCOMING firewall rules. Say this host needs to have port 80 opened to it. By default, this will be blocked at the pfsense router as there is no rules setup. My concern here is that will it be as simple as just creating a WAN rule to say source * port 80 destination 196.21.151.3 (in laymans terms obviously) or do I need to first setup in pfsense an interface for the network 196.21.151.0/24 so that it will be able to allow for firewall rules to be created for those specific IP blocks?
Logically I believe that I do not need to do anything further as the pfsense firewall should allow for me to open the port for any IP behind the firewall, but as this is at our production server I would want to assure myself that when plugged in (and obviously the rules configured), that pfsense will allow these connections to the various hosts and VM's behind it without having each individual network first configured?
I'm sorry for not being able to give more technical details. I'm fairly new to pfsense and as our only tests center is at our office which does not replicate what we have at the datacenter, I would rather get quality answers from experienced folk like yourself before having an anxious breakdown when things are not working at the dc :)
-
"Now let's say I have a host which uses 196.21.151.3 which is now behind the pfsense firewall. It uses the gateway 196.21.151.1 (as provided by the datacenter)"
It doesn't WORK THAT WAY!!!
You don't put the same network on 2 sides of a router!! Are you planning on bridging? And turning pfsense into a transparent?
"My concern is INCOMING firewall rules"
There are no default incoming rules… Out of the box anything behind pfsense would be protected from unsolicited traffic!! What kind of firewall would it be if just let stuff in behind the firewall without being told too??
The first thing you need to do is understand basic networking 101.. If your going to put devices behind pfsense you can use whatever network you want.. But not the same network that is on its wan! And out of the box it is going to NAT.. just like any home soho router.. So whatever IP network you use behind pfsense when it goes outbound will be the IP on pfsense WAN. So if you want inbound traffic you would have to forward ports, which you could only send to 1 IP.
If you want to use a public IPs behind pfsense you have 2 options.. Route them which is how you should be doing it in a DC.. Or set them up as VIPs on your wan, and then use a 1:1 nat to whatever rfc1918 address you put on the box behind pfsense.
-
John, thank you for the brief introduction to networking 101. I can tell you're excited to help and thank you for that!
It appears that there may be a chance that you did not get my entire sentence related to my concern as you only quoted the first bit:
My concern is INCOMING firewall rules. Say this host needs to have port 80 opened to it. By default, this will be blocked at the pfsense router as there is no rules setup.
I explicitly said that by default pfsense would (and should) block all packets as there is no rules setup to allow any traffic to any rules. I might need a course of networking rules 101 but i'm not installing the pfsense to look cool, it should at least function as a firewall.
The first thing you need to do is understand basic networking 101. If your going to put devices behind pfsense you can use whatever network you want.. But not the same network that is on its wan! And out of the box it is going to NAT.. just like any home soho router.. So whatever IP network you use behind pfsense when it goes outbound will be the IP on pfsense WAN. So if you want inbound traffic you would have to forward ports, which you could only send to 1 IP.
It makes sense. I cannot have one of the IP's of the network as the WAN and then use the remainder in LAN. I did not think about it that way. As there is simply no other way for me to give the pfsense box internet WITHOUT one of the IP's provided by the datacenter, I presume (and please, don't hold back, give it to me straight) I would need to get the smallest possible network from my datacenter to exclusively use for the WAN.
Given the 2 solutions, I have no experience in routing and as there is about 200 individual IP's the 1:1 NAT option would not make sense, I'm better of forgetting about pfsense and have each device rely on it's own firewall and security. Thanks for your time anyways.
-
Firstly, I have NO idea whether the IP blocks are "routed" to me. As mentioned, our rack has a cable which we plug into our switch and from there on forth we have access.
You might try asking the colo provider? Tell them you want a /29 on the interface and the /26 blocks routed to your first available address on that.
Some simple packet captures and pings would tell you how it is configured but you would need to know what to look for.
If you place one of the /26 networks on the interface and ping an address on one of the other /26 networks from the outside, they will:
-
ARP for the gateway address to which they are configured to route the traffic. If that address exists on the firewall it will reply and they will proceed to step 2. Or if they already have the ARP cached they will go straight to step 2.
-
Attempt to send the traffic with that target destination to your router - meaning they are routing the traffic to an existing address on the WAN interface for which they already have ARP.
Or they will ARP for the destination address which means they are stacking multiple Layer 3 networks on your interface and should be smacked upside the head with a clue bat.
If you get to step 2 you need to ask them which address they are routing the traffic to unless you can see the ARP for the gateway address followed by the traffic and can deduce this for yourself.
-
-
Thank you Derelict! I've asked my colocation provider if they can confirm whether they can route the individual networks they give to us through a (new) /29 network with the first available network.
At this point of time I have the pfsense server plugged into the switch like other hosts so that I can start testing it over the private network which is making it a bit difficult to test your recommended ping scenario as the pfsense box does not have exclusive incoming access. I will however take your guidance on the matter as I've committed in getting this working (and glad I first came to ask before just trying!) I will keep you posted once I have an answer from them. I will also ask them to go ahead with a /29 order if they can confirm that they can do it as it sounds like that is the most logical route.
-
Got some feedback from our colocation provider. I'll paste their input. It appears that we have the option for routing:
–-----------------------------------------------------
There are two ways we can provision additional subnets to a client:
- Configure the subnet with a default gateway in the VLAN (default)
- Statically route the additional subnet to an IP in the existing subnet in the VLAN
I've tested last night the integration as described by John by setting up VIPs with a 1:1 ratio - This appears to work as well.
Based on the routing option, am I right in saying that an entire subnet would be routed to a single IP address which would then be the WAN IP in pfsense? If so, how does mapping happen as the devices behind the firewall would have a private IP? Would I still need to setup a 1:1 per private ip to one of the routed IP's in the subnet?
-
No you are not natting to a single IP.. Your devices behind would be on their public networks. There is no mapping..
If you want to all port 80 to some public IP behind pfsense, then you just put that rule in to the wan interface of the firewall..
-
So just to confirm:
1. I get a /29 from the datacenter and ask them to route all of our other networks through the first available IP.
2. I then setup the pfsense WAN with that IP
3. From there on forth I make incoming rules (on WAN) to allow the various ports on the public IP's. (so accept port 80 source any destination 196.123.123.123)
4. The VM's etc behind the firewall remains setup with their various static IP addresses, no network changes like changing the gateway to the lan required?
5. If I want to set rules for between the VM's making use of the public IP's behind the pfsense router, would I set them all in the WAN interface?Thanks again for your help.
-
No. You would number an inside interface (LAN) using one of the /26 networks. This would require firewall rules to allow outbound connections just like any other LAN.
The hosts on that network would get an address out of that /26 network (static or DHCP, your choice) and use the LAN address as their gateway.
You configure Firewall > NAT, Outbound on the WAN interface to NOT NAT for sources using that /26 network. (There are several ways to do this, I would use Hybrid mode and a NO NAT rule in your case.)
Then you just pass the desired traffic to the /26 on WAN. No port forwards needed. No NAT involved.
-
4 The vms would point to the IP of their gateway for their network that you put on the interface on PFSENSE.. So if if you got say a /24 of 196.123.123/24 that is routed to your wan IP. Then on pfsense interface that your going to connected your devices their gateway would be the IP you put on that interface - say 196.123.123.1
5 Pfsense has nothing to do with rules between devices on the same network.. Now if you have 2 networks behind pfsense like 196.123.123/24 and 196.123.124/24 then sure you could create filewall rules between these 2 different networks. But pfsense has nothing to do with devices on the same network talking to each other.
-
I've requested from the datacenter 2 additional /29 networks of which 1 will be routed through the first available IP in the other. I believe this will be the only way we can properly test this before going into production. Will try the below and keep you posted.
Thank you so far for your help!
-
If they route the subnets it will work.
-
Got the routed IP's. It's 2 /29 networks where one routes to an IP within the other.
- 192.168.158.160/29 - 192.168.158.161 is the IP through which the following /29 is routed
- 192.168.158.168/29 (can use between 192.168.158.170 - 174)
Steps taken thus far:
1. I've then set the WAN to the 192.168.158.161, perfect, connected and VPN works!
2. I've created a VLAN (have not configured on switch yet) and a seperate interface which use static IP 192.168.158.170 (which would now also be the gateway for all other IP's in the usuable range)
3. I've created a WAN rule to allow for traffic from any source to 192.168.158.168/29 - This rule will be deleted, just want to first get the route and connection correct.
4. I've also setup a VM to make use of IP 192.168.158.171 and set the gateway to 192.168.158.170
5. I've created a LAN rule for the new interface in step 2 above for allow for all traffic - This rule too will be deleted / finetuned once the VM above has access
6. I've gone into firewall > NAT > outbound and set it to hybrid (as we still have an actual private LAN behind the PFSENSE which still needs NAT). I then created a mapping rule for interface WAN with source ANY destination 192.168.158.168/29 (network) and set the option to "Do not NAT" in the ruleAt this point of time the VM setup in point 4 above has no internet access. I presume this is due to the VLAN not setup on the actual switch but only in pfsense? I am also unable to ping the gateway IP from the VM. I need to reset the switch directly at the datacenter so if the above may be due to the VLAN's not setup on the switch I'll need to first address that tomorrow.
-
"I am also unable to ping the gateway IP from the VM"
How are these vms connected to the network.. Are they on the same host as pfsense (pfsense is vm?)
What rules did you create on this new interface you created for your "192.168.158" I assume your just using rfc1918 space for your post - but its really public?
-
How are these vms connected to the network.. Are they on the same host as pfsense (pfsense is vm?)
Pfsense is a physical server, both pfsense server and host of the VM is connected to the same switch
What rules did you create on this new interface you created for your "192.168.158"
A single rule that allows all traffic on ipv4 source any destination any (accept all rule)
I assume your just using rfc1918 space for your post - but its really public?
Yes, got a little confusing with all of the sets above. The last octet of the IP's are the same as what I'm using now so that I can keep track of what's doing. They are public
-
Well if your machines are VM then the switch that connects this vm network vswitch to your physical and then pfsense will have to be configured for your vlans yes…
So you have something like this (see attached pic)
You have to setup the vlans on your switch.. What VM are you using? esxi, vserver, xen, etc.? But for pfsense to be able to get the vlan on its physical interface you created the vlan on, then yes your switching environment has to be configured correctly to put the devices into the correct vlan on the switch port they are connected to. And then the connection to pfsense will have to tag these vlans so pfsense can see this traffic on its vlan interface you created.
-
Ah, I believe I've found the missing link then! I'm only going to the dc tomorrow to go reset our switch, if I fail we're purchasing a new one on Monday (the HP switch mostly runs Java which is so outdated it's not allowing for basic changes)
The diagram is also 100% correct.
For this particular VM test (as above) I used hyper-v but our production servers run citrix xenserver - These are the ones I am more interested in sorting.
Thanks for the help so far!
-
6. I've gone into firewall > NAT > outbound and set it to hybrid (as we still have an actual private LAN behind the PFSENSE which still needs NAT). I then created a mapping rule for interface WAN with source ANY destination 192.168.158.168/29 (network) and set the option to "Do not NAT" in the rule
This is backwards. Should be:
interface WAN with source Network 192.168.158.168/29 destination any and set the option to "Do not NAT" in the rule
I assume the 192.168 is simply a place-holder for the actual, public IP addresses. You can avoid this confusion there by using 192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24 in your examples where you want to use BS address space and want everyone to know you're really not talking about RFC1918 space. https://tools.ietf.org/html/rfc5735 (eta: oh already asked and answered. Not many people know about these example/documentation subnets so I'll leave it here).
