Setting up firewall for public networks
-
"Now let's say I have a host which uses 196.21.151.3 which is now behind the pfsense firewall. It uses the gateway 196.21.151.1 (as provided by the datacenter)"
It doesn't WORK THAT WAY!!!
You don't put the same network on 2 sides of a router!! Are you planning on bridging? And turning pfsense into a transparent?
"My concern is INCOMING firewall rules"
There are no default incoming rules… Out of the box anything behind pfsense would be protected from unsolicited traffic!! What kind of firewall would it be if just let stuff in behind the firewall without being told too??
The first thing you need to do is understand basic networking 101.. If your going to put devices behind pfsense you can use whatever network you want.. But not the same network that is on its wan! And out of the box it is going to NAT.. just like any home soho router.. So whatever IP network you use behind pfsense when it goes outbound will be the IP on pfsense WAN. So if you want inbound traffic you would have to forward ports, which you could only send to 1 IP.
If you want to use a public IPs behind pfsense you have 2 options.. Route them which is how you should be doing it in a DC.. Or set them up as VIPs on your wan, and then use a 1:1 nat to whatever rfc1918 address you put on the box behind pfsense.
-
John, thank you for the brief introduction to networking 101. I can tell you're excited to help and thank you for that!
It appears that there may be a chance that you did not get my entire sentence related to my concern as you only quoted the first bit:
My concern is INCOMING firewall rules. Say this host needs to have port 80 opened to it. By default, this will be blocked at the pfsense router as there is no rules setup.
I explicitly said that by default pfsense would (and should) block all packets as there is no rules setup to allow any traffic to any rules. I might need a course of networking rules 101 but i'm not installing the pfsense to look cool, it should at least function as a firewall.
The first thing you need to do is understand basic networking 101. If your going to put devices behind pfsense you can use whatever network you want.. But not the same network that is on its wan! And out of the box it is going to NAT.. just like any home soho router.. So whatever IP network you use behind pfsense when it goes outbound will be the IP on pfsense WAN. So if you want inbound traffic you would have to forward ports, which you could only send to 1 IP.
It makes sense. I cannot have one of the IP's of the network as the WAN and then use the remainder in LAN. I did not think about it that way. As there is simply no other way for me to give the pfsense box internet WITHOUT one of the IP's provided by the datacenter, I presume (and please, don't hold back, give it to me straight) I would need to get the smallest possible network from my datacenter to exclusively use for the WAN.
Given the 2 solutions, I have no experience in routing and as there is about 200 individual IP's the 1:1 NAT option would not make sense, I'm better of forgetting about pfsense and have each device rely on it's own firewall and security. Thanks for your time anyways.
-
Firstly, I have NO idea whether the IP blocks are "routed" to me. As mentioned, our rack has a cable which we plug into our switch and from there on forth we have access.
You might try asking the colo provider? Tell them you want a /29 on the interface and the /26 blocks routed to your first available address on that.
Some simple packet captures and pings would tell you how it is configured but you would need to know what to look for.
If you place one of the /26 networks on the interface and ping an address on one of the other /26 networks from the outside, they will:
-
ARP for the gateway address to which they are configured to route the traffic. If that address exists on the firewall it will reply and they will proceed to step 2. Or if they already have the ARP cached they will go straight to step 2.
-
Attempt to send the traffic with that target destination to your router - meaning they are routing the traffic to an existing address on the WAN interface for which they already have ARP.
Or they will ARP for the destination address which means they are stacking multiple Layer 3 networks on your interface and should be smacked upside the head with a clue bat.
If you get to step 2 you need to ask them which address they are routing the traffic to unless you can see the ARP for the gateway address followed by the traffic and can deduce this for yourself.
-
-
Thank you Derelict! I've asked my colocation provider if they can confirm whether they can route the individual networks they give to us through a (new) /29 network with the first available network.
At this point of time I have the pfsense server plugged into the switch like other hosts so that I can start testing it over the private network which is making it a bit difficult to test your recommended ping scenario as the pfsense box does not have exclusive incoming access. I will however take your guidance on the matter as I've committed in getting this working (and glad I first came to ask before just trying!) I will keep you posted once I have an answer from them. I will also ask them to go ahead with a /29 order if they can confirm that they can do it as it sounds like that is the most logical route.
-
Got some feedback from our colocation provider. I'll paste their input. It appears that we have the option for routing:
–-----------------------------------------------------
There are two ways we can provision additional subnets to a client:
- Configure the subnet with a default gateway in the VLAN (default)
- Statically route the additional subnet to an IP in the existing subnet in the VLAN
I've tested last night the integration as described by John by setting up VIPs with a 1:1 ratio - This appears to work as well.
Based on the routing option, am I right in saying that an entire subnet would be routed to a single IP address which would then be the WAN IP in pfsense? If so, how does mapping happen as the devices behind the firewall would have a private IP? Would I still need to setup a 1:1 per private ip to one of the routed IP's in the subnet?
-
No you are not natting to a single IP.. Your devices behind would be on their public networks. There is no mapping..
If you want to all port 80 to some public IP behind pfsense, then you just put that rule in to the wan interface of the firewall..
-
So just to confirm:
1. I get a /29 from the datacenter and ask them to route all of our other networks through the first available IP.
2. I then setup the pfsense WAN with that IP
3. From there on forth I make incoming rules (on WAN) to allow the various ports on the public IP's. (so accept port 80 source any destination 196.123.123.123)
4. The VM's etc behind the firewall remains setup with their various static IP addresses, no network changes like changing the gateway to the lan required?
5. If I want to set rules for between the VM's making use of the public IP's behind the pfsense router, would I set them all in the WAN interface?Thanks again for your help.
-
No. You would number an inside interface (LAN) using one of the /26 networks. This would require firewall rules to allow outbound connections just like any other LAN.
The hosts on that network would get an address out of that /26 network (static or DHCP, your choice) and use the LAN address as their gateway.
You configure Firewall > NAT, Outbound on the WAN interface to NOT NAT for sources using that /26 network. (There are several ways to do this, I would use Hybrid mode and a NO NAT rule in your case.)
Then you just pass the desired traffic to the /26 on WAN. No port forwards needed. No NAT involved.
-
4 The vms would point to the IP of their gateway for their network that you put on the interface on PFSENSE.. So if if you got say a /24 of 196.123.123/24 that is routed to your wan IP. Then on pfsense interface that your going to connected your devices their gateway would be the IP you put on that interface - say 196.123.123.1
5 Pfsense has nothing to do with rules between devices on the same network.. Now if you have 2 networks behind pfsense like 196.123.123/24 and 196.123.124/24 then sure you could create filewall rules between these 2 different networks. But pfsense has nothing to do with devices on the same network talking to each other.
-
I've requested from the datacenter 2 additional /29 networks of which 1 will be routed through the first available IP in the other. I believe this will be the only way we can properly test this before going into production. Will try the below and keep you posted.
Thank you so far for your help!
-
If they route the subnets it will work.
-
Got the routed IP's. It's 2 /29 networks where one routes to an IP within the other.
- 192.168.158.160/29 - 192.168.158.161 is the IP through which the following /29 is routed
- 192.168.158.168/29 (can use between 192.168.158.170 - 174)
Steps taken thus far:
1. I've then set the WAN to the 192.168.158.161, perfect, connected and VPN works!
2. I've created a VLAN (have not configured on switch yet) and a seperate interface which use static IP 192.168.158.170 (which would now also be the gateway for all other IP's in the usuable range)
3. I've created a WAN rule to allow for traffic from any source to 192.168.158.168/29 - This rule will be deleted, just want to first get the route and connection correct.
4. I've also setup a VM to make use of IP 192.168.158.171 and set the gateway to 192.168.158.170
5. I've created a LAN rule for the new interface in step 2 above for allow for all traffic - This rule too will be deleted / finetuned once the VM above has access
6. I've gone into firewall > NAT > outbound and set it to hybrid (as we still have an actual private LAN behind the PFSENSE which still needs NAT). I then created a mapping rule for interface WAN with source ANY destination 192.168.158.168/29 (network) and set the option to "Do not NAT" in the ruleAt this point of time the VM setup in point 4 above has no internet access. I presume this is due to the VLAN not setup on the actual switch but only in pfsense? I am also unable to ping the gateway IP from the VM. I need to reset the switch directly at the datacenter so if the above may be due to the VLAN's not setup on the switch I'll need to first address that tomorrow.
-
"I am also unable to ping the gateway IP from the VM"
How are these vms connected to the network.. Are they on the same host as pfsense (pfsense is vm?)
What rules did you create on this new interface you created for your "192.168.158" I assume your just using rfc1918 space for your post - but its really public?
-
How are these vms connected to the network.. Are they on the same host as pfsense (pfsense is vm?)
Pfsense is a physical server, both pfsense server and host of the VM is connected to the same switch
What rules did you create on this new interface you created for your "192.168.158"
A single rule that allows all traffic on ipv4 source any destination any (accept all rule)
I assume your just using rfc1918 space for your post - but its really public?
Yes, got a little confusing with all of the sets above. The last octet of the IP's are the same as what I'm using now so that I can keep track of what's doing. They are public
-
Well if your machines are VM then the switch that connects this vm network vswitch to your physical and then pfsense will have to be configured for your vlans yes…
So you have something like this (see attached pic)
You have to setup the vlans on your switch.. What VM are you using? esxi, vserver, xen, etc.? But for pfsense to be able to get the vlan on its physical interface you created the vlan on, then yes your switching environment has to be configured correctly to put the devices into the correct vlan on the switch port they are connected to. And then the connection to pfsense will have to tag these vlans so pfsense can see this traffic on its vlan interface you created.
-
Ah, I believe I've found the missing link then! I'm only going to the dc tomorrow to go reset our switch, if I fail we're purchasing a new one on Monday (the HP switch mostly runs Java which is so outdated it's not allowing for basic changes)
The diagram is also 100% correct.
For this particular VM test (as above) I used hyper-v but our production servers run citrix xenserver - These are the ones I am more interested in sorting.
Thanks for the help so far!
-
6. I've gone into firewall > NAT > outbound and set it to hybrid (as we still have an actual private LAN behind the PFSENSE which still needs NAT). I then created a mapping rule for interface WAN with source ANY destination 192.168.158.168/29 (network) and set the option to "Do not NAT" in the rule
This is backwards. Should be:
interface WAN with source Network 192.168.158.168/29 destination any and set the option to "Do not NAT" in the rule
I assume the 192.168 is simply a place-holder for the actual, public IP addresses. You can avoid this confusion there by using 192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24 in your examples where you want to use BS address space and want everyone to know you're really not talking about RFC1918 space. https://tools.ietf.org/html/rfc5735 (eta: oh already asked and answered. Not many people know about these example/documentation subnets so I'll leave it here).
