Setting up firewall for public networks

Derelict · Jul 27, 2017, 4:58 PM

No. You would number an inside interface (LAN) using one of the /26 networks. This would require firewall rules to allow outbound connections just like any other LAN.

The hosts on that network would get an address out of that /26 network (static or DHCP, your choice) and use the LAN address as their gateway.

You configure Firewall > NAT, Outbound on the WAN interface to NOT NAT for sources using that /26 network. (There are several ways to do this, I would use Hybrid mode and a NO NAT rule in your case.)

Then you just pass the desired traffic to the /26 on WAN. No port forwards needed. No NAT involved.

johnpoz · Jul 27, 2017, 5:13 PM

4 The vms would point to the IP of their gateway for their network that you put on the interface on PFSENSE.. So if if you got say a /24 of 196.123.123/24 that is routed to your wan IP. Then on pfsense interface that your going to connected your devices their gateway would be the IP you put on that interface - say 196.123.123.1

5 Pfsense has nothing to do with rules between devices on the same network.. Now if you have 2 networks behind pfsense like 196.123.123/24 and 196.123.124/24 then sure you could create filewall rules between these 2 different networks. But pfsense has nothing to do with devices on the same network talking to each other.

mauzilla · Jul 28, 2017, 7:39 AM

I've requested from the datacenter 2 additional /29 networks of which 1 will be routed through the first available IP in the other. I believe this will be the only way we can properly test this before going into production. Will try the below and keep you posted.

Thank you so far for your help!

Derelict · Jul 28, 2017, 9:18 AM

If they route the subnets it will work.

mauzilla · Jul 28, 2017, 12:16 PM

Got the routed IP's. It's 2 /29 networks where one routes to an IP within the other.

192.168.158.160/29 - 192.168.158.161 is the IP through which the following /29 is routed
192.168.158.168/29 (can use between 192.168.158.170 - 174)

Steps taken thus far:

1. I've then set the WAN to the 192.168.158.161, perfect, connected and VPN works!
2. I've created a VLAN (have not configured on switch yet) and a seperate interface which use static IP 192.168.158.170 (which would now also be the gateway for all other IP's in the usuable range)
3. I've created a WAN rule to allow for traffic from any source to 192.168.158.168/29 - This rule will be deleted, just want to first get the route and connection correct.
4. I've also setup a VM to make use of IP 192.168.158.171 and set the gateway to 192.168.158.170
5. I've created a LAN rule for the new interface in step 2 above for allow for all traffic - This rule too will be deleted / finetuned once the VM above has access
6. I've gone into firewall > NAT > outbound and set it to hybrid (as we still have an actual private LAN behind the PFSENSE which still needs NAT). I then created a mapping rule for interface WAN with source ANY destination 192.168.158.168/29 (network) and set the option to "Do not NAT" in the rule

At this point of time the VM setup in point 4 above has no internet access. I presume this is due to the VLAN not setup on the actual switch but only in pfsense? I am also unable to ping the gateway IP from the VM. I need to reset the switch directly at the datacenter so if the above may be due to the VLAN's not setup on the switch I'll need to first address that tomorrow.

johnpoz · Jul 28, 2017, 12:36 PM

"I am also unable to ping the gateway IP from the VM"

How are these vms connected to the network.. Are they on the same host as pfsense (pfsense is vm?)

What rules did you create on this new interface you created for your "192.168.158" I assume your just using rfc1918 space for your post - but its really public?

mauzilla · Jul 28, 2017, 12:45 PM

How are these vms connected to the network.. Are they on the same host as pfsense (pfsense is vm?)

Pfsense is a physical server, both pfsense server and host of the VM is connected to the same switch

What rules did you create on this new interface you created for your "192.168.158"

A single rule that allows all traffic on ipv4 source any destination any (accept all rule)

I assume your just using rfc1918 space for your post - but its really public?

Yes, got a little confusing with all of the sets above. The last octet of the IP's are the same as what I'm using now so that I can keep track of what's doing. They are public

johnpoz · Jul 28, 2017, 12:57 PM

Well if your machines are VM then the switch that connects this vm network vswitch to your physical and then pfsense will have to be configured for your vlans yes…

So you have something like this (see attached pic)

You have to setup the vlans on your switch.. What VM are you using? esxi, vserver, xen, etc.? But for pfsense to be able to get the vlan on its physical interface you created the vlan on, then yes your switching environment has to be configured correctly to put the devices into the correct vlan on the switch port they are connected to. And then the connection to pfsense will have to tag these vlans so pfsense can see this traffic on its vlan interface you created.

mauzilla · Jul 28, 2017, 1:31 PM

Ah, I believe I've found the missing link then! I'm only going to the dc tomorrow to go reset our switch, if I fail we're purchasing a new one on Monday (the HP switch mostly runs Java which is so outdated it's not allowing for basic changes)

The diagram is also 100% correct.

For this particular VM test (as above) I used hyper-v but our production servers run citrix xenserver - These are the ones I am more interested in sorting.

Thanks for the help so far!

Derelict · Jul 28, 2017, 6:34 PM

6. I've gone into firewall > NAT > outbound and set it to hybrid (as we still have an actual private LAN behind the PFSENSE which still needs NAT). I then created a mapping rule for interface WAN with source ANY destination 192.168.158.168/29 (network) and set the option to "Do not NAT" in the rule

This is backwards. Should be:

interface WAN with source Network 192.168.158.168/29 destination any and set the option to "Do not NAT" in the rule

I assume the 192.168 is simply a place-holder for the actual, public IP addresses. You can avoid this confusion there by using 192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24 in your examples where you want to use BS address space and want everyone to know you're really not talking about RFC1918 space. https://tools.ietf.org/html/rfc5735 (eta: oh already asked and answered. Not many people know about these example/documentation subnets so I'll leave it here).