Azure Firewall Setup

twistedstorm

Does anyone have instructions for a simple Wan/Lan firewall deployment in Azure. I believe my issue is with the user-defined routes and nating. When ever i add the 0.0.0.0/0 route that points to the appliance i lose all connections to the virtual network machines on the subnet. I want the public ips to be what is sent out. What am I missing?

Derelict

You want LAN public IPs to be routed from the outside to the inside VMs on the pfSense inside interface?

Does Azure even support routing like that? Without NAT, they would have to know to route the traffic to those addresses to the pfSense WAN address.

twistedstorm

We have several public ip's that azure has assigned to our different network interfaces i'd love to be able to continue to use them instead of putting it all through one firewall ip. Is that possible? It seems my error is somewhere in the routes as soon as i add 0.0.0.0/0 to the LAN route table I lose all the VM's. Over 3 days and can't get it talking correctly. Not sure what I'm missing here.

Derelict

I don't think you can do that.

I would put one on the same subnet as the LAN interface and try changing the 0.0.0.0/0 route on that and see if you at least can get a normal, natted LAN connection going.

twistedstorm

So attempt Lan and Wan on same subnet add the 0.0.0.0/0 and see if a NAT connection can be had. I'm no expert at networking could it be possible that 1:1 natting could be used to allow the use of the azure front facing public ips? How do we have two port 80's on one IP? We have a few front end applications we'd like to protect but they share several of the same ports currently we are doing this with NSG's.

Derelict

That can be done if:

1. Azure will route public addresses to the public address of pfSense. In this case you might be able to just use the publics as they are.

2. Azure will allow multiple public addresses on the WAN interface.

https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-multiple-ip-addresses-powershell

You might be able to get away with one outside address for multiple inside servers by using something like HAproxy to steer the traffic to the correct server based on requested hostname or SNI.

twistedstorm

Any idea when I route 0.0.0.0/0 to the appliance i lose all communication to the vm's on the lan subnet?

Derelict

Did you try it like I suggested with an interface on the LAN subnet + NAT instead of those publics?

Azure has zero way of knowing it needs to route those inside publics to the pfSense WAN. If it is going to be possible, that needs to happen.

twistedstorm

I'm a little confused. Interface on the Lan subnet? what exactly would you like me to do with the interfaces and routes. Currently I have two interfaces in the system.
Wan = 10.0.3.5 and Lan 10.0.2.4

In azure I have to virtual subnets 10.0.3.0/24 and 10.0.2.0/24
Nat set to manual
allow all on the lan and wan for testing

been going at this 10/hrs a day since saturday I'll try anything at this point to get it working. Never was this hard to install pfsense locally :)

Help greatly appreciated

![Effective Routes.png](/public/imported_attachments/1/Effective Routes.png)
![Effective Routes.png_thumb](/public/imported_attachments/1/Effective Routes.png_thumb)

nat.png_thumb

pfsenseinterfaces.png_thumb

subnets.png_thumb