Setting up a home lab- need NAT to have internal virtual switch to go into the internet

korr2221 · Jan 29, 2019, 1:54 PM

So this is my lab set up. I want to be able to have my Virtual machines on my Hyper V host to go through the pfsense to get to the internet. For whatever reason I can't get the NAT set up correctly. So far I'm only adding the NAT outbound rules as the following:

Interface: LAN
Source 10.x.x.x /24
Source Port: *
Destination: *
Destination Port: *
NAT Address: WAN Address
NAT Port: *
Static Port: ?

Any help would be greatly appreciated. Do I have to set up the 1:1, NPt or NAT port forwarding?

Have edited the diagram my apologies on my mistake.

johnpoz · Jan 29, 2019, 1:38 PM

So you want 2 internal networks or lans behind pfsense for VMs?

You have lan network as 10.0.0/24 but then you show VMs on this internal switch being on 10.0.1/24 and 10.0.0/24? Are those just typos?

If its an internal switch on your hyper-v, it would not be connected to your external network - and it would be impossible for it to be getting dhcp from anything on the external network. But it could talk to the host.. You sure you didn't create an other external switch?

The switch used to connect to pfsense lan side could also be a PRIVATE switch. Only VMs connected this switch can talk to other VMS on the vswitch.. Can not even talk to the host.

korr2221 · Jan 29, 2019, 1:42 PM

@johnpoz my apologies only one network behind pfsense. The Windows 10 machine should be 10.0.0.4 or something. No idea why I made it 10.0.1.1 /24. Anyway, on my pfsense I made the external interface on the external virtual switch, and my internal virtual switch have all the VMs connected to that. It's not getting DHCP from the ASA FW.

But my goal is to be able to have those VMs be able to go through the pfsense to access internet which I believe requires proper NAT from the pfsense.

johnpoz · Jan 29, 2019, 1:47 PM

Well that would work out of the box..

Pfsense will nat out of the box anything on the lan to is wan address. Pfsense wan is via dhcp from your ASA right? It gets a 192.168.1.x address and points to the ASA which is the gateway.

There is NO nat to setup with this since its out of the box that way.. You WAN is the interface with a gateway - normally dhcp. And your lan will have NO gateway and will run dhcpd. Clients on this lan going anywhere will talk to the pfsense lan IP and if routed out the wan for their dest will be natted to the wan IP.

Did you mess with the lan rules? Did you mess with the outbound nat tab? Your setup is out of the box, click click works. Are you running any packages? Does pfsense have internet access?

korr2221 · Jan 29, 2019, 1:47 PM

@johnpoz Yes my WAN is getting DHCP from my ASA. I'm able to connect to the pfsense GUI inside the internal network on my VMs. It can also ping my 192.168.1.4 WAN interface from my VMs, but it doesn't go out into the internet. Any recommendations?

johnpoz · Jan 29, 2019, 1:48 PM

See my edit - did you mess with anything.. This really is out of the box = work. Can your VMS ping the ASA IP? 192.168.1.1

korr2221 · Jan 29, 2019, 1:51 PM

@johnpoz it doesn't ping my ASA from what I remember. I'm not home atm.

Did you mess with the lan rules? Not that I know of, what rules could cause an issue?

Did you mess with the outbound nat tab? Your setup is out of the box, click click works. There are no rules with exception to the one above and the 127.0.0.1 rules, I'll update you when I get home.

Are you running any packages? How can I check?

Does pfsense have internet access? How can I check?

When I go home I will reset my pfsense to factory default. Hopefully it works idk.

johnpoz · Jan 29, 2019, 1:55 PM

Does pfsense say its on the latest version.. Or give you an option to download new version? When you go to the package manger does it show packages available? If so then yeah it has internet.

So the outbound nat is set to automatic. The lan rules out of the box would be any any rule. Did you edit that? Or put in any floating rules. If you did not install any packages then there wouldn't be any.. You would see what packages are installed on the package manager tab.

korr2221 · Jan 29, 2019, 1:55 PM

@johnpoz I will update you when I get home from work and let you know. Thank you!

johnpoz · Jan 29, 2019, 1:56 PM

I set pfsense up on hyper-v the other day for another thread that said it doesn't support vlans. It really is clickity clickity other than you changing the lan network from the default there is zero to do... It would work out of the box.

korr2221 · Jan 29, 2019, 1:59 PM

@johnpoz but just for learning purposes, if I did need to make any NAT adjustments, what would the rule be? What would it entail to do what I need? Under the impression that it doesn't automatically work? I'm a little puzzled by all the NAT'ing features with 1:1, port forward and NPt.

johnpoz · Jan 29, 2019, 1:59 PM

There is zero reason to do any nat changes... Leave it on automatic! I could see if you had set it to manual, and then changed your lan IP you would have issues ;)

It will auto work!! There is no reason to do anything then automatic in the outbound nat unless your doing something very out of the box complex. And even then almost always hybrid mode would be the better choice then manual, etc.

korr2221 · Jan 29, 2019, 2:00 PM

@johnpoz i mean if there were zero rules, and it doesn't automatically work. wouldn't it need some kind of NAT rule to make it work?

johnpoz · Jan 29, 2019, 2:00 PM

If it was set to auto there would be the auto rules... IF NOT then you have something else wrong..

Derelict · Jan 29, 2019, 7:58 PM

If those guests get DHCP from the ASA the problem is in Hyper-V not pfSense.

All you have to do is create two vswitches, one on the outside for pfSense WAN to your existing, upstream LAN and one on the inside to pfSense LAN and the guests.

Generic terms because I don't use Hyper-V.

korr2221 · Jan 29, 2019, 8:03 PM

@derelict if you look at my network diagram this is what i did......

Derelict · Jan 29, 2019, 8:05 PM

If that is what you did, the DHCP wouldn't flow between that switch and the ASA.

It really is as simple as that. Check everything again. This is a Layer 2 problem. Nothing pfSense can do about it.

It could also be the way Hyper-V is connected to the physical network.

Moving to Virtualization.

johnpoz · Jan 29, 2019, 8:09 PM

@korr2221 said in Setting up a home lab- need NAT to have internal virtual switch to go into the internet:

and my internal virtual switch have all the VMs connected to that. It's not getting DHCP from the ASA FW.

He stated he VMs were NOT getting dhcp from ASA..

Derelict · Jan 29, 2019, 8:11 PM

Ah. Yeah that works out of the box. Confused by the message in the diagram.

korr2221 · Jan 29, 2019, 8:12 PM

@derelict As John said I think you misunderstood my problem. I don't want DHCP to be given by the ASA. It will be given by either pfsense or the Windows 2012 server for the 10.0.0.x /24 network. Anything behind pfsense will get it's own DHCP. The only issue is NAT'ing and somehow the VMs are not getting internet.