Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Setting up a home lab- need NAT to have internal virtual switch to go into the internet

    Scheduled Pinned Locked Moved Virtualization
    42 Posts 3 Posters 7.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator
      last edited by

      I set pfsense up on hyper-v the other day for another thread that said it doesn't support vlans. It really is clickity clickity other than you changing the lan network from the default there is zero to do... It would work out of the box.

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      1 Reply Last reply Reply Quote 0
      • K
        korr2221 @johnpoz
        last edited by korr2221

        @johnpoz but just for learning purposes, if I did need to make any NAT adjustments, what would the rule be? What would it entail to do what I need? Under the impression that it doesn't automatically work? I'm a little puzzled by all the NAT'ing features with 1:1, port forward and NPt.

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by johnpoz

          There is zero reason to do any nat changes... Leave it on automatic! I could see if you had set it to manual, and then changed your lan IP you would have issues ;)

          It will auto work!! There is no reason to do anything then automatic in the outbound nat unless your doing something very out of the box complex. And even then almost always hybrid mode would be the better choice then manual, etc.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          K 1 Reply Last reply Reply Quote 0
          • K
            korr2221 @johnpoz
            last edited by

            @johnpoz i mean if there were zero rules, and it doesn't automatically work. wouldn't it need some kind of NAT rule to make it work?

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by

              If it was set to auto there would be the auto rules... IF NOT then you have something else wrong..

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                If those guests get DHCP from the ASA the problem is in Hyper-V not pfSense.

                All you have to do is create two vswitches, one on the outside for pfSense WAN to your existing, upstream LAN and one on the inside to pfSense LAN and the guests.

                Generic terms because I don't use Hyper-V.

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                K 1 Reply Last reply Reply Quote 0
                • K
                  korr2221 @Derelict
                  last edited by

                  @derelict if you look at my network diagram this is what i did......

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by Derelict

                    If that is what you did, the DHCP wouldn't flow between that switch and the ASA.

                    It really is as simple as that. Check everything again. This is a Layer 2 problem. Nothing pfSense can do about it.

                    It could also be the way Hyper-V is connected to the physical network.

                    Moving to Virtualization.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    K 1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      @korr2221 said in Setting up a home lab- need NAT to have internal virtual switch to go into the internet:

                      and my internal virtual switch have all the VMs connected to that. It's not getting DHCP from the ASA FW.

                      He stated he VMs were NOT getting dhcp from ASA..

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        Ah. Yeah that works out of the box. Confused by the message in the diagram.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        K 1 Reply Last reply Reply Quote 0
                        • K
                          korr2221 @Derelict
                          last edited by korr2221

                          @derelict As John said I think you misunderstood my problem. I don't want DHCP to be given by the ASA. It will be given by either pfsense or the Windows 2012 server for the 10.0.0.x /24 network. Anything behind pfsense will get it's own DHCP. The only issue is NAT'ing and somehow the VMs are not getting internet.

                          1 Reply Last reply Reply Quote 0
                          • K
                            korr2221 @Derelict
                            last edited by

                            @derelict Yeah, everyone here so far is telling me this. I thought I had to make an entry in the NAT Outgoing rule. But apparently not? So I guess I'll have to reset it to default and hope it works?

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by

                              Its not HOPE ;) This is drop dead work out of the box simple... I have setup pfsense 100's of times over the years... And it really is clicky clicky up and running.. It is so drop dead simple its just amazing how users manage to mess it up...

                              There is really nothing to do but answer a couple of questions - like your time zone and what you want to call pfsense and will work.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • DerelictD
                                Derelict LAYER 8 Netgate
                                last edited by Derelict

                                With a simple DHCP WAN and LAN, Automatic Outbound NAT pretty much "just works."

                                You likely do not need to reinstall. Just save the configuration and reset to factory. You can easily restore the saved config and be right back where you are now.

                                Tip for a Virtual Lab:

                                The first thing I usually do after I install a new VM firewall is drop to the shell and run this:

                                pfSsh.php playback enableallowallwan

                                You can then just use your workstation to connect to the web gui on WAN (the address is right there above the console menu) so you don't have to connect using a VM. You would, of course want to disable (or source limit) that rule to test WAN firewall functionality.

                                ETA: DISCLAIMER this is not something you want to do with anything actually on the wild internet.

                                Chattanooga, Tennessee, USA
                                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                1 Reply Last reply Reply Quote 0
                                • K
                                  korr2221 @korr2221
                                  last edited by

                                  @johnpoz Just did a factory reset, update to the latest version of pfsense.

                                  Did you mess with the lan rules? This no longer matter I reset it to factory default.

                                  Did you mess with the outbound nat tab? factory default.

                                  Your setup is out of the box, click click works.

                                  Are you running any packages? No packages with logging facilities are currently installed.

                                  Does pfsense have internet access? •Unable to retrieve package information. It does not have internet.......

                                  1 Reply Last reply Reply Quote 0
                                  • DerelictD
                                    Derelict LAYER 8 Netgate
                                    last edited by

                                    If you have no internet from the node itself, nodes behind it won't have internet either.

                                    Chattanooga, Tennessee, USA
                                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                    K 1 Reply Last reply Reply Quote 0
                                    • K
                                      korr2221 @Derelict
                                      last edited by korr2221

                                      @derelict yes.... but why doesn't it have internet? If I use the same external network adapter in a windows 10 vm it has access to the internet.........i'm accessing the web gui via the LAN address which is 10.0.0.1 /24.... not from the 192.168.1.x interface. It's updated to version 2.4.4.2... i don't get it...... how does it not have internet but able to download and update? LOL

                                      The process will require 24 MiB more space.
                                      [1/1] Upgrading pfSense-kernel-pfSense from 2.4.2 to 2.4.4_2...
                                      [1/1] Extracting pfSense-kernel-pfSense-2.4.4_2: .......... done
                                      ===> Keeping a copy of current kernel in /boot/kernel.old

                                      Removing unnecessary packages... done.
                                      Upgrade is complete. Rebooting in 10 seconds.
                                      Success

                                      nvm it has internet...i got the package list after the update

                                      1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by

                                        ok so if it has internet - then you clients behind it would have internet.

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        K 1 Reply Last reply Reply Quote 0
                                        • K
                                          korr2221 @johnpoz
                                          last edited by

                                          @johnpoz clients behind it doesn't have internet.... Any ideas?

                                          1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator
                                            last edited by johnpoz

                                            Can clients ping pfsense IP? Is this what is set for their gateway?

                                            Lets see a traceroute to 8.8.8.8 for example

                                            First hop should be pfsense IP on your VM lan you setup. Do I really have to fire up hyper-v to show you how simple this is?

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            K 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.