Simple address forwarding
-
What do you mean you don't want the networks to be different?
If you have
192.168.134.100 --- 192.168.134.25 (pfsense) 192.168.0.1 --- 192.168.0.25/16
So sure .100 can send traffic to 192.168.134.25 port 80. and pfsense can port forward that 192.168.0.25, but unless you also Source Nat it 192.168.0.25/16 thinks that 192.168.134.100 is on its network.. So never sends back answer to pfsense at .1 to send on to 134.100
So 134.100 never gets anything back.
Virtual adapters works just fine - I have fired up pfsense on virtualbox many many many times.. There are natting, internal or bridging etc.. So yes you also need to understand how the networking works in virtualbox. But you also need to understand the basics of networking.
-
@johnpoz said in Simple address forwarding:
What do you mean you don't want the networks to be different?
If you have
192.168.134.100 --- 192.168.134.25 (pfsense) 192.168.0.1 --- 192.168.0.25/16
So sure .100 can send traffic to 192.168.134.25 port 80. and pfsense can port forward that 192.168.0.25, but unless you also Source Nat it 192.168.0.25/16 thinks that 192.168.134.100 is on its network.. So never sends back answer to pfsense at .1 to send on to 134.100
So 134.100 never gets anything back.
I think that is right, for now I have set the subnets to /24, and they can probably stay that way
so what I have is
192.168.134.x --- (virtualbox network) --- 192.168.134.200 (pfsense) 192.168.0.200 --- (bridged ethernet) --- 192.168.0.1 --- (cable) --- 192.168.0.25 widget
I've also attached a whiteboard photo. [upload didn't work, I'll share it shortly]so from pfsense I can ping everything, and from the widget I can ping to 192.168.134.200 now that I've set 192.168.0.200 as gateway on the widget. But I can't ping from the 192.168.134.x network to 192.168.134.25, in other words my rules don't work.
-
-
the OneDrive link crops the photo a bit, but if you click on "view original" the whole image is visible.
-
So which interface is what in pfsense... 134 is wan or lan? If the 192.168.0. 200 is normal network then pfsense has gateway on this pointing to your normal gateway which makes this pfsense WAN? And out of hte box pfsense will nat traffic from its lan to is wan.
For wan to get to lan you would have to seutp port fowards, or you would need to turn off natting and then just firewall, etc.
-
@johnpoz said in Simple address forwarding:
So which interface is what in pfsense... 134 is wan or lan? If the 192.168.0. 200 is normal network then pfsense has gateway on this pointing to your normal gateway which makes this pfsense WAN? And out of hte box pfsense will nat traffic from its lan to is wan.
For wan to get to lan you would have to seutp port fowards, or you would need to turn off natting and then just firewall, etc.
I was calling 134 LAN so that I could use the web interface on that subnet but other than that I don't think I care. But I think most people would call it the WAN since it needs the kind of forwarding for which 99.9% of the rest of the world uses NAT. That's been part of the problem for me is mapping internal/external to my problem.
I'm still parsing the rest of your sentence... thx.
-
what did you set it in pfsense? We need to know which network is what in pfsense on your 2 interfaces.
Also I attached your image to your post so its easier for the next guy.
-
@johnpoz what's the best way to share that?
-
also my first photo had a typo in the red ip address.
And the picture is slightly too big to upload so here is another link to the fixed version
https://1drv.ms/u/s!Aps0w-x8vFBjhS1M53ko07ebZFAj -
Anyway the .134.200 is the LAN and .0.200 is the WAN. I can blow it all away and swap them if you think that would help.
-
You understand its childs play to save the image in such a way that is reasonable size ;) And not MB ;)
-
So if 0.200 is WAN then for widget to get to 134 you would have to port forward.
But out of the box 134 could talk to 0 network. and to the 0 network it would look like it came from pfsense IP 0.200
-
I think that means I should flip WAN and LAN because I want .0.25 to be able to get packets to a server at .134.x
-
Then yes flip them or port forward the ports you want widget to be able to send to 134.
-
I flipped them but I am still stuck. Is there a config dump I can post?
-
Thing are looking more promising will check back with the board next week.
-
Your going to run into all kinds of problems trying to route stuff when the stuff is on physical and doesn't use pfsense as its gateway.
If pfsense is not going to be a gateway to the internet then these networks do not even need to be wan.. 1 could be pfsense lan, and the other could be opt network.
-
@johnpoz said in Simple address forwarding:
Your going to run into all kinds of problems trying to route stuff when the stuff is on physical and doesn't use pfsense as its gateway.
If pfsense is not going to be a gateway to the internet then these networks do not even need to be wan.. 1 could be pfsense lan, and the other could be opt network.
But according to the docs, WAN is required so is it possible to run pfsense with only LAN and OPT interfaces?
On a separate note, when I cloned the VM, the MAC addresses changed. Can I control the assignment of which mac address is bound to em0 and em1?
update on last week, I didn't have any virtual IPs since I wrongly figured the pfsense could see them both and ping them, but then once I added virtual IPs my 1:1 NAT forwarding started working.
