Proxmox + PFSense conection port forward
-
@Lixaotec said in Proxmox + PFSense conection port forward:
Proxmox connected to isp modem, static 192.168.100.10 (vmbr0)
PFsense a vm inside Proxmox, also gets an ip from isp modem (192.168.100.6) vmbr0
inside PFSense I created a NAT Port Forwarind to a linux VM, also inside proxmox (192.168.1.100) another iface, vmbr1 , and listen with netcat to test
When I use another machine that also connected to isp modem (192.168.100.12) I can do a netcat sucessfully.
However when I try from inside of proxmox shell to netcat that port, it does not works.Proxmox has no correct route to the machine behind pfSense. It will send its packets to the ISP router which is the default gateway.
If you really want to access this VM from Proxmox over vmbr0 and pfSense, you have to add a static route to Proxmox for the vmbr1 network pointing to 192.168.100.6.
-
Dear @viragomann
Thanks for replying.
Shouldnt be PFSense responsability to route from inside to vmbr1?
vmbr1 is dhcp server inside proxmox, i thought it would never be accessible diretly from proxmox either, thats why I am trying nat port fowrd
-
@Lixaotec said in Proxmox + PFSense conection port forward:
Shouldnt be PFSense responsability to route from inside to vmbr1?
Yes, but pfSense isn't involved as long Proxmox sends its packets to the wrong device.
So just fire up a traceroute to 192.168.1.100 on proxmox and look, where the packets go to be sure.
-
Sorry I told wrong stuff.
vmbr1 is a dhcp Inside PFSense, not proxmox.
-
traceroute to 192.168.1.100 (192.168.1.100), 30 hops max, 60 byte packets
1 * 192.168.100.1 (192.168.100.1) 0.485 ms 0.656 ms
2 100.127.255.6 (100.127.255.6) 5.480 ms 5.542 ms 5.602 ms
3 * * *
4 * * *
5 * * *
6 * * *
7 * * *
8 * * *
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 * * *
16 * * *
17 * * *
18 * * *
19 * * *
20 * * *
21 * * *
22 * * *
23 * * *
24 * * *
25 * * *
26 * * *
27 * * *
28 * * *
29 * * *
30 * * * -
If your on the wan network of pfsense.. BTW 192.168.100 is horrible choice for a network - this is the default for cable modems when they don't have access. And you can access their status page on 192.168.100.1.. So I assume you don't actually have a "modem" but some gateway device... What is the make and model number of this "modem"?
Anyhoo - if your wan network is 192.168.100/24 and you want to get to something behind pfsense 192.168.1.X then out of the box pfsense is natting to 192.168.100.6 for any devices behind it on this 192.168.1 network
So setup a port forward, and access 192.168.100.6 on port X and pfsense will send you to that IP and port you setup.
-
So the next hop is 192.168.100.1, your ISP modem. 100.127.255.6 may be your internet upstream gateway.
So as I mentioned above, Proxmox send its packets to the IPS moedem, since it as no route to 192.168.1.100. So add a route to Proxmox and it should work.
-
How is going to work when pfsense nats out of the box. Did he turn off natting?
-
As I understood his first post, he only want to access the machines behind pfSense from Proxmox, but not the other way round.
-
Huh?? If proxmox had an IP in this 192.168.1 network - he would have no need of creating any routes in the first place. when talking to 192.168.1.x it would use its IP in that interface.
If the HOST does not have an ip in this network, then he would need to route yes. But since pfsense is the router to get to 192.168.1 - and it nats this network out of the box.. He would have to setup port forwarding, and hit the IP of pfsense wan - so again no routing is involved.
-
its an optical cable modem. Huawei. Configs are default from isp (they burnt a customized firmware, that wont work with any other changes, really a s**t)
However, I did the nat, and it works when coming from other device on that modem.
192.168.100.1 - Isp modem DHCP
192.168.100.10 - Proxmox (vmbr0)
192.168.100.6 - PfSense (inside Proxmox - vmbr0) WAN
192.168.100.12 - external devicevmbr1 - inside PFSense LAN
192.168.1.1 - PFsense dhcp
192.168.1.100 - my vm with 4444 port openfrom .12 i manage to connect to the nat port forward at PFSense, lets say 192.168.100.6:4444
from .10 i cant connect to 192.168.100.6:4444 (i can see packages arriving in PFSense with CLOSED:SYN_SENT)
-
Well if devices on your network behind pfsense have firewall.. Pfsense can send the traffic to this IP all day long - doesn't mean that box will answer..
Here is the thing - sniff on pfsense lan interface in pfsense. Do you see it send the traffic on that you port forward? If so then pfsense did what its suppose to do.. If you get not answer that is nothing pfsense can do about that.
-
PFSense is a brand new installation , clean of rules, only the nat rule for that port is configured
Why it accpets from one device, and not from another (proxmox)?
-
You could have an issue in promox where your using the same interface to try and talk to itself just with another IP..
Sniff on pfsense - does it see the traffic to its wan IP, does it port forward it?
-
-
@johnpoz said in Proxmox + PFSense conection port forward:
If proxmox had an IP in this 192.168.1 network
No, it hasn't as I understood. It has only an IP in 192.168.100.x
-
So pfsense sent the SYN to you dest box - if it doesn't answer what is pfsense suppose to do? Does that dest VM have pfsense as its gateway? Does it have a firewall? Is it even listening on that port? Did it even see the traffic pfsense sent it?
-
Dear @johnpoz
When Promox communicate with 192.168.100.6 (pfsense) the packages seems to be arriving at PFSense, verified by states print above.
The dest VM 192.168.1.100 have pfsense as its gateway 192.168.1.1, and it is listening, I also confirm that because I can reach it from 192.168.100.12
vm dest does not have firewall enable, its a raw ubuntu server
-
I reach it from the same nat rule .. it works from 192.168.100.12, but not from 192.168.100.10 (proxmox).
-
Pfsense doesn't care what the source IP is.. I suggest again - you sniff.
On pfsense lan sniff when you send data from the .10 address. Do you see pfsense send the packet - do you get a response?
If your saying it works from .12, but not .10 - pfsense has no care what the source is - it would treat the data exactly the same.. Other than something in proxmox.
So sniff and see exactly what is going on..
